DMARC Adoption is Both Way Better Than Before and Not Good at All
Recent research from EasyDMARC makes clear that while deployment of DMARC records is rising fast, enforcement of DMARC best practices is abysmally low.
Are you a glass half empty person, or a glass half full type? The answer has a lot to do with how you’re likely to react to the latest research on DMARC adoption from EasyDMARC.
Glass half empty: Of 1.8 million domains inspected, under half (47.7%) have a valid DMARC record.
Glass half full: That’s up from a genuinely ugly 29.1% two years ago.
DMARC, for anyone unfamiliar with it, is an authentication protocol designed to curb spoofing, phishing, and other email-related threats. Three of IT’s biggest email service providers—Google, Yahoo, and Microsoft—now require domain owners who send 5,000 or more messages a day to use it, which is why the percentage of businesses with a DMARC record in place has spiked since 2023. Disappointingly few of those businesses, however, have configured their record correctly.
Indeed, a mere 7.7% of domains that have a valid DMARC record both reject mails that flunk DMARC authentication checks and automatically collect daily summary reports about email authentication activity, both of which are DMARC best practices. That’s up from 5.2% in 2023 (glass half full!) but still way, way too low (glass at least half empty).
“I often compare this to buying a brand-new set of locks for your door and actually not using them,” says Courtney Austin (pictured), EasyDMARC’s vice president of marketing. “It’s one thing to say you’re deploying. It’s another thing to say you’re configuring it properly.”
A lot of businesses don’t know what proper configuration looks like, however, especially if they’re small or midsize. According to EasyDMARC’s data, for example, 62.7% of Fortune 500 businesses have full-scale rejection of non-complying email in place versus just 15.2% of the SMB-scaled Inc. 5000.
Which is why DMARC services (as we’ve written here before) are a meaningful revenue opportunity for MSPs, according to EasyDMARC, beginning with the project income they generate upfront.
“From a timeline perspective, you’re not going to implement this just in a couple of days,” Austin observes. “It does take some time to configure.” There’s recurring revenue to be had after that too, he adds.
“A lot of folks think set and forget, I ticked a box,” Austin says. “There’s ongoing maintenance you’ve got to do.”
The biggest benefit of providing DMARC help, though, isn’t measured in dollars and cents so much as what Austin calls “the currency of trust.” Business owners appreciate a technology partner that’s diligent about explaining why DMARC matters, deploying it correctly, and ensuring it remains effective over time.
“It’s not just all about making a profit,” Austin says. “It’s about building up trust with that customer to say, ‘you’ve got my back.’”