Email authentication continues to improve, but DMARC is still widely misunderstood and often misused. The number of domains publishing DMARC records has grown steadily since 2023, especially in industries like finance, education, and healthcare. However, a large percentage of those domains are not enforcing any policy, which means spoofing and phishing attacks are still a serious concern.
Adoption is up, but enforcement remains low. Estimates show that while more than 30 percent of domains have added DMARC over the past two years, fewer than a third are using policies like quarantine or reject. Most records are set to “none,” which enables monitoring but provides no actual protection against domain impersonation. It’s a good first step, but without enforcement, DMARC doesn’t prevent malicious email from being delivered. [Read more…]
Microsoft is shifting new account signups away from passwords and toward passkeys. It’s part of a broader industry effort, with companies like Google and Apple also pushing for a future where stolen credentials are no longer a threat. This move sounds like progress, but there’s more going on beneath the surface.