Topic starter
27/10/2026 7:09 pm
TL;DR: 152 of 250 FTSE 250 companies have reached DMARC enforcement at p=reject, but 98 still have not, leaving spoofed email possible across 39.2% of the index, according to Red Sift. Enforcement is the control that matters, because partial deployment still leaves impersonation paths open.
Editorial analysis by NHI Mgmt Group, based on content published by Red Sift: “FTSE 250 DMARC report: 39% of the UK's top companies still don't block spoofed email”.
By the numbers:
- 152 of 250 FTSE 250 organisations (60.8%) have reached DMARC enforcement at p=reject
- 47 organisations (18.8%) run p=none policies that monitor traffic but take no action against spoofed email
- 33 organisations (13.2%) sit at p=quarantine, sending suspicious messages to spam rather than blocking them outright
Key questions
Q: What breaks when DMARC is not enforced for brand email?
A: Without DMARC enforcement, mailbox providers can still deliver or partially trust spoofed mail that appears to come from your domain.
Q: Why do partial DMARC deployments still leave phishing risk?
A: Partial deployment leaves a trust gap because receivers may still deliver unauthenticated mail, especially when policies stop at none or quarantine.
Q: What do security teams get wrong about SPF, DKIM, and DMARC?
A: They often deploy them as isolated email settings instead of treating them as enforcement controls for domain identity.
Practitioner guidance
- Audit every mail source that uses your domain Use DMARC aggregate reports to inventory marketing, payroll, HR, CRM, support, and third-party services sending on your behalf.
- Move from visibility to enforcement in stages Tighten alignment, fix authentication failures, then move from p=none to p=quarantine and finally p=reject.
- Treat unowned senders as an identity governance problem Any system that can send email as your brand is effectively operating under your domain identity.
Bottom line: DMARC reduces spoofing only when policy moves from monitoring to enforcement across every authorised sender.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
28/10/2026 9:26 pm
DMARC enforcement is the real control boundary, not DMARC publication. Publishing a record without moving to p=reject creates an observability layer, not a protective one. That distinction matters because attackers care about delivery, not policy intent. For practitioners, the governance question is whether email authentication has actually become enforceable across every sender, not whether the domain has started the project.
A question worth separating out:
Q: How do security teams know whether DMARC enforcement is actually working?
A: Look for fewer authentication failures from legitimate senders, stable alignment for critical mail flows, and reporting that clearly shows why a message passed or failed. If failures cannot be explained quickly, the programme is not ready for stricter enforcement. Working DMARC is visible, reproducible, and backed by clean sender inventory.
👉 Read our full editorial: FTSE 250 DMARC enforcement still leaves a spoofing gap