- Video
2026 State of DMARC Report: Marketing, Consulting & Services
Progress is visible, but protection depends on enforcement.
Key Takeaways
- 40% of marketing and consulting domains are at DMARC enforcement, slightly below the 42% global average
- Enforcement grew ~6.5 points in 2025, showing steady progress
- 13.73% of domains sit at p=none with no reporting, a high rate of “checkbox DMARC”
- 24.20% have no valid DMARC record, above the overall baseline
- High-volume sending environments amplify risk when email security is incomplete
The State of DMARC in 2026: A Gap Between Intention and Execution for Marketing and Consulting Orgs
“Checkbox DMARC” is leaving this industry exposed.
DMARC adoption is rising globally, but enforcement is what turns policy into protection. And our 2026 report shows that the marketing and consulting industry is sitting firmly in the gap between these two.
Many organizations have published DMARC, but a notable portion stop at p=none, often without implementing reporting. This is compliance, not security.
Some misguided understanding of DMARC may trace back to bulk sender requirements from providers like Google and Yahoo. Marketing teams checked the box, set p=none, and moved on..
In high-volume email environments — campaigns, platforms, agencies — the gap between policy and protection scales fast. Brand impersonation, fake campaigns, and vendor spoofing don’t stay contained.
And because these organizations guide others on email, the stakes include credibility. Phishing or spoofing attacks can unravel an otherwise successful agency’s reputation.
Marketing and consulting orgs need to move to DMARC enforcement to achieve protection.
“Marketing and consulting orgs tell others how to do email right, but the data tells a complicated story about the industry.”
Al Iverson
Industry Research and Community Engagement Lead at Valimail
“A large share of marketing and consulting orgs have ‘checkbox DMARC’ — published, but not protecting.”
Al Iverson
Industry Research and Community Engagement Lead at Valimail
“If your DMARC isn’t at quarantine or reject, spoofed mail can still get through.”
Al Iverson
Industry Research and Community Engagement Lead at Valimail
“In high-volume environments, mistakes scale quickly.”
Al Iverson
Industry Research and Community Engagement Lead at Valimail
Protect Your Domain, Customers, and Reputation
Start your path to DMARC enforcement with a panoramic view of the traffic being sent on your behalf.
No trial offers, credit cards, or obligations.
Explore all Valimail
has to offer
Enforce DMARC to move from compliance to protection.
Attackers aren’t waiting. Neither should you.
Frequently asked questions
Why are marketing and consulting organizations at risk?
Any industry with high-volume sending and trusted brands is attractive for attackers.
What is “checkbox DMARC”?
A p=none policy without reporting — it meets requirements but doesn’t monitor or block threats.
What does DMARC enforcement actually do?
What should marketing and consulting organizations do next?
Move to enforcement (quarantine/reject) to protect your domain, your reputation, and your customers.