FTSE 250 DMARC enforcement still leaves a spoofing gap

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Red Sift's research: Most FTSE 250 firms have DMARC enforcement, but a sizeable minority still leave spoofing and impersonation paths open.

Why it matters: For IAM and email security teams, DMARC at p=reject is the point where authentication becomes enforceable protection rather than reporting-only visibility.

By the numbers:

• 152 of 250 FTSE 250 organisations (60.8%) have reached DMARC enforcement at p=reject
• 47 organisations (18.8%) run p=none policies that monitor traffic but take no action against spoofed email
• 33 organisations (13.2%) sit at p=quarantine, sending suspicious messages to spam rather than blocking them outright
• 98 of the UK's largest mid-cap companies (39.2%) are not yet at full enforcement

Context

DMARC is the email authentication policy that tells receiving mail servers how to handle messages that fail SPF or DKIM checks. In practice, the control only blocks spoofing when the published policy reaches p=reject; anything weaker still leaves room for unauthorised mail to be delivered.

The governance problem is not whether organisations have heard of DMARC, but whether they have completed sender discovery, alignment, and policy enforcement across every legitimate mail stream. That is where many programmes stall, especially when marketing, HR, payroll, CRM and support systems all send on behalf of the same domain.

Key questions

Q: What breaks when DMARC is not enforced for brand email?

A: Without DMARC enforcement, mailbox providers can still deliver or partially trust spoofed mail that appears to come from your domain. That leaves customers exposed to impersonation and leaves legitimate campaigns competing with abuse for inbox placement. The governance failure is not the record itself, but the absence of a blocking policy tied to authorised senders.

Q: Why do partial DMARC deployments still leave phishing risk?

A: Partial deployment leaves a trust gap because receivers may still deliver unauthenticated mail, especially when policies stop at none or quarantine. Attackers exploit that gap by using the brand name, not the protocol state. The risk persists until all legitimate senders authenticate and the domain can safely block failures.

Q: What do security teams get wrong about SPF, DKIM, and DMARC?

A: They often deploy them as isolated email settings instead of treating them as enforcement controls for domain identity. SPF, DKIM, and DMARC only work well when they are tuned together, monitored continuously, and backed by an operational process that responds to failure reports and configuration drift.

Q: How do security teams know whether DMARC enforcement is actually working?

A: Look for fewer authentication failures from legitimate senders, stable alignment for critical mail flows, and reporting that clearly shows why a message passed or failed. If failures cannot be explained quickly, the programme is not ready for stricter enforcement. Working DMARC is visible, reproducible, and backed by clean sender inventory.

Technical breakdown

Why p=none still leaves spoofing risk

DMARC p=none is reporting only. Receiving systems can see the policy and send reports back to the domain owner, but unauthenticated mail is still delivered, which means the organisation gets visibility without control. That is useful for discovery, but it does not stop impersonation, business email compromise, or brand abuse. In operational terms, p=none often means the team knows where the problems are but has not resolved every legitimate sender, every alignment issue, or every downstream dependency needed to enforce safely. Practical implication: treat p=none as a transitional state and not as a meaningful anti-spoofing control. See the DMARC, SPF and DKIM Guide.

Practical implication: Treat p=none as a transitional state and not as a meaningful anti-spoofing control.

Why quarantine is still not full protection

DMARC p=quarantine moves suspicious messages to spam instead of blocking them outright. That reduces exposure, but it still relies on mailbox provider behaviour, user settings, and local reputation signals, which can vary across recipients. A malicious message may land in junk for one user and the inbox for another. Quarantine is therefore a partial enforcement model, not an end state. It is operationally safer than monitoring only, but it still allows an attacker to test delivery and iterate a campaign until it reaches the inbox. Practical implication: use quarantine as a staged checkpoint before reject, not as a long-term destination.

Practical implication: Use quarantine as a staged checkpoint before reject, not as a long-term destination.

How DMARC ties SPF and DKIM into a usable policy

SPF and DKIM are necessary but insufficient on their own. SPF says which servers may send for a domain, and DKIM signs messages so receivers can verify integrity. DMARC adds the policy layer that instructs receivers what to do when those checks fail, while also requiring alignment between the authenticated identity and the visible From domain. Without that policy layer, organisations can have authentication data without enforceable anti-spoofing behaviour. Practical implication: verify that every legitimate sending source authenticates correctly and aligns before enforcing reject, otherwise the policy will break mail or fail open. See the Email Identity and BEC Guide.

Practical implication: Verify that every legitimate sending source authenticates correctly and aligns before enforcing reject.

Threat narrative

Attacker objective: The attacker wants to exploit trusted brand identity in email to steal money, capture credentials, or move a fraudulent request through internal and customer workflows.

1. Entry occurs when an attacker sends email that impersonates a trusted FTSE 250 domain and targets recipients who rely on the brand name alone.
2. Credential or trust abuse follows when the recipient believes the sender is legitimate and opens the message, clicks a link, or follows a payment instruction.
3. Impact occurs when spoofed mail enables business email compromise, invoice fraud, or brand-damaging phishing at scale.

NHI Mgmt Group analysis

DMARC enforcement is the real control boundary, not DMARC publication. Publishing a record without moving to p=reject creates an observability layer, not a protective one. That distinction matters because attackers care about delivery, not policy intent. For practitioners, the governance question is whether email authentication has actually become enforceable across every sender, not whether the domain has started the project.

FTSE 250 maturity shows that partial progress can still leave a broad impersonation surface. The index may be ahead of some regional benchmarks, but 39.2% not yet at full enforcement is still a large exposed population for a group with real brand reach and external trust dependencies. The named concept here is DMARC completion gap: the distance between publishing authentication signals and enforcing them across all legitimate senders. Practitioners should measure that gap as a programme failure state, not a technical detail.

Email authentication is now a supplier assurance issue as much as an anti-phishing issue. The article’s supply chain point is important: mid-cap firms sit inside larger customer ecosystems and inherit security expectations from them. That means DMARC is increasingly part of the trust profile that other organisations evaluate. For identity and access teams, this is another example of a control that crosses internal security and external assurance boundaries.

Consumer-facing mid-caps are being judged on deliverability, fraud resistance, and trust at the same time. Mailbox provider enforcement, customer communications, and fraud prevention now intersect in one control set. That raises the governance bar because failure can show up as blocked legitimate mail, more successful impersonation, or both. Practitioners should manage DMARC as a lifecycle control with operational ownership, not as a one-time DNS change.

What this signals

DMARC completion gap: organisations do not fail because they lack a record, but because they stop short of making policy enforceable across the full sending estate. That is the point at which email identity becomes operational rather than symbolic.

For practitioners, the next governance question is whether email authentication is owned as a domain-level control or scattered across marketing, IT, and outsourced services. The more distributed the sending estate, the more important sender inventory, alignment testing, and exception management become.

A p=reject policy is only durable when new services are caught early enough to authenticate before they ship mail. Continuous monitoring matters because the risk reappears whenever a new platform starts sending under the brand without being folded into the control model.

For practitioners

• Audit every mail source that uses your domain Use DMARC aggregate reports to inventory marketing, payroll, HR, CRM, support, and third-party services sending on your behalf. The practical goal is to find every legitimate sender before enforcement changes anything.
• Move from visibility to enforcement in stages Tighten alignment, fix authentication failures, then move from p=none to p=quarantine and finally p=reject. Keep each step reversible until you have evidence that legitimate mail is passing cleanly.
• Treat unowned senders as an identity governance problem Any system that can send email as your brand is effectively operating under your domain identity. Make a named owner accountable for each sender and remove services that cannot authenticate properly.
• Validate DMARC alongside SPF and DKIM Check that authentication and alignment work together, not just in isolation. A domain can publish all three records and still leave spoofing paths open if the visible From identity does not align with the authenticated source.

Key takeaways

• DMARC reduces spoofing only when policy moves from monitoring to enforcement across every authorised sender.
• The FTSE 250 data shows a meaningful enforcement gap remains, even among organisations with mature security functions.
• The practical control issue is sender inventory, alignment, and ownership, not merely whether a DMARC record exists.

Related NHI Mgmt Group resources: DMARC, SPF and DKIM Guide · Email Identity and BEC Guide · Email Security Guide

Key terms

• DMARC: DMARC is an email authentication policy mechanism that uses DNS-published records to tell receiving mail systems how to handle messages that fail alignment checks. It helps reduce impersonation risk, but it only works when the published policy is accurate, current, and governed as part of the domain's security state.
• p=reject: A DMARC policy that tells receiving mail systems to refuse messages that fail authentication checks for the domain. It is the strongest DMARC setting because it prevents spoofed mail from entering normal user workflows.
• p=quarantine: A DMARC policy that flags failed messages for lower-trust handling instead of outright delivery. It reduces risk, but it can still leave room for user review, release, or exception handling, so it is not the same as full blocking.
• p=none: p=none is the DMARC monitoring posture that reports on sender behavior without changing mail flow. It is useful only when teams actively review the data, because leaving it in place without governance turns visibility into a passive state instead of a decision-making control.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. Explore the course if you are responsible for identity governance, secrets, or workload trust.