More Than 3 in 4 Domains Still Have No Real DMARC Protection. Yours Might Be One of Them Without Knowing It

Most domains that publish a DMARC record never enforce it. The policy sits at p=none, a monitoring setting that tells mailbox providers to take no action on mail that fails authentication. It passes a basic "does DMARC exist?" scan, which is exactly why so many brands believe they're covered when they aren't.

Key takeaways

• EasyDMARC's 2026 DMARC Adoption & Enforcement Report, covering the top 1.8 million domains, found that 77.1% had either no DMARC record or a policy of p=none. That is the scale of the gap behind the headline.

• A domain can have DMARC "set up" and still do nothing to stop spoofing, because p=none only monitors.

• An email deliverability checker that only confirms a record is present is checking the wrong thing. What matters is the policy and the alignment.

• Moving to enforcement is usually a one-line DNS change. Knowing when it's safe to make that change is the hard part.

Most brands treat DMARC as a box they ticked once. Someone set it up years ago, it shows up when you look, and that's the end of it. The uncomfortable part is how often that record is in monitoring mode. It exists. It just doesn't do what most people assume.

That matters more than it used to. Gmail, Yahoo and Microsoft now require bulk senders to publish DMARC, and all three lean harder on authentication when deciding whether to accept a message at all.

Why a DMARC record can exist and still do nothing

DMARC has three policies: none, quarantine and reject. "None" means the domain collects reports on mail claiming to come from it and asks receivers to take no action. It's meant for the first few weeks while you find every legitimate sender. It was never meant to be permanent.

A huge share of domains never move past it. The record goes in, monitoring mode stays, and nobody comes back to it. A domain at p=none still passes a presence check, and an email deliverability checker that stops there is answering the wrong question. The real question is what happens when someone spoofs your domain, and p=none answers it with "nothing".

What this looks like in practice

Picture a brand that added DMARC three years ago when it first moved campaigns to Klaviyo. It passed the setup checklist at the time and nobody has touched it since. Meanwhile mailbox providers have tightened their rules for bulk senders. The policy is still p=none, the reports go to an inbox nobody reads, and the brand's email deliverability checker has never flagged it, because as far as that tool is concerned, DMARC is there.

Nothing breaks all at once. Trust in the domain just stays lower than it could be, and there's no obvious signal pointing at DMARC as a cause.

What a proper check needs to look at

A real check looks at three things together:

1.  Does the record exist? The only question most quick scans ask.

2.  What is the policy? none, quarantine or reject, plus the pct tag if only part of the mail is covered.

3.  Is alignment set correctly? Your SPF and DKIM domains need to line up with the From domain, otherwise mail can fail DMARC even with everything "configured".

A domain can pass the first, half-pass the second and fail the third while still looking healthy on a surface scan. A useful email deliverability checker gets all the way to step three.

Moving from none to enforcing without breaking anything

The reason domains stall at p=none is fear, and it's a reasonable fear. Jump straight to reject before every legitimate sender is authenticated and you'll block your own mail: the helpdesk tool, the review platform, the invoicing system someone set up two years ago.

The safer route is staged:

1.  Read your aggregate DMARC reports for a few weeks and list every service sending as your domain.

2.  Fix SPF and DKIM for each one, including Klaviyo's branded sending domain.

3.  Move to p=quarantine, ideally starting with a low pct, and watch the reports.

4.  Move to p=reject once nothing legitimate is getting caught.

Base each step on your actual reports rather than guesswork, and don't assume last year's setup still holds.

See where your emails are actually landing

Fixing DMARC closes one gap: it helps your mail get accepted and trusted. It's a different gap from the one that decides Primary versus Promotions once the mail is in. A domain can enforce DMARC perfectly and still land in Promotions, because that decision runs on other signals.

A MailMend on/off A/B test inside Klaviyo. Authentication decides acceptance; placement is measured separately.

That decision is the one MailMend works on. It's built for Klaviyo and designed to improve how often your campaigns and flows land in Primary, without touching your copy or your list. You measure it in a native Klaviyo A/B test, on versus off, and judge it on clicks and revenue. Book a demo to try it on your own account; the free trial starts after your first A/B test.

Frequently asked questions

How do I know if my DMARC policy is actually enforced?

Look up the TXT record at _dmarc.yourdomain.com and read the p= tag. p=none is monitoring only. p=quarantine or p=reject means it's enforced. Check the pct tag too, since pct=10 means only a tenth of failing mail is covered.

Can an email deliverability checker catch this automatically?

A good one flags the policy and alignment, not just the presence of a record. If your current email deliverability checker only reports DMARC as "present", it isn't giving you the full picture.

Is moving straight to reject risky?

Yes, if you haven't confirmed that every legitimate service sending as your domain is authenticated. Going through quarantine and reading the reports first is the safer path.

Does DMARC affect Promotions tab placement?

Not directly. DMARC affects whether a message is accepted and trusted. Primary or Promotions is a separate decision made after authentication has passed.