TL;DR: Only 309 of 700 domains across seven Mid-Atlantic states and Washington, D.C. have reached DMARC enforcement, leaving more than half the region’s top organisations still able to accept spoofed email, according to Red Sift research. The gap matters because federal, financial, healthcare and defence targets remain exposed until reject becomes the default, not the exception.
At a glance
What this is: This regional analysis shows that DMARC enforcement remains incomplete across the Mid-Atlantic, with only 44% of the 700 domains surveyed reaching p=reject.
Why it matters: It matters because email authentication failures still create impersonation, wire fraud and trust risks for organisations that handle government, healthcare, finance and defence workflows.
By the numbers:
- Red Sift analyzed 700 domains across seven Mid-Atlantic states and the District of Columbia.
- Only 309 of 700 domains, or 44%, reached full DMARC enforcement.
- 191 domains, or 27.3%, still run p=none policies that monitor but do not block spoofed email.
- 64 domains, or 9.1%, have no DMARC record published at all.
Context
DMARC is an email authentication control that tells receiving systems how to handle messages that fail SPF and DKIM checks. In practice, the control only becomes protective when an organisation moves from monitoring to enforcement, because p=none records collect data without stopping spoofed mail.
In this region, the governance problem is not lack of awareness but incomplete execution across high-value sectors. The Mid-Atlantic combines government, finance, healthcare and defence exposure, so weak email authentication creates a direct route into fraud, impersonation and supplier trust failures.
Key questions
Q: What breaks when DMARC is not enforced for brand email?
A: Without DMARC enforcement, mailbox providers can still deliver or partially trust spoofed mail that appears to come from your domain. That leaves customers exposed to impersonation and leaves legitimate campaigns competing with abuse for inbox placement. The governance failure is not the record itself, but the absence of a blocking policy tied to authorised senders.
Q: Why do organisations stay exposed after SPF and DKIM are in place?
A: SPF and DKIM reduce impersonation risk, but they do not stop spoofing on their own if the domain owner has not moved DMARC to enforcement. The usual reasons are incomplete sender inventory, fragile third-party mail flows, and governance teams that treat email authentication as a project rather than an operating control.
Q: How should security teams prioritise DMARC rollout across a large organisation?
A: Start with the domains that carry the highest trust value and fraud impact, such as finance, procurement, government correspondence and healthcare communications. Then work outward through the rest of the sender estate, because the first domains to enforce should be the ones that would cause the most harm if impersonated.
Q: What should teams do when quarantine seems close enough to reject?
A: Treat quarantine as a short transition state, not a permanent compromise. If the domain is already aligned and reporting cleanly, finish the policy change to reject so receivers can stop accepting spoofed mail rather than merely handling it more cautiously.
Technical breakdown
Why p=none leaves spoofing risk unchanged
A DMARC policy at p=none tells receivers to report on authentication failures but not to reject them. That makes it useful for visibility, yet ineffective as a stop control. Organisations often stay on p=none while they map legitimate senders, but the security benefit remains partial because attackers can still deliver spoofed messages into the inbox. The operational issue is not that DNS is missing, but that the policy is not being enforced. See the DMARC, SPF and DKIM Guide.
Practical implication: Move domains beyond reporting mode once sender inventory is stable enough to support rejection.
How quarantine differs from reject in operational terms
p=quarantine is the transitional state between observation and full enforcement. It allows receivers to treat suspicious messages more cautiously, but it still leaves policy ambiguity that attackers can exploit, especially where downstream mail systems or user behaviour override message handling. p=reject is the point at which the domain owner tells receivers not to accept unauthenticated mail at all, which is why the final step matters more than the intermediate one.
Practical implication: Treat quarantine as a short transition state, not a long-term operating model.
Why SPF and DKIM are necessary but not sufficient
SPF and DKIM provide the authentication inputs DMARC uses to decide whether a message is legitimate. If those controls are not aligned with the visible From domain, or if the organisation fails to maintain sender inventory and record hygiene, DMARC enforcement will break or remain incomplete. This is why large organisations often stall: the technical standard is straightforward, but the sender estate is messy and constantly changing.
Practical implication: Inventory all legitimate senders before switching domains to reject.
Threat narrative
Attacker objective: The objective is to exploit organisational trust in a known domain to redirect money, data or decisions without triggering email rejection.
- Entry begins when an attacker sends a message that appears to come from a trusted regional institution, supplier or agency.
- Credential or trust abuse occurs when recipients accept the forged message because DMARC is not enforced or is only monitored.
- Impact follows when the spoofed email is used to drive payment fraud, procurement manipulation, or sensitive information disclosure.
Breaches seen in the wild
- United Nations breach 2021: Sakura Samurai used exposed Git credentials to reach 100,000+ UNEP staff records, then reported the flaw through the UN disclosure programme.
- Poland ArcGIS password leak 2023: An ArcGIS login emailed in 2020 was published from stolen mail in 2023 and still worked, exposing Polish military and infrastructure maps.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
DMARC execution debt is the real control gap: the article shows that many organisations have published records but not finished enforcement. That is a governance failure, not a technical mystery, because p=none and long quarantine states create a false sense of completion while spoofing remains possible. Practitioners should treat incomplete DMARC rollout as a lifecycle issue, not a one-time configuration task.
High-value sectors cannot afford identity-by-email assumptions: government, banking and healthcare workflows still rely heavily on mail for trust-bearing decisions. When a domain is not enforced, the sender identity is asserted but not defended, which leaves procurement, payroll and patient communications open to impersonation. That makes email authentication part of identity governance, not just mail hygiene.
Regional risk concentration should drive tighter defaults: the Mid-Atlantic’s exposure profile means weak enforcement has outsized consequences because the same spoofing technique can reach federal, defence and healthcare targets in one geography. public sector identity security becomes relevant here because the strongest case for DMARC is where trust failures can spill into regulated and mission-critical environments.
Authentication posture drift: domains often move forward in stages, then stop short of reject because ownership, sender discovery and operational change do not stay aligned. That drift is especially visible in large multi-entity organisations where marketing, finance and third-party services all send mail under one brand. Practitioners should manage DMARC as an ongoing governance state, not a project milestone.
DMARC is now a fraud-control baseline, not a specialist mail setting: mailbox providers, payment rules and insurer expectations are making unauthenticated email harder to ignore. That means email authentication belongs in the same control conversation as access governance and supplier assurance, especially where a spoofed message can trigger human approval or financial transfer.
What this signals
DMARC enforcement debt: the persistent gap between published policy and blocked spoofing is now a governance problem in its own right. Large organisations often know where they stand technically, but they still leave trust decisions to receivers because policy ownership, sender inventory and change control are not fully joined up.
For identity and security teams, the key programme signal is that email authentication is drifting into the same category as other trust controls that fail when lifecycle management is weak. That means enforcement status, third-party sender onboarding and exception handling need to be reviewed together, not in separate silos.
For practitioners
- Inventory every legitimate sender Build a complete list of business systems, third parties and cloud services that send mail on behalf of the domain before moving enforcement forward.
- Move p=none domains to reject Prioritise domains already collecting DMARC reports and convert them from monitoring to blocking once alignment issues are resolved. See the DMARC, SPF and DKIM Guide.
- Shorten quarantine as a transition state Use quarantine only as a temporary step while sender exceptions are validated, then complete the move to enforcement rather than letting the state persist.
- Treat high-risk brands first Start with domains tied to finance, government, healthcare and supplier communications because those mail streams have the highest impersonation impact.
- Review DMARC reports continuously Use incoming aggregate data to spot drift, new senders and failed alignment before they become visible to attackers or business users.
Key takeaways
- The Mid-Atlantic study shows that many top organisations have not completed the last mile of email authentication even when DMARC is already present.
- Partial policy states such as monitoring and quarantine reduce visibility but still leave spoofed email viable for fraud and impersonation.
- The practical control decision is to finish sender discovery, then move high-risk domains to reject and keep them there through continuous review.
Related NHI Mgmt Group resources: DMARC, SPF and DKIM Guide · Email Identity and BEC Guide · Public Sector Identity Security Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 and MITRE ATT&CK address the attack surface, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, and ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP API Security Top 10 | API8 — Security Misconfiguration | Weak or incomplete DMARC policy is a trust misconfiguration that leaves spoofed mail deliverable. |
| Recommendation — Tighten mail authentication settings and remove permissive defaults that let unauthenticated email pass. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | DMARC enforcement governs which messages are authorised to appear as a domain. |
| Recommendation — Apply authorisation controls to domain identity assertions so only validated senders can claim the brand. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | DMARC depends on disciplined management of domain authenticators and sender alignment over time. |
| Recommendation — Manage and rotate email authenticators so domain identity remains verifiable as sender estates change. | ||
| MITRE ATT&CK | TA0001;TA0009 — Initial Access; Collection | Spoofed email is commonly used to gain initial trust and collect sensitive information. |
| Recommendation — Map spoofing paths to initial access and collection techniques to prioritise defensive testing. | ||
| ISO/IEC 27001:2022 | A.5.23 — Information security for use of cloud services | The article emphasises continuous control over third-party email services and sender drift, which is especially relevant in cloud-hosted mail flows. |
| Recommendation — Govern cloud-based mail senders under documented security requirements and review them regularly. | ||
Key terms
- DMARC: DMARC is an email authentication policy mechanism that uses DNS-published records to tell receiving mail systems how to handle messages that fail alignment checks. It helps reduce impersonation risk, but it only works when the published policy is accurate, current, and governed as part of the domain's security state.
- P=none Policy: A DMARC setting that records authentication results but does not instruct receivers to take protective action. It is useful for discovery and tuning, but by itself it does not prevent spoofed messages from reaching inboxes, which is why it should be treated as a temporary stage.
- Quarantine Policy: A Quarantine Policy is an access control measure used to isolate an identity or workload when compromise is suspected. In cloud environments, it restricts normal permissions so defenders can reduce blast radius while they investigate. The practical goal is containment, not remediation, and it usually works alongside log review and policy analysis.
- Email Spoofing: Email spoofing is the practice of making a message appear to come from a trusted sender when it does not. The technique relies on weak authentication and user trust, and it often supports phishing, fraud, and impersonation campaigns across business workflows.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, secrets management and the identity controls that underpin secure trust decisions. It is designed for practitioners building stronger identity programmes across human and non-human systems.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org