DMARC Policy Changes

Fortune 100 enforcement climbed from 67 to 76 domains at p=reject out of 100 total, a solid 9-point gain. Allstate was among the movers, stepping up from p=none to p=quarantine — a meaningful first step toward full enforcement for a major insurer.

67 → 76 of 100 at p=reject

SaaS enforcement rose from 63 to 72 at p=reject out of 100 domains, bringing nearly three-quarters of the sector to the strongest policy level. Segment's jump directly to p=reject is a notable addition for a platform that handles sensitive customer data pipelines.

63 → 72 of 100 at p=reject

The tranco-top500 sector saw a dramatic jump in p=reject adoption, rising from 0 to 215 domains out of 427 total — meaning more than half the sector now enforces full rejection. Multiple domains including clarity.ms, adsafeprotected.com, and gvt2.com moved directly from no policy to p=reject this month, suggesting a coordinated push across ad-tech and analytics infrastructure.

0 → 215 of 427 at p=reject

The media sector improved from 16 to 21 domains at p=reject out of 30 tracked, with Bloomberg's move from p=quarantine to p=reject a highlight. That leaves fewer than a third of tracked media domains still below full enforcement.

16 → 21 of 30 at p=reject

Hospital systems edged up from 17 to 18 domains at p=reject out of 25 total, but the headline is a step backward: CommonSpirit Health dropped from p=reject all the way to p=none, offsetting some of the sector's progress and raising concerns about email security posture at one of the country's largest health systems.

17 → 18 of 25 at p=reject