TL;DR: Only 14.9% of over 73 million domains have implemented a basic DMARC policy and 2.5% enforce p=reject, leaving most domains exposed to spoofing and phishing that can impersonate trusted senders, according to Red Sift analysis. Email authentication only works when sender inventory, alignment and enforcement move together; monitoring without rejection is not a control.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Red Sift's blog post: Most domains still lack enforced DMARC, leaving spoofed email and brand impersonation insufficiently blocked.
Why it matters: IAM and security teams need to treat email domain protection as a governance problem across DNS, sender inventory and enforcement, not as a one-time mail setting.
By the numbers:
- only 14.9% have implemented even a basic DMARC policy
- Only 2.5% enforce the strictest protection level, p=reject
- roughly 84% of domains have no visible DMARC record at all
Context
DMARC is the policy layer that tells receiving mail servers what to do when SPF and DKIM checks fail. The governance problem is not the protocol itself, but incomplete sender inventory, misaligned ownership and reluctance to move beyond monitoring.
Most organisations already understand the concept, yet many stop at visibility instead of enforcement. That makes spoofing, phishing and brand impersonation operationally easier than the control architecture intends, especially when multiple business services send mail on the domain's behalf.
Key questions
A: Start by inventorying every authorised sender, including marketing, support, and transactional platforms, then validate SPF and DKIM for each one. Move policy gradually from none to quarantine and finally reject, while reviewing DMARC reports for failures. The goal is not faster enforcement, but accurate enforcement that blocks spoofing without disrupting real business mail.
Q: Should organisations rely on DMARC to stop phishing?
A: No. DMARC helps reduce spoofing, but it does not stop attacks that use valid infrastructure, collaboration channels, or post-delivery manipulation. Organisations should keep DMARC in place, but measure phishing resilience across the whole delivery chain, including session abuse, channel trust, and user action after delivery.
A: The clearest signs are a persistent p=none policy, incomplete sender inventory, unresolved SPF or DKIM alignment problems, and reports showing unknown services sending as the domain. If the organisation can describe DMARC but cannot say which systems are authorised to send mail, the control is still descriptive rather than protective.
Q: Who should own DMARC enforcement in an organisation?
A: DMARC enforcement should be jointly owned by security and the teams operating domain-based mail services. Security should define the policy and monitoring expectations, while platform or messaging teams validate legitimate senders and fix alignment issues. That split keeps deliverability, fraud prevention, and change control tied to one operating model.
Technical breakdown
Why SPF and DKIM alignment still breaks in real environments
SPF authorises source IP addresses, while DKIM signs message content so recipients can verify integrity. DMARC requires alignment between the visible From domain and at least one authenticated mechanism, so the receiving system can decide whether the message is genuinely from the claimed sender. The hard part is not the standard. It is the sender sprawl created by marketing platforms, CRM tools, ticketing systems and outsourced mail services that all need to be mapped correctly. One missed sender can break legitimate mail, which is why teams leave policy in monitor-only mode. See the DMARC, SPF and DKIM Guide.
Practical implication: Build a complete sender inventory before tightening policy, or enforcement will fail in production.
Why p=none is a visibility state, not a control
A DMARC policy of p=none still publishes reporting instructions, but it does not direct receivers to quarantine or reject unauthenticated mail. That makes it useful for discovery and validation, yet ineffective as a blocking mechanism. Many teams mistake reporting for protection because the records exist and aggregate reports are arriving. In practice, p=none simply shows you what would happen if you enforced policy. Until the policy escalates to quarantine or reject, the domain remains usable for spoofing and impersonation.
Practical implication: Treat p=none as a temporary transition state and set a deadline for policy escalation.
How attacker use of trusted domain infrastructure bypasses user awareness
When attackers spoof a known domain, they do not need to defeat user training first. They inherit trust from the domain name itself, which can make phishing messages more credible than generic spoofing attempts. That is why email authentication belongs in identity governance, not only in mail operations. The identity signal is the domain's ability to assert who may send on its behalf. When that signal is weak, users, customers and downstream systems all become more exposed to impersonation and fraudulent workflow manipulation. See the Email Identity and BEC Guide.
Practical implication: Tie domain authentication to the same governance model you use for privileged access and delegated trust.
Threat narrative
Attacker objective: The attacker wants to use the organisation's domain identity to make phishing or fraud messages appear legitimate enough to trigger user action.
- Entry occurs when an attacker sends a spoofed message that appears to originate from the organisation's domain, exploiting weak or absent DMARC enforcement.
- Escalation follows when recipients trust the forged sender identity and act on the message, especially in customer-facing or payment-related workflows.
- Impact is achieved when the spoofed mail drives credential theft, fraudulent payment activity or brand damage before the deception is recognised.
Breaches seen in the wild
- Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
DMARC enforcement is now an identity governance issue, not just an email deliverability issue. Once a domain can claim sender identity, it becomes part of the broader trust fabric that customers, partners and internal systems rely on. A policy that stops at monitoring leaves that trust ungoverned, which is why security teams should treat email authentication as a control boundary, not a messaging preference.
Sender sprawl is the real reason DMARC stalls: the technical standard is simple, but modern organisations rarely have a single sender path. Marketing automation, support systems and finance platforms all create separate authentication dependencies, and one unmanaged service can hold policy back for months. This is the same governance pattern seen in other identity programmes, where delegated access outgrows the team that owns it.
Domain spoofing works because the trusted identity is the brand itself: attackers do not need a system compromise if they can borrow the visible trust signal. Email identity and BEC becomes relevant here because the operational failure is not email transport, but unmanaged authority to send as the organisation. Practitioners should treat sender validation as a prerequisite for any meaningful anti-phishing posture.
Maintenance is the control, not the record: DNS publishing is only the starting point. New services appear, third-party settings drift and old senders stay connected long after they should be removed. The governance lesson is that email authentication behaves like a lifecycle process, so teams must own inventory, review and enforcement together rather than as disconnected tasks.
What this signals
Email authentication debt: organisations often think they have a DMARC programme because a record exists, but the control only becomes real when sender inventory, policy escalation and ongoing maintenance are managed as one lifecycle. That is the operational threshold practitioners should watch, because every new SaaS sender adds another place where trust can drift.
The broader signal is that email identity now sits on the same governance spectrum as delegated access and privileged trust. If teams cannot answer which services may send on behalf of the domain, they do not have a deliverability issue, they have an identity boundary problem.
For practitioners
- Map every authorised sender Inventory every platform, service and third party that sends email on behalf of the domain, then verify SPF and DKIM alignment for each one before changing policy.
- Escalate from monitor-only to enforcement Move DMARC from p=none to p=quarantine and then p=reject only after legitimate senders are confirmed and reporting is stable.
- Use aggregate reports to find shadow senders Review DMARC aggregate reports to identify unauthorised or forgotten services that are still sending as the domain, including legacy business tools and external platforms.
- Align email authentication with identity governance Assign clear ownership for domain authentication so IT, security and marketing are not each assuming another team will handle the controls.
Key takeaways
- Most domains still fail to enforce DMARC, which leaves spoofing and phishing able to exploit trusted domain identity.
- The central evidence is not just low adoption, but the large number of domains that remain stuck at monitor-only posture instead of blocking unauthorised senders.
- Practitioners need sender inventory, policy escalation and ongoing maintenance to turn email authentication into a real control.
Related NHI Mgmt Group resources: DMARC, SPF and DKIM Guide · Email Identity and BEC Guide · Workforce Identity Security Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | Weak DMARC enforcement lets attackers abuse domain authentication and impersonate trusted senders. |
| Recommendation — Tighten sender authentication controls so unauthorised mail cannot pass as a trusted domain. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | DMARC governance is about who is authorised to send under the domain's identity. |
| Recommendation — Define and enforce authorised senders as part of your identity and access governance model. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article centers on managing authorised senders and removing forgotten services. |
| Recommendation — Maintain a current inventory of every system allowed to send on behalf of the domain. | ||
| MITRE ATT&CK | TA0006 — Credential Access | Phishing and spoofing are the entry paths that DMARC is meant to disrupt. |
| Recommendation — Map spoofed-domain phishing to TA0006 and prioritise controls that block impersonation at delivery. | ||
Key terms
- DMARC None Policy: DMARC None Policy is a monitoring-only DMARC setting that asks receivers to report authentication results without changing delivery. It helps domain owners discover legitimate and abusive sources before enforcement. Attackers can still deliver spoofed mail if no stronger policy is applied, so organisations should use the reports to fix alignment and prepare for quarantine or reject.
- Sender Inventory: A sender inventory is the complete list of services, applications, and systems authorized to send email for a domain. It is the governance baseline for DMARC because enforcement is only safe when every legitimate sender has been identified, authenticated, and mapped to an owner.
- Email Authentication Alignment: Email authentication alignment is the match between the domain visible to recipients and the domain validated by SPF, DKIM and DMARC. When those signals do not line up, a message may be technically sent but still fail trust checks and lose deliverability.
- DMARC Aggregate Reporting: Aggregate reporting is the high-level DMARC feedback stream that summarizes authentication results across sources and receivers. It is used to spot trends, unknown senders, and policy failures at scale, but it only works when the schema is consistent and the data pipeline is normalized.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, identity lifecycle and secrets management. It helps practitioners connect identity controls to the broader trust boundaries their programmes depend on.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org