DMARC in the Southeast: why is full enforcement still missing?

TL;DR: Only 236, or 39%, of 600 domains across six Southeast states have reached DMARC enforcement, leaving 61% still unable to block spoofed email despite the region's heavy manufacturing, logistics, payments, and defense footprint, according to Red Sift research. That gap shows email authentication is now a follow-through problem, not an awareness problem, and the last policy step matters most.

Editorial analysis by NHI Mgmt Group, based on content published by Red Sift: “61% of Southeast U.S. organizations are unprotected against phishing attacks”.

By the numbers:

• Red Sift analyzed 600 domains across six Southeast states and found only 236, or 39%, reached DMARC enforcement.
• Red Sift found 157 domains, or 26.2%, running p=none policies that monitor spoofing but take no action.
• Red Sift found 62 domains, or 10.3%, have no DMARC record published at all.

Key questions

Q: What breaks when DMARC is not enforced for brand email?

A: Without DMARC enforcement, mailbox providers can still deliver or partially trust spoofed mail that appears to come from your domain.

Q: Why does p=quarantine still leave organisations exposed to spoofed email?

A: Quarantine reduces risk but does not eliminate it, because suspicious mail is still delivered into a workflow that may be reviewed, released, or ignored.

Q: How should security teams implement DMARC enforcement across multiple email senders?

A: Start by inventorying every system that sends mail for the domain, then validate SPF and DKIM for each one before moving from monitoring to quarantine or reject.

Practitioner guidance

• Prioritise reject on business-critical domains Move domains that support payments, invoices, shipping, procurement, and customer communications from monitoring to reject before less critical mail streams.
• Time-box quarantine as a transition state Set explicit exit criteria for p=quarantine and review them weekly so the control does not become an indefinite holding pattern.
• Map every legitimate sender before enforcement Inventory all third-party services, marketing tools, ERP systems, and outsourced mailers that send on behalf of the domain, then align SPF and DKIM before flipping the policy.

Bottom line: The core problem is not whether organisations know about DMARC, but whether they finish the move from monitoring to reject.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →