DMARC enforcement lags across southeast organisations despite high exposure

At a glance

What this is: Red Sift's Southeast DMARC review shows most top organisations have published authentication controls, but only 39% have moved to enforcement that blocks spoofed email.

Why it matters: For IAM and security teams, the finding shows that email identity controls still fail at the final policy step, leaving supplier, payment, and brand impersonation risk open across business-critical workflows.

By the numbers:

• Red Sift analyzed 600 domains across six Southeast states and found only 236, or 39%, reached DMARC enforcement.
• Red Sift found 157 domains, or 26.2%, running p=none policies that monitor spoofing but take no action.
• Red Sift reported 145 domains, or 24.2%, sitting at p=quarantine, close to protection but not yet rejecting spoofed mail.
• Red Sift found 62 domains, or 10.3%, have no DMARC record published at all.

Context

DMARC enforcement is the point at which published email authentication policy starts blocking spoofed mail instead of only observing it. In practice, many organisations have SPF and DKIM in place, but stop short of the final policy change that turns email identity signals into enforcement. In the Southeast, that matters because email still carries supplier invoices, freight instructions, payment changes, and sensitive operational workflows.

The article frames a governance gap, not a technical discovery gap. Most organisations have started authentication work, but many have not completed the transition from monitoring to reject, leaving email identity weak at the point where business processes depend on trust. That pattern is familiar in identity programmes: the control exists, but the lifecycle step that makes it effective is left unfinished.

Key questions

Q: What breaks when DMARC is not enforced for brand email?

A: Without DMARC enforcement, mailbox providers can still deliver or partially trust spoofed mail that appears to come from your domain. That leaves customers exposed to impersonation and leaves legitimate campaigns competing with abuse for inbox placement. The governance failure is not the record itself, but the absence of a blocking policy tied to authorised senders.

Q: Why does p=quarantine still leave organisations exposed to spoofed email?

A: Quarantine reduces risk but does not eliminate it, because suspicious mail is still delivered into a workflow that may be reviewed, released, or ignored. That creates a residual trust window. In practice, only reject removes the spoofed message from normal user handling and makes the policy a true blocking control.

Q: How should security teams implement DMARC enforcement across multiple email senders?

A: Start by inventorying every system that sends mail for the domain, then validate SPF and DKIM for each one before moving from monitoring to quarantine or reject. The goal is not simply blocking spoofing, but establishing a clear authorised-sender list that can survive vendor sprawl and email lifecycle changes.

Q: Who owns the move from DMARC monitoring to enforcement?

A: Ownership usually sits with email security or identity governance, but the decision also depends on finance, operations, and application owners who depend on the domain. The key accountability issue is that no one should let p=quarantine become permanent without a business-approved enforcement date.

Technical breakdown

Why DMARC monitoring does not stop spoofed email

DMARC has three policy states: p=none, p=quarantine, and p=reject. p=none only collects reports, so spoofed messages can still reach inboxes. p=quarantine moves suspicious mail to a lower-trust destination, but it still leaves room for user interaction and exception handling. Only p=reject turns authentication into a hard control. The article's point is that many organisations have already done the DNS setup, sender discovery, SPF alignment, and DKIM work. The remaining gap is policy enforcement, not protocol deployment.

Practical implication: Treat DMARC as a lifecycle control, not a checkbox, and move systems from reporting to reject once legitimate senders are mapped.

Why the quarantine stage is a governance bottleneck

Quarantine is often where programmes stall because teams believe the hard part is over. Operationally, quarantine means the organisation has enough visibility to identify unauthenticated mail, but has not accepted the governance decision to block it outright. That leaves a gap between technical readiness and policy commitment. In identity terms, this resembles a system that has identified risk but not enforced the control. The article suggests many Southeast organisations are sitting in that halfway state, which is why the region looks better than no-record areas but still falls short of real protection.

Practical implication: Use quarantine as a short transition state with a dated exit criteria, not as a steady-state control.

How email authentication supports payment and supplier trust

Email authentication is not just a mail hygiene issue. It is an identity signal that helps receivers judge whether a domain really controls the messages it sends. That matters where email drives purchase orders, shipping updates, invoice changes, and payroll or payment instructions. When a manufacturer, logistics firm, or financial organisation leaves spoofing windows open, attackers can impersonate trusted counterparties and inject false instructions into business processes. The article's regional analysis shows why this risk is especially acute in the Southeast, where operational dependency on email is tied directly to money movement and supply-chain execution.

Practical implication: Prioritise enforcement on domains that support money movement, shipping, procurement, and customer communications.

Threat narrative

Attacker objective: The attacker wants recipients to trust a fake sender identity enough to redirect payments, alter logistics, or manipulate business workflows.

1. Entry occurs through domain spoofing, where an attacker sends email that appears to come from a trusted Southeast organisation.
2. Credential harvesting is not the point here; the abuse comes from trust in the sender identity and weak DMARC enforcement.
3. Impact follows when recipients act on fraudulent invoice, freight, or payment instructions before the spoof is detected.

Breaches seen in the wild

• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Email authentication is now an identity governance problem, not just a mail security problem. DMARC enforcement determines whether a domain can prove message origin at the point of use. In regions where procurement, logistics, and payments still depend on inbox trust, incomplete enforcement leaves a governance gap that attackers can exploit. Practitioners should treat email domain identity as part of access trust, not a separate hygiene task.

Half-finished controls create the most misleading risk picture. Organisations sitting in p=quarantine often look better on paper than they are in practice, because they have not actually closed the spoofing path. That creates false confidence for security leaders who think the hardest part is complete. The real issue is policy finalisation, and that is where many identity programmes fail under operational pressure.

Verification trust gap: the distance between authentication being configured and authentication being enforced. This article shows that the gap is especially dangerous in sectors where email carries money, freight, and supplier instructions. Once a business process depends on sender identity, reject policy becomes a control on transaction integrity, not just mailbox spam.

Regional averages can hide sector-specific exposure. A 39% enforcement rate may look mid-pack across the United States, but the Southeast's concentration of manufacturing, logistics, payments, and defense makes the residual risk more material than the number suggests. Security teams should rank domains by business criticality, not by DNS status alone, and close the highest-value gaps first.

The final mile is where governance beats configuration. Most organisations in the study have already published DMARC, SPF, and DKIM. What separates protected from exposed domains is the willingness to move from monitoring to enforcement and sustain that decision as mail ecosystems change. That is a governance discipline, and identity teams should manage it like any other privileged policy.

From our research library:

• The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.

What this signals

DMARC enforcement exposes a broader identity control pattern. Many organisations are comfortable publishing records and collecting reports, but struggle to convert evidence into blocking policy. That same pattern appears in other identity programmes, where visibility is mistaken for control until the final enforcement step is made.

The Southeast's exposure is concentrated in the workflows attackers value most. Manufacturing, logistics, payments, and defense all rely on trusted email exchanges, so spoofing risk is not evenly distributed across the region. Security teams should align DMARC rollout priorities with transaction criticality, not with domain ownership alone.

For practitioners

• Prioritise reject on business-critical domains Move domains that support payments, invoices, shipping, procurement, and customer communications from monitoring to reject before less critical mail streams.
• Time-box quarantine as a transition state Set explicit exit criteria for p=quarantine and review them weekly so the control does not become an indefinite holding pattern.
• Map every legitimate sender before enforcement Inventory all third-party services, marketing tools, ERP systems, and outsourced mailers that send on behalf of the domain, then align SPF and DKIM before flipping the policy.
• Monitor for high-value spoofing targets Watch for domains tied to finance, logistics, and supplier relationships because those are the workflows most likely to be abused when authentication is weak.

Key takeaways

• The core problem is not whether organisations know about DMARC, but whether they finish the move from monitoring to reject.
• The article shows a region where most domains have started authentication work, yet a majority still do not block spoofed mail.
• For practitioners, the lesson is to treat email identity enforcement as a business integrity control and prioritise the domains that move money and goods.

Key terms

• DMARC: DMARC is an email authentication policy mechanism that uses DNS-published records to tell receiving mail systems how to handle messages that fail alignment checks. It helps reduce impersonation risk, but it only works when the published policy is accurate, current, and governed as part of the domain's security state.
• p=reject: A DMARC policy that tells receiving mail systems to refuse messages that fail authentication checks for the domain. It is the strongest DMARC setting because it prevents spoofed mail from entering normal user workflows.
• p=quarantine: A DMARC policy that flags failed messages for lower-trust handling instead of outright delivery. It reduces risk, but it can still leave room for user review, release, or exception handling, so it is not the same as full blocking.
• Business email compromise: A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners connect lifecycle control to broader access and trust decisions.