A DMARC record is often treated as a finish line for email authentication. It is not. It is a public instruction to receiving systems about how to handle messages that fail to authenticate in alignment with the visible From domain. Whether that instruction becomes an effective operational control depends on reporting, ownership, and deliberate policy changes.

That distinction matters because email is both critical infrastructure and a common route for abuse. A company can publish a valid DMARC record while still lacking a routine way to discover legitimate systems that send under its domain, investigate authentication failures, or decide safely whether to enforce a stronger policy.

Adoption Is Not Readiness

Our public-DNS study of a pinned 100,000-domain corpus gives a useful snapshot of the gap. On one August 2026 scan window, we successfully observed 99,310 domains. Of those, 57,691 (58.1%) published a valid DMARC record. That is meaningful adoption, but it is not a measure of operational readiness.

Among the domains with DMARC, 20,787 remained at p=none, a monitoring policy. Monitoring is often the appropriate first step; it gives organizations time to find unaccounted-for senders and fix alignment before asking receivers to quarantine or reject failures. The risk is treating it as a permanent end state. A domain in monitoring mode makes no DMARC-based request to quarantine or reject a failed message.

The Reporting Gap

Reporting exposes a second, less visible gap. The study found that 11,839 DMARC publishers, or 20.5%, had no aggregate-reporting address. Aggregate reports do not block an attack by themselves. They are the feedback loop: evidence about sources that sent mail associated with a domain and how receivers evaluated the authentication results.

Without that feedback loop, an organization may not see an overlooked marketing platform, a broken DKIM configuration, a newly introduced sender, or suspicious activity. It can have a syntactically valid record and still be operating with limited information.

The public-DNS data breaks the population into four practical states:

• 31,924 domains (55.3% of DMARC publishers) combined an enforcing
• licy with aggregate reporting.
• 4,980 enforced without aggregate reporting.
• 13,928 monitored with reporting.
• 6,859 both remained in monitoring mode and requested no aggregate reports.

This does not mean the first group is universally safe or the other groups are necessarily mismanaged. DNS records do not show inbox placement, message volume, the quality of a security program, or whether a domain was attacked. They show which controls the domain owner published at one point in time. That limitation is important.

Still, the pattern suggests a better question for policy leaders, journalists, and operators. Instead of asking only whether an organization “has DMARC,” ask whether it can operate DMARC.

From Configuration to Operation

Operating it starts with knowing every service authorized to send mail with the domain: marketing platforms, help desks, billing tools, CRM sequences, survey systems, agencies, and transactional applications. Each service needs an accountable owner, a known return-path or signing identity, and a production-path test that proves SPF or DKIM aligns with the visible From domain.

Next comes evidence. The current DMARC specification and its aggregate-reporting companion describe how a domain can request reports using the rua tag. Those reports should be reviewed on a regular schedule alongside platform logs and delivery signals. An unfamiliar source is a prompt to investigate; it can be an overlooked legitimate system, a forwarding effect, or an unauthorized sender.

The Path to Enforcement

Only then can an organization make a measured policy decision. A p=none policy helps collect evidence. Quarantine and reject ask participating receivers to apply stronger handling to unauthenticated mail that claims the domain. Moving too quickly can disrupt legitimate mail; never moving at all leaves no DMARC-based enforcement request. The transition requires an inventory, observations, and an owner who can resolve the exceptions.

This is why public measurement should distinguish publication from maturity. A record answers a configuration question. Reporting, ownership, testing, and controlled enforcement turn it into an operating control.

For organizations that depend on trusted email, that is not an academic distinction. It affects whether a launch announcement arrives as the company intended, whether a forgotten sender is caught before it causes a delivery incident, and whether an attacker can more easily impersonate the organization’s exact domain.

Methodology and data:
https://www.palisade.email/research/state-of-dmarc-2026
https://doi.org/10.5281/zenodo.21924607