Despite DMARC's existence since 2012, a recent analysis of 67,336 company domains reveals a significant lack of enforcement. DMARC, a DNS record guiding mail servers on handling unauthenticated emails, is crucial for preventing domain spoofing.

The study found that 45.1% of domains lack any DMARC record. Among those with a record, only 29.7% enforce policies like 'reject' or 'quarantine'. A substantial 42.5% remain at the 'none' policy, which only monitors without blocking suspicious emails. This means 68.4% of all domains checked either have no DMARC record or an inactive one. The primary barrier to enforcement appears to be the complexity of identifying legitimate email sources from daily reports, a task often deprioritized.

Analysis of reporting addresses (rua=) showed a long tail of unrecognized senders, making it difficult for administrators to differentiate valid from invalid mail sources. While major vendors like Brevo, Proofpoint, and Cloudflare are frequent report recipients, a vast number of unique, often cryptic, reporting addresses complicate the process. This administrative burden, rather than a lack of awareness, is likely the main reason for the low enforcement rates observed.