DMARC Has Been Public Since 2012. 68.4% of Domains Still Don't Enforce It
Fourteen years after DMARC launched, we found that 68.4% of company domains still lack enforcement. While many have records, most sit in a monitoring-only mode called p=none. The real barrier isn't ignorance but the overwhelming difficulty of parsing fragmented aggregate reports to identify legitimate senders, turning a simple configuration change into an endless research task.
An administrator staring at a week of these reports is not looking at a vendor list. They are looking at a pile of IP addresses and sender strings with no obvious owner, and deciding whether to enforce means identifying every one of them first.