24.89% of domains publish a DMARC record. Most of them have no real protection. That's because DMARC has three policy levels, and the one most commonly deployed — p=none — tells receiving mail servers to do nothing when authentication fails.
What DMARC actually does
DMARC (Domain-based Message Authentication, Reporting and Conformance) connects SPF and DKIM to a policy. When a receiving mail server checks an incoming email claiming to be from your domain, it runs SPF (is this server authorised?) and DKIM (is there a valid signature?). DMARC tells the server what to do if either check fails.
The three policy levels:
p=none — monitoring only. The server checks SPF/DKIM but takes no action on failure. Emails that fail authentication still deliver normally. p=none generates reports you can use to understand your mail flow, but it provides zero protection against spoofing.
p=quarantine — route to junk. Emails that fail authentication are delivered to the spam or junk folder rather than the inbox. This is meaningful protection — spoofed emails don't disappear, but they're much less likely to be acted on.
p=reject — block outright. Emails that fail authentication are rejected by the receiving server and never delivered. This is full enforcement. 24.89% of domains publish DMARC but only 10.59% reach enforcement level.
Why most DMARC deployments don't protect you
p=none is the safe starting point when you first deploy DMARC — it lets you see which services are sending on your behalf without breaking anything. The problem is that many businesses set it and forget it. The domain publishes DMARC, the IT checklist gets ticked, and nobody moves to enforcement.
At p=none, your domain can still be spoofed. An attacker can send email from your exact domain address and it will land in the recipient's inbox.
How to check where you are
Run the free DomainScores check to see your current DMARC policy and whether you're at enforcement level.
Need to reach enforcement without breaking your email? Domain Fix from €1,197 — we move your domain to p=reject safely, handling every sending service and subdomain. Grade B+ guaranteed, or your money back.