TL;DR: DMARC is no longer optional for organisations that rely on email, according to Valimail, because monitoring alone does not stop spoofing or brand impersonation; the practical target is quarantine or reject enforcement, backed by SPF and DKIM alignment and ongoing reporting. DMARC governance is now an access-control problem for the inbox, not just an email hygiene task.
At a glance
What this is: This is Valimail's guidance on DMARC records, explaining how monitoring, quarantine, and reject policies change the way email receivers handle unauthenticated messages.
Why it matters: It matters because DMARC sits at the boundary between identity, trust, and fraud prevention, making email-domain governance a core control for human and non-human communications alike.
Context
DMARC is an email authentication control that tells receiving systems what to do when a message fails SPF or DKIM alignment. In practice, it governs whether unauthorised use of a domain is merely observed or actively blocked, which makes it part of brand protection, fraud reduction, and mailbox trust management.
The governance gap is that many organisations treat DMARC as a reporting exercise rather than a policy enforcement control. That leaves a visible but still exploitable impersonation path, especially where email remains a primary channel for customer, partner, and internal communications.
Key questions
A: Start by inventorying every authorised sender, including marketing, support, and transactional platforms, then validate SPF and DKIM for each one. Move policy gradually from none to quarantine and finally reject, while reviewing DMARC reports for failures. The goal is not faster enforcement, but accurate enforcement that blocks spoofing without disrupting real business mail.
Q: Why does weak DMARC adoption increase the risk of email fraud and brand impersonation?
A: Weak DMARC adoption leaves attackers with an easier path to forge messages that appear to come from a trusted domain. Without enforcement, fraudulent email can reach inboxes even when the domain owner did not send it. That creates a direct opening for phishing, payment fraud, and customer deception, especially when recipients rely on familiar branding instead of authentication.
Q: What breaks when a domain stays on p=none?
A: You still get reports, but you do not stop spoofed mail from arriving in inboxes. That means the organisation can observe abuse without containing it, which is useful for early rollout but unsafe as a permanent state. The longer the policy remains unchanged, the more likely attackers can exploit the gap between visibility and enforcement.
Q: How do security teams know whether DMARC enforcement is actually working?
A: Look for fewer authentication failures from legitimate senders, stable alignment for critical mail flows, and reporting that clearly shows why a message passed or failed. If failures cannot be explained quickly, the programme is not ready for stricter enforcement. Working DMARC is visible, reproducible, and backed by clean sender inventory.
Technical breakdown
How DMARC decides whether a message is trusted
DMARC works by checking whether the domain in the visible From address aligns with the authentication results from SPF and DKIM. SPF validates which servers may send on behalf of a domain, while DKIM signs the message so the receiving system can verify it has not been altered. DMARC then combines those signals and applies policy. If a message fails alignment, the receiver follows the domain owner's instruction: monitor, quarantine, or reject. That policy layer is what turns authentication from a passive signal into an enforcement decision. See the DMARC, SPF and DKIM Guide.
Practical implication: Treat DMARC policy as an enforcement control, not a reporting overlay.
Why p=none is not a security endpoint
A p=none policy tells receivers to deliver messages even when DMARC fails, while still generating reports. That is useful for discovery and staged rollout, but it does not stop spoofed mail from reaching users. In other words, p=none gives visibility without containment. The risk is that teams confuse operational insight with protection and leave the domain exposed while the reports accumulate. Quarantine narrows the blast radius, and reject is the control that stops the message from being delivered at all.
Practical implication: Move beyond monitoring once SPF and DKIM alignment is stable.
How DMARC reports support identity and fraud governance
DMARC aggregate and forensic reports show which sources are sending mail on behalf of a domain and whether those sources are passing or failing policy checks. That makes the control valuable for governance, because legitimate senders can be authorised and unexpected senders can be removed. For identity teams, the important point is that email reputation is tied to domain authority, not just mailbox credentials. If an attacker can impersonate the domain itself, the trust signal is stronger than a simple account compromise and often reaches more recipients. See the Email Identity and BEC Guide.
Practical implication: Use DMARC telemetry to inventory authorised mail sources and remove unapproved senders.
NHI Mgmt Group analysis
DMARC enforcement is a trust boundary, not an email housekeeping task. The article makes the right distinction between monitoring and enforcement, but the deeper governance point is that unauthorised domain use is an access problem at the message layer. Once a receiver trusts the From domain, the attacker can borrow brand authority without compromising the underlying mailbox. Practitioners should therefore treat DMARC policy as part of identity assurance for communications, not just deliverability tuning.
Mail authentication only becomes operationally meaningful when policy is enforced. SPF and DKIM can confirm some aspects of message legitimacy, but they do not by themselves decide what happens to failed mail. That decision belongs to DMARC, which means the control is only as effective as the policy chosen and the consistency of alignment across legitimate senders. Teams that stop at p=none have visibility but no containment, which is a governance gap rather than a technical success.
Brand impersonation is the fraud path that most directly exposes weak domain governance. The article correctly notes that spoofing erodes reputation, but the security consequence is broader: email remains a high-trust channel for business process abuse, payment fraud, and internal deception. Email identity and BEC guidance is relevant here because DMARC is strongest when it is paired with sender governance, mailbox protection, and verification of high-risk requests. Practitioners should align email policy with fraud controls, not leave them in separate queues.
DMARC creates a lifecycle problem, not a one-time configuration task. Publishing the record is only the start. New services, campaign tools, and delegated mail flows can quietly reintroduce unauthorised sending if they are not inventoried and authorised. That is why the governance model has to include review, reporting, and policy tightening over time. Practitioners should expect continuous change, not a static configuration milestone.
The named concept here is DMARC enforcement drift. Organisations often begin with a strong monitoring posture and then leave the policy unchanged while their sending ecosystem expands. Over time, the record no longer reflects the real mail estate, which weakens both protection and confidence in the reports. The practical conclusion is simple: reassess alignment and policy strength whenever the mail surface changes.
What this signals
DMARC enforcement drift: The real governance risk is not whether a record exists, but whether the policy still matches the live sending estate. As new marketing tools, SaaS applications, and delegated mail flows appear, the gap between recorded intent and operational reality widens unless teams keep reauthorising senders and tightening policy.
Email authentication should be treated as a fraud control with identity implications, not as a deliverability setting owned only by messaging teams. Once impersonation is in play, the issue extends into trust, verification, and business process abuse, which is why security, email operations, and fraud teams need the same source of truth.
For programmes that rely heavily on outbound communication, the next maturity step is to make sender authorisation and DMARC review part of broader identity governance. That brings email domains into the same control logic used for other high-trust credentials: known sources, explicit approval, continuous review, and rapid revocation when the source is no longer legitimate.
For practitioners
- Publish DMARC with a staged enforcement plan Start with monitoring only if you need discovery, but set a clear path to quarantine or reject once SPF and DKIM alignment are stable across legitimate senders.
- Inventory every authorised mail source Map all platforms, applications, and third-party services that send on your domain so unexpected sources do not remain hidden in aggregate reports.
- Validate alignment before tightening policy Check that SPF and DKIM are published, aligned, and working for each sending stream before moving from p=none to stronger enforcement.
- Use DMARC reports as governance evidence Review aggregate and forensic reports regularly to spot unapproved senders, prove which services are legitimate, and remove stale or rogue sources.
Key takeaways
- DMARC turns email-domain trust into an enforceable policy decision, which is why monitoring alone leaves organisations exposed to spoofing and impersonation.
- The article's own example shows that p=none is only a staging state, while quarantine and reject are the controls that actually constrain fraudulent mail.
- Teams should govern DMARC alongside sender inventory, SPF and DKIM alignment, and regular policy review so the record keeps pace with the live mail estate.
Related NHI Mgmt Group resources: Email Identity and BEC Guide · DMARC, SPF and DKIM Guide · NIST SP 800-53 Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-10 — Human Use of NHI | Email domains are often abused to impersonate trusted identities, making domain governance relevant to NHI misuse patterns. |
| Recommendation — Treat email-domain impersonation as a governance issue and restrict who can send on behalf of the domain. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | DMARC depends on the lifecycle and management of email authentication mechanisms and reporting controls. |
| Recommendation — Manage mail authentication records and review them as part of authenticator lifecycle governance. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | DMARC enforces who is authorised to present the organisation's domain in email traffic. |
| Recommendation — Align domain authorisation with PR.AA-05 so only approved senders can use the organisation's identity. | ||
| MITRE ATT&CK | TA0001;TA0006 — Initial Access; Credential Access | Phishing and impersonation are common entry paths that begin with trusted-looking email. |
| Recommendation — Map spoofing and phishing detection to TA0001 and TA0006 to prioritise fraudulent mail paths. | ||
Key terms
- DMARC: DMARC is an email authentication policy mechanism that uses DNS-published records to tell receiving mail systems how to handle messages that fail alignment checks. It helps reduce impersonation risk, but it only works when the published policy is accurate, current, and governed as part of the domain's security state.
- SPF: SPF is a DNS-based policy that lists which systems are permitted to send email on behalf of a domain. It helps mail receivers validate whether the sender matches the domain’s declared sources, reducing the chance of forged or impersonated messages.
- DKIM: DKIM is an email signing method that relies on a public key published in DNS to let receivers validate message integrity. In practice, the DNS record becomes part of the trust chain, so key management and DNS governance must stay aligned if organisations want reliable authentication.
- Email Spoofing: Email spoofing is the practice of making a message appear to come from a trusted sender when it does not. The technique relies on weak authentication and user trust, and it often supports phishing, fraud, and impersonation campaigns across business workflows.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. Explore the course when your programme needs a stronger operating model for identity, access, and governance.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org