DMARC Has Been Public Since 2012. 68.4% of Domains Still Don't Enforce It

A new CipherCue analysis just dropped a stat that sounds like a collective IT homework fail: 68.4% of company domains still don’t fully enforce email anti-spoofing rules. In plain English, that means a huge chunk of businesses still haven’t told inbox providers to actually block fake emails pretending to be from them. Even wilder, many did the digital equivalent of buying a security system and never turning it on: they published a record, then left it in “watch only” mode for years.

But the real fireworks were in the comments, where the crowd split into two camps: “Why is this still so hard?” and “Maybe email itself is the problem.” One self-hoster basically shrugged and asked what extra benefit this adds if basic protections already seem to work. Another commenter blamed tiny organizations and copy-paste tech culture, saying plenty of companies set this stuff up without understanding it, then leave the default setting forever. And then came the scorched-earth hot takes: some argued the biggest spam offenders are the giant email platforms themselves, accusing them of ignoring abuse because nobody dares block them. That escalated into full “email is broken, fork it” energy, with one user dreaming of a community-run alternative that keeps the corporate giants out.

So yes, the article is about an old email safety tool. But the comment section turned it into a familiar internet drama: lazy admins, overwhelmed small teams, Big Tech rage, and a side of homelab procrastination comedy.