DMARC enforcement in the Southwest: what practitioners need to act on

TL;DR: Only 201 of 500 domains, or 40%, across five Southwest states have reached DMARC enforcement, leaving most top organizations still unable to block spoofed email in a region shaped by technology, finance, gaming and military operations, according to Red Sift. The gap shows authentication maturity has not kept pace with the operational value of the domains being impersonated.

Editorial analysis by NHI Mgmt Group, based on content published by Red Sift: “Only 40% of the Southwest's top organizations block spoofed email”.

By the numbers:

• 138 domains across the region run p=none policies that monitor but take no action against spoofed emails.
• 114 domains sit at p=quarantine, close to full protection but not finishing the move to reject.
• 47 domains have no DMARC record published at all.

Key questions

Q: What breaks when organisations delay DMARC enforcement?

A: Delayed enforcement leaves hidden sender dependencies undiscovered until a mailbox provider begins rejecting mail.

Q: Why do p=none and p=quarantine leave organisations exposed?

A: p=none and p=quarantine are useful transitional states, but they still allow many spoofed messages to reach users.

Q: How should security teams implement DMARC enforcement across multiple email senders?

A: Start by inventorying every system that sends mail for the domain, then validate SPF and DKIM for each one before moving from monitoring to quarantine or reject.

Practitioner guidance

• Tighten DMARC policy from monitoring to rejection Set a dated transition plan for domains still at p=none or p=quarantine, with explicit owner sign-off for each sending source before moving to reject.
• Inventory every legitimate sender Build a current list of all systems, vendors and business units sending mail on the domain so SPF and DKIM alignment can be validated before enforcement changes.
• Treat email impersonation as fraud exposure Bring business email compromise scenarios into fraud and identity governance reviews where payments, vendor onboarding and account recovery depend on email trust.

Bottom line: The core risk is not just spoofed email, but the ability to impersonate an organisation’s identity in workflows that trigger payment, access or trust decisions.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →