Heartland critical infrastructure still lags on DMARC enforcement

At a glance

What this is: Red Sift’s regional analysis shows that DMARC enforcement across the Heartland is still incomplete, with most top organisations not yet blocking spoofed email.

Why it matters: That matters because energy, defence, agriculture, and research organisations depend on email for approvals and payments, so weak email authentication remains a direct fraud and impersonation risk.

By the numbers:

• Only 328 of 900 domains across nine Heartland states have reached full DMARC enforcement.
• 287 domains, or 31.9%, run p=none policies that monitor but take no action against spoofed emails.
• 202 domains, or 22.4%, sit at p=quarantine, close to full protection but not finishing the move to reject.
• 83 domains, or 9.2%, have no DMARC record published at all.

Context

DMARC is the policy layer that decides whether unauthenticated mail is delivered, quarantined, or rejected. In practice, the difference between monitoring and enforcement is the difference between seeing spoofing attempts and stopping them before they reach users. The Heartland case is a reminder that email authentication is still uneven even where operational trust is high.

The regional exposure is not abstract. Energy, agriculture, defence, and research organisations depend on email to move payment instructions, supplier confirmations, procurement requests, and other sensitive workflows. When a top-domain portfolio remains at p=none or no policy, impersonation risk stays open across DMARC, SPF and DKIM.

Key questions

Q: What breaks when DMARC stays at monitoring mode?

A: When DMARC remains at p=none, the organisation gains visibility but not protection. Fraudulent or unauthorised messages can still be delivered, which means impersonation risk stays active even if reporting looks healthy. The control only changes behaviour once quarantine or reject is enabled for domains that have been fully validated.

Q: When should organisations prioritise DMARC over more user-awareness training?

A: Prioritise DMARC when spoofed mail, brand impersonation, or executive lookalike abuse is a recurring risk. Awareness training helps people notice suspicious messages, but DMARC changes whether spoofed mail reaches the inbox in the first place. That makes it a higher-leverage control when email is the main attack path.

Q: What are the signs that a DMARC rollout is failing in practice?

A: The clearest signs are legitimate messages being rejected, deliverability complaints from customers or partners, and unresolved alignment issues with third-party senders. If reporting shows many authenticated failures from known business mail streams, the policy is likely too aggressive or incomplete. A failed rollout usually reflects poor sender discovery, weak coordination, or insufficient monitoring.

Q: Who should own DMARC enforcement in an organisation?

A: DMARC enforcement should be jointly owned by security and the teams operating domain-based mail services. Security should define the policy and monitoring expectations, while platform or messaging teams validate legitimate senders and fix alignment issues. That split keeps deliverability, fraud prevention, and change control tied to one operating model.

Technical breakdown

Why p=none still leaves spoofing in play

DMARC works by comparing the visible From domain to SPF and DKIM alignment results, then applying a published policy. A p=none record only reports failures, it does not change delivery behaviour. That means attackers can still impersonate trusted domains and rely on user action, mailbox defaults, or downstream filtering to catch the message. For organisations with high-trust payment and procurement flows, p=none is a visibility control, not a protection control. See the DMARC, SPF and DKIM Guide.

Practical implication: Move from report-only DMARC to enforcement where sender inventories are stable enough to support rejection.

Why quarantine is not the finish line

Quarantine sits between monitoring and outright rejection, but it still leaves room for inconsistent mailbox handling, user overrides, and delayed remediation of legitimate senders. In many programmes, quarantine reflects that SPF and DKIM have been mapped, yet enforcement is paused because the last legitimate senders have not been validated. The control gap is not technical complexity alone, but governance hesitation around ownership of every authorised sender. See the Email Identity and BEC Guide.

Practical implication: Treat quarantine as a short transition state and assign ownership for every sender still blocking full reject.

Why DMARC matters most where email drives money and mission

In sectors such as energy, defence, logistics, and research, email is often part of a larger trust chain for invoices, contracts, and operational approvals. That makes domain impersonation a business-process attack rather than a simple spam problem. The security value of DMARC rises sharply when the organisation depends on externally trusted mail for high-value decisions, because the control can prevent spoofed messages from entering the workflow at all.

Practical implication: Prioritise enforcement first on domains used for finance, procurement, and external partner communication.

Threat narrative

Attacker objective: The attacker wants to weaponise trusted email identity so a legitimate-looking message triggers fraud, mistaken action, or operational delay.

1. Entry begins when an attacker sends a spoofed message that imitates a trusted domain used in payments, contracts, or operational approvals.
2. Credential access is not the main step here; instead, the attacker exploits trust in the sender identity to get the message delivered and read.
3. Impact follows when a recipient acts on fraudulent instructions, opening the door to payment diversion, disclosure, or workflow disruption.

Breaches seen in the wild

• Poland ArcGIS password leak 2023: An ArcGIS login emailed in 2020 was published from stolen mail in 2023 and still worked, exposing Polish military and infrastructure maps.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

DMARC enforcement is now a trust-control problem, not a messaging preference. The Heartland data shows that organisations still treat policy levels as optional maturity steps rather than as a boundary between monitored risk and blocked impersonation. In sectors where email drives payment and operational authorisation, that assumption no longer holds. Practitioners should treat domain enforcement as part of identity trust governance, not as a mail-team optimisation.

Report-only DMARC creates a verification trust gap: organisations can see spoofing attempts without preventing them. That gap is especially dangerous in critical infrastructure sectors, where recipients often trust inbound instructions because the sender identity appears familiar. The lesson is not that reporting is useless, but that reporting alone does not protect the workflow. Practitioners need to close the gap between sender discovery and policy enforcement.

DMARC is most effective when the organisation maps it to high-value business processes. A broad enforcement programme can stall if teams do not identify which domains actually carry procurement, payroll, logistics, or defence traffic. The article shows that state-level exposure persists where enforcement remains uneven across top domains. The practical conclusion is to govern authentication by business-critical sender, not by IT ownership alone.

Heartland exposure shows how critical infrastructure risk often hides in plain email identity. A region with defence, energy, and research significance can still underperform on the basic ability to block spoofed mail. That mismatch matters because adversaries do not need sophisticated tradecraft if they can redirect trust through a familiar domain. Practitioners should read this as a reminder that identity assurance at the email layer is foundational to broader resilience.

What this signals

DMARC maturity now needs to be managed as part of identity trust posture. The operational question is no longer whether a domain publishes a record, but whether that record actually blocks spoofed mail in the workflows that matter most. Organisations that keep report-only policies for long periods are effectively accepting a known impersonation path.

The enforcement gap is usually a sender-governance problem before it is a protocol problem. When SPF and DKIM have been mapped but reject is still delayed, the blocker is often incomplete ownership of legitimate senders rather than a lack of tooling. That means the next step is to tie email authentication to application and business process inventories, not only to DNS administration.

Email identity still sits inside the wider control stack for critical infrastructure. In sectors like energy, defence, and research, spoofed messages can influence payments, procurement, and operational decisions, so authentication cannot be treated as a standalone mail filter. Practitioners should expect tighter links between email authentication, fraud controls, and resilience programmes.

For practitioners

• Enforce DMARC on business-critical domains Move domains that support payments, procurement, contracts, and partner communication to p=reject once legitimate sender inventory is validated.
• Inventory every authorised sender Map all systems, vendors, and platforms that send on behalf of your domains so SPF and DKIM alignment can be maintained without accidental breakage.
• Retire long-running p=none policies Set a deadline for report-only records and assign owners to each domain that still monitors spoofing without blocking it.
• Prioritise high-trust workflows first Start with the domains used for finance, supplier management, defence, and customer communications, where spoofed mail has the highest business impact.

Key takeaways

• Most Heartland organisations have not yet reached DMARC enforcement, which leaves spoofed email usable against sectors that rely heavily on trusted messaging.
• The largest gap is not just missing records but the large share of domains still stuck in report-only or quarantine states.
• Practitioners should treat DMARC as a governance control for email identity and finish the move to reject on the domains that matter most.

Related NHI Mgmt Group resources: DMARC, SPF and DKIM Guide · Email Identity and BEC Guide · Threat Actor Groups Guide · Global Cybersecurity Regulatory Map

Key terms

• DMARC: DMARC is an email authentication policy mechanism that uses DNS-published records to tell receiving mail systems how to handle messages that fail alignment checks. It helps reduce impersonation risk, but it only works when the published policy is accurate, current, and governed as part of the domain's security state.
• Email Spoofing: Email spoofing is the practice of making a message appear to come from a trusted sender when it does not. The technique relies on weak authentication and user trust, and it often supports phishing, fraud, and impersonation campaigns across business workflows.
• Report-Only Enforcement: A control mode where a guard or policy is monitored but not yet used to block or disrupt users. Security teams use it to measure false positives, confirm abuse patterns, and tune thresholds before moving to active enforcement that affects accounts or application behaviour.
• Sender Inventory: A sender inventory is the complete list of services, applications, and systems authorized to send email for a domain. It is the governance baseline for DMARC because enforcement is only safe when every legitimate sender has been identified, authenticated, and mapped to an owner.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, secrets management, workload identity, and the control decisions that shape identity trust. It helps practitioners connect identity governance to the wider security programme they run every day.