Topic starter
24/10/2026 8:49 pm
TL;DR: Across six Southeast states, 61% of 600 domains have not reached DMARC enforcement, Red Sift reports. Email identity controls still leave spoofed mail deliverable until domains move past monitoring to reject.
Editorial analysis by NHI Mgmt Group, based on content published by Red Sift: “61% of Southeast U.S. organizations are unprotected against phishing attacks”.
By the numbers:
- Red Sift analyzed 600 domains across six Southeast states and found only 236, or 39%, reached DMARC enforcement.
- Red Sift found 157 domains, or 26.2%, running p=none policies that monitor spoofing but take no action.
- Red Sift found 62 domains, or 10.3%, have no DMARC record published at all.
Key questions
Q: Why does p=quarantine still leave organisations exposed to spoofed email?
A: Quarantine reduces risk but does not eliminate it, because suspicious mail is still delivered into a workflow that may be reviewed, released, or ignored.
Q: How should security teams implement DMARC enforcement across multiple email senders?
A: Start by inventorying every system that sends mail for the domain, then validate SPF and DKIM for each one before moving from monitoring to quarantine or reject.
Q: What breaks when DMARC is not enforced for brand email?
A: Without DMARC enforcement, mailbox providers can still deliver or partially trust spoofed mail that appears to come from your domain.
Practitioner guidance
- Prioritise reject on business-critical domains Move domains that support payments, invoices, shipping, procurement, and customer communications from monitoring to reject before less critical mail streams.
- Time-box quarantine as a transition state Set explicit exit criteria for p=quarantine and review them weekly so the control does not become an indefinite holding pattern.
- Map every legitimate sender before enforcement Inventory all third-party services, marketing tools, ERP systems, and outsourced mailers that send on behalf of the domain, then align SPF and DKIM before flipping the policy.
Bottom line: The core problem is not whether organisations know about DMARC, but whether they finish the move from monitoring to reject.
Glossary terms: DMARC, p=reject, p=quarantine, Business email compromise
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
25/10/2026 11:12 am
Email authentication is now an identity governance problem, not just a mail security problem. DMARC enforcement determines whether a domain can prove message origin at the point of use. In regions where procurement, logistics, and payments still depend on inbox trust, incomplete enforcement leaves a governance gap that attackers can exploit. Practitioners should treat email domain identity as part of access trust, not a separate hygiene task.
A few things that frame the scale:
- The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.
A question worth separating out:
Q: Who owns the move from DMARC monitoring to enforcement?
A: Ownership usually sits with email security or identity governance, but the decision also depends on finance, operations, and application owners who depend on the domain. The key accountability issue is that no one should let p=quarantine become permanent without a business-approved enforcement date.
👉 Read our full editorial: DMARC enforcement lags across southeast organisations despite high exposure
This post was modified 7 days ago by NHI Mgmt Group