DMARC enforcement gaps: what practitioners need to act on

TL;DR: Only 14.9% of over 73 million domains have implemented a basic DMARC policy and 2.5% enforce p=reject, leaving most domains exposed to spoofing and phishing that can impersonate trusted senders, according to Red Sift analysis. Email authentication only works when sender inventory, alignment and enforcement move together; monitoring without rejection is not a control.

Editorial analysis by NHI Mgmt Group, based on content published by Red Sift: “Most businesses still can't answer one simple question about their email”.

By the numbers:

• only 14.9% have implemented even a basic DMARC policy
• roughly 84% of domains have no visible DMARC record at all

Key questions

Q: How should security teams move DMARC from monitoring to enforcement without breaking legitimate mail?

A: Start by inventorying every authorised sender, including marketing, support, and transactional platforms, then validate SPF and DKIM for each one.

Q: Should organisations rely on DMARC to stop phishing?

A: No. DMARC helps reduce spoofing, but it does not stop attacks that use valid infrastructure, collaboration channels, or post-delivery manipulation. Organisations should keep DMARC in place, but measure phishing resilience across the whole delivery chain, including session abuse, channel trust, and user action after delivery.

Q: What are the warning signs that an email authentication programme is not actually protecting the domain?

A: The clearest signs are a persistent p=none policy, incomplete sender inventory, unresolved SPF or DKIM alignment problems, and reports showing unknown services sending as the domain.

Practitioner guidance

• Map every authorised sender Inventory every platform, service and third party that sends email on behalf of the domain, then verify SPF and DKIM alignment for each one before changing policy.
• Escalate from monitor-only to enforcement Move DMARC from p=none to p=quarantine and then p=reject only after legitimate senders are confirmed and reporting is stable.
• Use aggregate reports to find shadow senders Review DMARC aggregate reports to identify unauthorised or forgotten services that are still sending as the domain, including legacy business tools and external platforms.

Bottom line: Most domains still fail to enforce DMARC, which leaves spoofing and phishing able to exploit trusted domain identity.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →