DMARC enforcement lags across the Southwest despite high-value targets

At a glance

What this is: Red Sift’s regional analysis shows that DMARC enforcement remains incomplete across the Southwest, with 40% of 500 domains at p=reject and many high-value organisations still accepting spoofed email.

Why it matters: This matters because email impersonation remains a direct path into fraud, supply-chain compromise and credential theft, and identity teams need to treat domain authentication as part of access governance, not just mail hygiene.

By the numbers:

• Only 201 of 500 domains across five Southwest states have reached DMARC enforcement (p=reject).
• 138 domains across the region run p=none policies that monitor but take no action against spoofed emails.
• 114 domains sit at p=quarantine, close to full protection but not finishing the move to reject.
• 47 domains have no DMARC record published at all.

Context

DMARC enforcement is the point at which email authentication stops being advisory and starts blocking spoofed messages. In practice, many organisations still treat SPF, DKIM and DMARC as mailbox settings rather than as controls over who can legitimately speak for the domain, which leaves room for impersonation even when some monitoring exists. DMARC, SPF and DKIM is the baseline here.

The Southwest matters because it combines major technology firms, gaming and hospitality revenue, and strategic government and defence operations. That mix turns email identity into a governance issue for fraud prevention, procurement integrity and trusted communications, not just a messaging configuration problem.

A region can have strong local pockets of maturity and still remain exposed if enforcement stops at monitoring or quarantine. That is the pattern this analysis reveals: partial progress, uneven execution and a large residual spoofing window.

Key questions

Q: What breaks when organisations delay DMARC enforcement?

A: Delayed enforcement leaves hidden sender dependencies undiscovered until a mailbox provider begins rejecting mail. That can expose spoofing paths, stale sending systems, and misaligned domains at the same time, which creates both security risk and business disruption. Moving early lets teams find and fix alignment issues before delivery fails broadly.

Q: Why do p=none and p=quarantine leave organisations exposed?

A: p=none and p=quarantine are useful transitional states, but they still allow many spoofed messages to reach users. They provide telemetry and some filtering, yet they do not create the hard refusal that blocks impersonation. If teams stay in those states too long, they create the illusion of progress while leaving the organisation open to abuse.

Q: How should security teams implement DMARC enforcement across multiple email senders?

A: Start by inventorying every system that sends mail for the domain, then validate SPF and DKIM for each one before moving from monitoring to quarantine or reject. The goal is not simply blocking spoofing, but establishing a clear authorised-sender list that can survive vendor sprawl and email lifecycle changes.

Q: What should security teams verify before moving a domain to reject?

A: Before moving to reject, teams should verify every legitimate sender, confirm SPF and DKIM alignment, and remove or reconfigure stale sources that still send on behalf of the domain. If the sender inventory is incomplete, enforcement will break legitimate mail and create pressure to roll the policy back. Good enforcement depends on governance of authorised senders, not just record changes.

Technical breakdown

Why p=none leaves spoofing risk intact

A DMARC policy of p=none tells receivers to collect reports but not to reject or quarantine unauthenticated mail. That is useful for visibility, but it does not enforce domain impersonation protection. The core technical failure is that the organisation learns where spoofing comes from without changing the inbox outcome. For large organisations with many senders, p=none often persists because teams want telemetry before enforcement, but telemetry without follow-through leaves the domain usable for phishing and business email compromise. Practical implication: treat p=none as a temporary staging state, not an operational end state. See the DMARC, SPF and DKIM Guide.

Practical implication: Move domains out of p=none on a defined schedule, otherwise reporting becomes a substitute for protection.

How SPF and DKIM support DMARC enforcement

DMARC only works when SPF and DKIM alignment can reliably prove that a message truly comes from the domain it claims. SPF checks which systems may send, while DKIM adds a cryptographic signature that survives transit and supports authentication alignment. When sender inventories are long, delegated, or fragmented across marketing, payroll, booking and procurement systems, enforcement becomes harder because each legitimate sender must be identified and aligned. That is why many organisations stall at quarantine. Practical implication: inventory every authenticated sender before raising policy to reject, or legitimate mail will break and enforcement will be rolled back.

Practical implication: Map all authorised senders before tightening policy, especially where third-party platforms send on the domain’s behalf.

Why domain impersonation is an identity governance problem

Email domains function as identity surfaces because users, partners and payment workflows trust the sender name long before they inspect technical headers. When a spoofed domain reaches the inbox, the attacker is borrowing organisational identity to trigger action, whether that action is a wire transfer, credential entry or document approval. This is why email authentication sits adjacent to IAM rather than outside it: the control protects the identity asserted by the communication channel. Practical implication: include DMARC posture in identity and fraud governance reviews alongside privileged access and third-party trust controls. See the Email Identity and BEC Guide.

Practical implication: Bring DMARC posture into identity governance and fraud reviews, not only into messaging administration.

Threat narrative

Attacker objective: Exploit trusted email identity to trigger fraud, credential theft or supply-chain compromise before recipients can verify the sender.

1. Entry occurs when an attacker sends spoofed email from a lookalike or impersonated domain that the recipient trusts by appearance alone.
2. Credential harvesting or fraud follows when the message drives the recipient to pay an invoice, approve a transfer, or disclose login details.
3. Impact is achieved when the organisation’s domain identity is used to move money, steal credentials or extend trust into downstream systems.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

DMARC enforcement is now an identity governance control, not a mail-server preference. When domains are used to authorise payments, procurement messages and account recovery flows, spoofing becomes an access problem as much as a messaging problem. That means security teams should assess enforcement as part of the organisation’s trust boundary, especially where external parties act on email instructions. The practical conclusion is simple: if a domain can still be impersonated, the identity boundary is still soft.

Partial deployment creates a false sense of protection. Organisations that stop at p=none or p=quarantine often have visibility, but not refusal. That is the governance gap this regional data exposes, because the policy may look mature while the inbox remains permissive. The practitioner lesson is to measure enforcement by blocking effect, not by the presence of a DMARC record alone.

The Southwest’s industry mix makes spoofing risk commercially asymmetric. Technology firms, gaming operators, hospitality groups and defence-linked organisations all depend on trusted email at different points in their operating model. A weak DMARC posture in any one of those sectors can create disproportionate downstream loss because attackers only need one convincing impersonation to start the chain. Practitioners should therefore prioritise enforcement where email drives money movement or sensitive operational approvals.

SMTP authentication gaps should be read alongside third-party trust, not in isolation. If vendors, contractors or service providers can send on behalf of the organisation without strong alignment controls, the spoofing problem extends beyond the company’s own mailbox estate. That makes DMARC part of a broader identity trust model, where delegated communication rights must be explicitly governed and continuously reviewed.

Staging to reject is a governance decision about tolerance for ambiguity. The article’s data shows that many organisations are close to full enforcement but have not crossed the final line. That final step is not technical complexity so much as operational discipline, because reject forces sender inventory cleanup and exception management. The practitioner conclusion is to close the loop on sender ownership before exposure becomes the business default.

What this signals

Email identity drift: Regional DMARC reporting often shows a gap between visibility and actual refusal. That gap matters because teams can believe they have control maturity when they only have telemetry, so the real governance question is whether unauthenticated mail is being blocked or merely observed.

A practical programme should treat sender inventory as an ongoing identity control surface. As new SaaS platforms, payment workflows and external communication channels are added, the risk is not just misconfiguration but unauthorised expansion of who can legitimately speak for the organisation.

Where trusted email drives money movement, procurement or sensitive operational approvals, weak authentication becomes a fraud enabler rather than a mail hygiene issue. That is why DMARC posture should be reviewed alongside business email compromise defences and third-party trust reviews.

For practitioners

• Tighten DMARC policy from monitoring to rejection Set a dated transition plan for domains still at p=none or p=quarantine, with explicit owner sign-off for each sending source before moving to reject.
• Inventory every legitimate sender Build a current list of all systems, vendors and business units sending mail on the domain so SPF and DKIM alignment can be validated before enforcement changes.
• Treat email impersonation as fraud exposure Bring business email compromise scenarios into fraud and identity governance reviews where payments, vendor onboarding and account recovery depend on email trust.
• Monitor for unauthenticated mail sources Review DMARC aggregate reports for sources that are still sending without alignment and retire or reconfigure them before they become an enforcement blocker.

Key takeaways

• The core risk is not just spoofed email, but the ability to impersonate an organisation’s identity in workflows that trigger payment, access or trust decisions.
• The article’s data shows a large residual enforcement gap, with many domains still monitoring or quarantining instead of blocking unauthenticated mail.
• The most effective response is to treat DMARC as an identity governance control and complete the move to reject only after sender inventories and alignments are verified.

Related NHI Mgmt Group resources: Email Identity and BEC Guide · DMARC, SPF and DKIM Guide · CWE Top 25 Guide

Key terms

• DMARC: DMARC is an email authentication policy mechanism that uses DNS-published records to tell receiving mail systems how to handle messages that fail alignment checks. It helps reduce impersonation risk, but it only works when the published policy is accurate, current, and governed as part of the domain's security state.
• Email Authentication Alignment: Email authentication alignment is the match between the domain visible to recipients and the domain validated by SPF, DKIM and DMARC. When those signals do not line up, a message may be technically sent but still fail trust checks and lose deliverability.
• Business email compromise: A form of social engineering where an attacker impersonates a trusted person or domain to manipulate payment, change banking details, or extract sensitive information. It often succeeds without malware because the attacker targets process trust and human judgement instead of technical controls.
• Sender Inventory: A sender inventory is the complete list of services, applications, and systems authorized to send email for a domain. It is the governance baseline for DMARC because enforcement is only safe when every legitimate sender has been identified, authenticated, and mapped to an owner.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect identity controls to the broader security decisions their programmes depend on.