Two years of pressure from Google, Yahoo and Microsoft did what a decade of best-practice blog posts could not: people published DMARC records. Adoption across the top 1.8 million domains went from 523,921 records in 2023 to 937,931 in early 2026, according to EasyDMARC's 2026 adoption report. That is real progress.
Here is the part that does not make the headline. Of those 937,931 domains, 525,996 are at p=none — monitoring mode, which instructs receiving mail servers to do absolutely nothing when a message fails authentication. Only 411,935 are at p=quarantine or p=reject, the two policies that actually stop anything. And only 159,691 domains in the whole sample combine p=reject with aggregate reporting, the configuration that both blocks spoofing and tells you it happened — fewer than 1 in 11 of the domains that have a record at all.
Valimail's 2026 State of DMARC report, published in February, measures the same thing from a different angle and calls it the Enforcement Gap: adoption at 78%, enforcement stuck at 42%. Enforcement rose seven points across the whole of 2025. At that rate the gap closes some time in the 2030s.
If you published a DMARC record in 2024 because your ESP sent you a warning email, and you have not touched it since, this article is about your domain.
What p=none actually buys you
A DMARC record at p=none is a request for telemetry, not a control. It says: check whether messages claiming to be from my domain pass SPF or DKIM in a way that aligns with the visible From address, and mail me a report — but deliver them either way.
That is a legitimate and necessary first phase. It is how you discover the invoicing system nobody told you about. The problem is that it was designed as a two-to-twelve-week diagnostic phase, and for most organisations it has become the permanent state. In the meantime an attacker can put your exact domain in the From header of a payment-redirect email and no receiving server will stop it.
This matters more than it did. The FBI's IC3 recorded $3.046 billion in business email compromise losses in 2025 — the single most financially damaging category of enterprise-targeted crime, again — and phishing was the most-reported crime type at 191,561 complaints. Exact-domain spoofing is the cheapest way to run that attack, and enforcement is the only thing that closes it.
The four things that keep you at p=none
Nobody stays at p=none on purpose. They stay because moving to enforcement would break legitimate mail, and these four issues are almost always why.
1. The SPF ten-lookup limit. RFC 7208 caps an SPF evaluation at ten DNS-querying mechanisms — every include:, a, mx, ptr, exists and redirect, counted recursively through every nested include. Exceed it and a compliant receiver returns permerror, which DMARC treats as an SPF failure. Three or four SaaS senders will do it: Microsoft 365, a marketing platform, a helpdesk and a payroll tool each bring their own nested includes. The failure is invisible at p=none and total at p=reject. Count your lookups; if you are over, flatten selectively or move senders to subdomains with their own SPF records.
2. Alignment, not just authentication. This is the concept that most people miss. A message can pass SPF and still fail DMARC. DMARC checks that the domain that passed SPF (the envelope sender / Return-Path) or the domain in the DKIM d= tag matches the domain in the visible From header. Most email service providers set the Return-Path to their own bounce domain, so SPF passes for bounces.esp-provider.net while your From header says yourcompany.com — no alignment, no DMARC pass. The fix is DKIM signing with your own domain, which every serious ESP supports and many customers never enable.
3. Forwarding. SPF breaks on forwarding by design: the forwarding server's IP is not in your SPF record. Mailing lists, .forward rules, alumni addresses and role-account redirects all do this. DKIM survives forwarding — unless the list modifies the message, which mailing lists routinely do by prefixing the subject or appending a footer, invalidating the signature. ARC exists to preserve the original authentication result across hops and is honoured by the large providers, but not universally. This is the reason to reach enforcement via p=quarantine first, and to read your reports rather than assume.
4. Shadow senders. The list of systems sending mail as your domain is always longer than the list anyone can recite: CRM, ticketing, e-signature, HR onboarding, monitoring alerts, the CI pipeline, an old marketing tool a department bought on a card. Every one of them has to be authenticated and aligned before enforcement, or its mail dies on the day you flip the policy. Aggregate reports are the only reliable inventory — which is why the 384,345 domains that have a DMARC record but no RUA tag are flying blind.
Check your own domain in a minute
Three DNS queries. From any terminal:
dig +short TXT _dmarc.yourdomain.com — read the p= value. If it says p=none, you are unprotected. Check for rua= too; without it you have no data. And check sp=: if it is absent, subdomains inherit p, but if someone set sp=none your subdomains are wide open regardless of the main policy.
dig +short TXT yourdomain.com — find the record starting v=spf1. Count the mechanisms that cause DNS lookups, following each include: down. Confirm it ends in -all (hard fail) or ~all (soft fail), never +all.
dig +short TXT selector._domainkey.yourdomain.com — DKIM needs the selector, which you get from the s= tag in the DKIM-Signature header of a message you sent. Open any sent message's source and look.
Then check the domains you are not thinking about. Parked domains, brand-defensive registrations, old product domains and the misspelling you bought years ago all need v=DMARC1; p=reject; with an empty SPF (v=spf1 -all) and no MX. A domain that never sends mail is the easiest one to enforce and the most commonly forgotten. ClickScan's email authentication check runs all of this from the outside, including a live spoofing test that shows whether a forged message from your domain actually gets delivered, and brand impersonation monitoring for the look-alike domains you never registered.
The path out
Publish rua= and read reports for two to four weeks. Enumerate every legitimate sender. Get each one DKIM-signed with your own domain so alignment does not depend on SPF surviving a forward. Fix the lookup count. Move to p=quarantine, watch for a fortnight, then p=reject. Set sp=reject and lock down non-sending domains on the same day.
It is not difficult work. It is unglamorous inventory work, which is why 525,996 domains have not done it. The uncomfortable summary is that a p=none record is worse than no record in one specific way: it lets everyone involved believe the problem is handled.
Sources: EasyDMARC 2026 DMARC Adoption & Enforcement Report; DMARC Report analysis of the same dataset; Valimail 2026 State of DMARC Report; FBI IC3 2025 Annual Report; RFC 7208 (SPF). Adoption percentages differ substantially between studies because the domain samples differ — EasyDMARC measures the top 1.8 million domains, Valimail a different industry-weighted set. Treat the direction as solid and any single percentage as sample-dependent.