Topic starter
25/10/2026 11:00 am
TL;DR: DMARC is no longer optional for organisations that rely on email, according to Valimail, because monitoring alone does not stop spoofing or brand impersonation; the practical target is quarantine or reject enforcement, backed by SPF and DKIM alignment and ongoing reporting. DMARC governance is now an access-control problem for the inbox, not just an email hygiene task.
Editorial analysis by NHI Mgmt Group, based on content published by Valimail: “How to create and publish your own DMARC record”.
Key questions
A: Start by inventorying every authorised sender, including marketing, support, and transactional platforms, then validate SPF and DKIM for each one.
Q: Why does weak DMARC adoption increase the risk of email fraud and brand impersonation?
A: Weak DMARC adoption leaves attackers with an easier path to forge messages that appear to come from a trusted domain.
Q: What breaks when a domain stays on p=none?
A: You still get reports, but you do not stop spoofed mail from arriving in inboxes.
Practitioner guidance
- Publish DMARC with a staged enforcement plan Start with monitoring only if you need discovery, but set a clear path to quarantine or reject once SPF and DKIM alignment are stable across legitimate senders.
- Inventory every authorised mail source Map all platforms, applications, and third-party services that send on your domain so unexpected sources do not remain hidden in aggregate reports.
- Validate alignment before tightening policy Check that SPF and DKIM are published, aligned, and working for each sending stream before moving from p=none to stronger enforcement.
Bottom line: DMARC turns email-domain trust into an enforceable policy decision, which is why monitoring alone leaves organisations exposed to spoofing and impersonation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →