DMARC Is Now the Law: What PCI DSS v4.0, NIS2, and DORA Mean for Your Email Program

Wed, 20 May 2026 08:00:00 +0000

For the better part of a decade, the case for DMARC rested on a single pillar: it was the right thing to do. Security teams pointed to phishing statistics. Email deliverability consultants warned about reputation damage. Vendors built dashboards to make the path from p=none to p=reject feel manageable.

None of that moved the needle fast enough.

What is moving the needle in 2026 is something organizations respond to far more reliably than best-practice guidance: the threat of fines. DMARC has crossed from recommendation into regulation, and the frameworks now requiring it carry real financial consequences.

The False Urgency Trap: What 115 CEMA Lawsuits Mean for Every Email Marketer in 2026

Tue, 19 May 2026 07:00:00 +0000

“Sale ends tonight. Don’t miss out.” is one of the most reliable subject lines in retail email marketing. It is also, when the sale does not actually end tonight, the subject line sitting at the center of approximately 115 class action lawsuits filed in the past twelve months.

The litigation wave targeting misleading email subject lines is the most consequential development in email marketing compliance in years. Two rulings in 2025 and 2026 have closed what many legal teams assumed was a federal preemption escape hatch. Retailers, e-commerce brands, and any sender using urgency-driven subject lines should understand exactly what changed and what the exposure looks like.

Compliance on Daily DMARC News

DMARC Is Now the Law: What PCI DSS v4.0, NIS2, and DORA Mean for Your Email Program

The False Urgency Trap: What 115 CEMA Lawsuits Mean for Every Email Marketer in 2026