Three standards, three different identifiers
The confusion starts with a reasonable assumption, that email authentication authenticates the sender. It authenticates three identifiers, none of them the sender as a reader understands the term.
SPF authenticates the envelope sender, the address used in the SMTP transaction, which the recipient never sees. RFC 7208 section 1.1.3 defines the checked identity as the RFC5321.MailFrom reverse path, and section 2.4 requires verifiers to check it. Nothing in the specification examines the From header.
DKIM authenticates a signing domain carried in a tag on the signature, and RFC 6376 is blunt about the separation. Section 1.2 states that DKIM separates the question of the identity of the signer of the message from the purported author of the message, and section 1.5 states that verifying the signature asserts that the hashed content has not changed since it was signed and asserts nothing else.
DMARC is the only one of the three that reaches the From header, and it reaches only the domain part. RFC 9989 section 3.2.2 defines the Author Domain as the domain name of the apparent author as extracted from the RFC5322.From header field. Alignment then asks whether that domain matches an authenticated identifier, identically under strict alignment in section 3.2.10.2, or by sharing an organisational domain under relaxed alignment in section 3.2.10.1.
What the specification puts out of scope
This should settle the argument, because it is not a deployment gap or an implementation weakness. It is scope.
RFC 9989 section 2.4 is titled "Out of Scope" and lists what DMARC excludes. One of its bullets reads: "Attacks in the display name portions of the RFC5322.From header field, also known as "display name" attacks;". Section 2.2, titled "Anti-Phishing", adds that DMARC does not attempt to solve all problems with spoofed or otherwise fraudulent emails, and that in particular it does not address the use of visually similar domain names or abuse of the RFC5322.From human-readable display name.
The specification names the two techniques most commonly used to impersonate an executive or a supplier and places both outside its own remit.
Four cases, and what DMARC returns for each
The per case distinctions are the value, so they are set out individually.
Exact domain spoofing of an enforcing domain. The attacker puts your domain in the From header. No aligned authentication can be produced, your policy is consulted, and the message is rejected or quarantined. This is the case DMARC was designed for, and it works.
A lookalike domain the attacker owns. The From header reads a domain registered by the attacker. They publish their own SPF record, sign with their own DKIM key, and alignment succeeds against their own policy. The result is a genuine DMARC pass. Your enforcement is irrelevant, because your domain never appears in the message. Registration costs a few euros, which is why this is the vector a rational attacker moves to first. See typosquatting for the technique families and how registrations are monitored.
Free webmail with a spoofed display name. The From header shows a chief financial officer's name and title, with an unremarkable mailbox at a large consumer provider behind it. The provider's SPF and DKIM pass and align, so the message is another DMARC pass against a policy you do not own, and the display name is not in DMARC's remit at all.
A compromised legitimate mailbox. The mail originates from genuine authenticated infrastructure, so every check passes correctly. Authentication works exactly as specified and is irrelevant to the fraud. See business email compromise for the mechanics, and for how the mailbox is taken, MFA bypass and session cookie theft.
The bulk sender requirements set the floor at p=none
The 2024 and 2025 sender requirements are usually described as the moment DMARC became mandatory. What they made mandatory was a record, not enforcement, and all three providers say so.
Google. Senders of 5,000 or more messages a day to Gmail accounts must set up both SPF and DKIM, support one-click unsubscribe for promotional mail, and keep spam rates below 0.30 percent. On DMARC, the sender guidelines state: "Your DMARC enforcement policy can be set to none." The requirements took effect on 1 February 2024, and Google's page states that starting November 2025 Gmail is ramping up enforcement on non compliant traffic.
Yahoo. Bulk senders must implement both SPF and DKIM, run a functioning one-click unsubscribe header, and keep their spam rate below 0.3 percent, with enforcement from February 2024. The DMARC requirement is a valid policy with "at least p=none", with the added condition that DMARC must pass. Yahoo keys this to being a bulk sender and publishes no daily volume number.
Microsoft. Effective 5 May 2025, domains sending more than 5,000 emails a day to Outlook.com accounts must pass SPF and DKIM and publish DMARC of, in Microsoft's wording, "At least p=none (p=reject is recommended) and align with either SPF or DKIM (preferably both)". Non compliant mail goes to the junk folder, and if the problem persists, messages may be rejected with 550 5.7.515.
The only place an enforcing policy appears in the three regimes is advisory. Microsoft names reject in a parenthetical recommendation. Google recommends that senders fully align DMARC to both SPF and DKIM and says this will eventually be a sender requirement. Note what Google's "eventually" is about: alignment to both mechanisms rather than one, not a higher policy level. The two are routinely conflated, and conflating them is how a non enforcing record comes to be described as compliance with a mandate.
p=none is usually a destination, not a phase
Monitoring mode is sold as a first step. The longitudinal evidence says it is where records go and stay.
AFNIC, the registry for .fr, measured DMARC across all .fr domains in 2025, including domains with no mail service, on the reasoning that a domain without mail is still spoofable. 19.5 percent publish a DMARC record. Of those, 62.7 percent sit at p=none, 16.7 percent at quarantine and 20.6 percent at reject, which puts roughly 7.3 percent of all .fr domains at an enforcing policy.
The trajectory matters more than the split. AFNIC reports that a domain publishing p=none in 2023 is very likely to still be publishing p=none two years later, and that growth in quarantine and reject comes primarily from newly adopting domains choosing a restrictive setting immediately rather than from existing records being upgraded.
What enforcement looks like where it is measured
A mandate that comes with measurement is the strongest argument that the protocol is not what moves the number.
The Dutch government measures information security standards across its own estate semi annually, published by Forum Standaardisatie, and scores DMARC as a pass only at a strict policy of quarantine or reject. DMARC was placed on the Dutch comply or explain standards list on 18 May 2015. The February 2024 round covered 11,944 government domains, with the sampling frame drawn from official government registers. 82 percent had a strict policy and 18 percent did not. By layer, central government reached 85 percent, water boards 79 percent, municipalities 76 percent, provinces 73 percent, and joint arrangements 54 percent. Only 44 percent passed all the email standards measured.
Read the two populations together. Where a public body mandates the control, measures it twice a year and publishes per domain results, enforcement reaches four fifths of the estate. In an open registry population with no mandate it sits in single digits. The variable is the mandate, not the protocol.
Two things nobody has established
Both claims are made routinely, and neither survives contact with the sources.
No EU legal instrument names DMARC. Vendors asserting that NIS2 requires it are inferring the requirement from the directive's technology neutral security duties, which is an argument you only need when the instrument does not name the control.
And no study links DMARC enforcement to a measured reduction in business email compromise incidence or losses. The one serious attempt is a Global Cyber Alliance model that assumes 1 percent of received business email compromise emails result in a successful attack and derives a monetary value from that assumption. Assuming the conversion rate and then valuing the prevention makes it a model, not a measurement.
Nobody has measured the technique split either
No methodologically transparent measurement exists of display name spoofing against lookalike domains against exact domain spoofing as shares of business email compromise.
The FBI's Internet Crime Complaint Center does not break business email compromise down by technique. Its 2024 annual report carries the category as a single line, 21,442 complaints and 2,770,151,146 dollars in losses.
The figure that circulates instead, that 23 percent of business email compromise attacks arrive from a lookalike domain, is an Agari number from a first half 2021 report. Its only stated denominator is trillions of emails analysed, and no classification methodology or corpus composition was published with it. A percentage without a denominator or a labelling rule is not a measurement.
The gap is structural: the agency that collects the complaints does not see message headers, and the companies holding header level corpora publish percentages without denominators.
What the warning banner evidence actually shows
One intervention here has been properly measured, and the result is more specific than its press coverage. Tolsdorf, Langer and Lo Iacono ran two phishing simulations at a large German university hospital, published at ACM CCS 2025 as "Phishing Susceptibility and the (In-)Effectiveness of Common Anti-Phishing Interventions in a Large University Hospital".
The baseline. Study I, in January 2024, sent 12 phishing emails with no interventions. Approximately 31 percent of staff clicked the link and 26 percent interacted with the login prompt.
The intervention arm. Study II, in May 2024, had a control group login interaction rate of 16.5 percent. That is a different baseline from Study I, so the two studies' numbers cannot be chained together.
Generic provenance tags are weak. Implemented as banners, an external tag produced a 53 percent relative reduction in login interactions, and tagging both the subject line and the From field together produced 58 percent. Isolated tagging in either the subject line alone or the From field alone yielded weak, non significant effects. Placement did more work than the existence of the tag.
Explicit warnings are strong. Combined with an "unverified sender" warning, the deterrent effect increased to a relative reduction of 94 percent, at p less than .001. That is a different intervention from an [EXTERNAL] provenance tag, and the press coverage conflated the two.
One limitation belongs with the result. The study never measured credential submission, and states that no submitted credentials were collected, stored or verified. The outcome was login interaction, meaning submitting the form, which is a proxy for disclosure.
The honest summary
Publish SPF and DKIM. Reach an enforcing policy with the subdomain tags set, because exact domain spoofing of your name is real and this is the control that stops it.
Then treat the rest as a different problem. The specification puts display names and lookalike domains out of scope, the sender requirements accept a record that enforces nothing, most records that reach monitoring mode stay there, and nobody has shown that enforcement moves fraud losses. A control worth deploying for a narrow purpose is not an impersonation defence, and the gap between those two descriptions is where the money leaves.