Google's DMARC Push Pays Off, but Email Security Challenges Remain

Since Google and Yahoo required bulk senders to implement DMARC, adoption has roughly doubled and unauthenticated email volumes have dropped significantly, but attackers have adapted by using lookalike domains, SPF "include" misconfigurations, and orphaned subdomains to send authenticated phishing and spam. The article recommends moving organizations from "none" to "quarantine" and "reject", monitoring SPF/DNS records to prevent subdomain takeover, and adopting BIMI alongside DMARC to improve visibility and reduce impersonation risk.