On October 16, 2026, dmarcian published the takeaways from a session it held with the Certified Senders Alliance. Two people carried the conversation: Matia Boldrini, Professional Services Representative at dmarcian, and Steffen Siguda, Group Corporate Information Security Officer at ams OSRAM, the Austrian sensor and semiconductor manufacturer. Their subject was not a new attack or a new protocol feature. It was the question that decides most DMARC projects in practice: why do so many organizations publish a DMARC record and then never reach enforcement?
The enforcement gap is not a technology gap
The starting point the two presenters shared is blunt. Many European enterprises publish DMARC records, but few have reached full enforcement. The reason is rarely the DNS syntax or the protocol itself. The blockers are people and process: a gap among technical, marketing, and leadership teams, and the difficulty of mapping shadow IT and third-party senders.
Anyone who has run a DMARC rollout will recognize the pattern. The aggregate reports reveal a sending source nobody in IT knows about, maybe a CRM plugin, a helpdesk tool or an old newsletter platform. Tracking down the owner means knocking on doors across departments that have no reason to prioritize your change request. Multiply that by dozens of sources and a large domain catalog, and the project stalls at p=none for years.
How ams OSRAM approached the rollout
The session described how a structured rollout gets past that wall. The team started by locking down the domains that never send email, which removes noise from the reports and closes the cheapest spoofing route in one move. A DMARC platform was used to monitor domains continuously rather than through one-off audits. And critically, an executive mandate was secured so that cross-departmental cooperation was not left to goodwill.
Siguda’s own advice is to start your project now by tackling the domains that never send email. Boldrini’s is to document everything and never publish DMARC without a reporting address. Both are process disciplines, not protocol tricks.
The order of steps they recommend
Based on the tips shared in the session, dmarcian laid out a practical sequence:
- Lock down every non-sending domain with a p=reject policy.
- Enable DKIM for all email sources.
- Publish DMARC at p=none with a reporting address that is monitored.
- Map every sender to an owner and a business purpose.
- Secure a mandate for cooperation before the first change requests go out.
- Move to p=reject, and keep an owner in place afterwards.
The last point deserves emphasis. A DMARC project does not end when the policy reaches reject. New tools get connected, domains get acquired, marketing vendors rotate. Without a standing owner reading the reports, enforcement quietly degrades as unauthenticated sources reappear.
Why enforcement pays for itself
The payoff described in the session reaches three different audiences at once. Reaching enforcement with a p=reject policy improves email deliverability for marketing, because authenticated, aligned mail is exactly what mailbox providers reward. It provides clarity for IT asset management, since the DMARC data ends up being an accurate inventory of everything that sends as your domains. And it significantly lowers cyber risk by stopping domain spoofing.
There is also a collective effect worth noting. The more organizations publish and enforce SPF, DKIM and DMARC, the easier it becomes for receivers everywhere to tell real mail from fake. Authentication is one of the few security controls that gets stronger as more people adopt it.
Getting from a published record to p=reject is mostly a matter of visibility and ownership: knowing every source that sends as your domain and having someone accountable for the data. Excello Mail gives you that live view of your DMARC, SPF and DKIM signals so you can map, fix and enforce without guesswork. Sign up for free to Excello Mail and make enforcement a plan instead of a wish.