One in Three University Domains Enforces DMARC. The Other Two-Thirds Are Wide Open.

Wed, 03 Jun 2026 08:00:00 +0000

Data from Valimail’s 2026 State of DMARC Report establishes higher education as the worst-performing sector for DMARC enforcement of any industry category measured. Universities, colleges, and schools sit at just 33.71% enforcement – a figure that places the sector behind retail, manufacturing, financial services, healthcare, and every other vertical tracked. The only sector that comes close is arts and recreation at 31.61%.

Proofpoint’s February 2026 analysis of the top 100 Australian universities reached a consistent finding: 66% of those institutions have not implemented DMARC at the p=reject level. Another 7% of the surveyed institutions publish no DMARC record at all. In the United States and Canada, research from dmarcian found that 60% of university domains are susceptible to phishing exploits because they either have no DMARC record, contain errors in their records, or are set to p=none.

Higher-Education on Daily DMARC News

One in Three University Domains Enforces DMARC. The Other Two-Thirds Are Wide Open.