Mid-Atlantic DMARC enforcement: what does it mean for IAM teams?

TL;DR: Only 309 of 700 domains across seven Mid-Atlantic states and Washington, D.C. have reached DMARC enforcement, leaving more than half the region’s top organisations still able to accept spoofed email, according to Red Sift research. The gap matters because federal, financial, healthcare and defence targets remain exposed until reject becomes the default, not the exception.

Editorial analysis by NHI Mgmt Group, based on content published by Red Sift: “Only 44% of the Mid-Atlantic's top organizations block spoofed email”.

By the numbers:

• Red Sift analyzed 700 domains across seven Mid-Atlantic states and the District of Columbia.
• Only 309 of 700 domains, or 44%, reached full DMARC enforcement.
• 191 domains, or 27.3%, still run p=none policies that monitor but do not block spoofed email.

Key questions

Q: What breaks when DMARC is not enforced for brand email?

A: Without DMARC enforcement, mailbox providers can still deliver or partially trust spoofed mail that appears to come from your domain.

Q: Why do organisations stay exposed after SPF and DKIM are in place?

A: SPF and DKIM reduce impersonation risk, but they do not stop spoofing on their own if the domain owner has not moved DMARC to enforcement.

Q: How should security teams prioritise DMARC rollout across a large organisation?

A: Start with the domains that carry the highest trust value and fraud impact, such as finance, procurement, government correspondence and healthcare communications.

Practitioner guidance

• Inventory every legitimate sender Build a complete list of business systems, third parties and cloud services that send mail on behalf of the domain before moving enforcement forward.
• Move p=none domains to reject Prioritise domains already collecting DMARC reports and convert them from monitoring to blocking once alignment issues are resolved.
• Shorten quarantine as a transition state Use quarantine only as a temporary step while sender exceptions are validated, then complete the move to enforcement rather than letting the state persist.

Bottom line: The Mid-Atlantic study shows that many top organisations have not completed the last mile of email authentication even when DMARC is already present.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →