Valimail Report: AI-Powered Phishing Surges Amid DMARC Enforcement Gap

Valimail's 2026 Report Highlights Critical Email Security Challenges

In February 2026, Valimail, a leader in Zero Trust email authentication, released its annual State of DMARC Report. The findings reveal a concerning stagnation in email security measures, particularly in the enforcement of Domain-based Message Authentication, Reporting, and Conformance (DMARC) policies, amidst a surge in AI-driven phishing attacks.

The Enforcement Gap: A Persistent Vulnerability

DMARC adoption has reached 78% among organizations; however, only 42% have implemented enforcement policies such as 'reject' or 'quarantine'. This 36-point 'Enforcement Gap' indicates that while many organizations have established DMARC records, they have not configured them to actively prevent domain spoofing. This gap leaves domains susceptible to impersonation attacks, as merely having a DMARC record without enforcement does not provide protection.

AI-Driven Phishing: A Growing Threat

The report underscores the escalating threat posed by AI-powered phishing campaigns. In 2025, Valimail identified over 2.5 billion suspicious emails, many crafted using generative AI to bypass traditional security filters. These sophisticated attacks can produce highly convincing emails that evade detection, making robust DMARC enforcement crucial in mitigating such threats.

Industry-Specific Trends and Compliance Mandates

Certain sectors have demonstrated higher DMARC enforcement rates. Online Retail and Manufacturing industries lead with enforcement rates of 72.73% and 67.61%, respectively. This proactive stance is partly due to compliance mandates from major email providers like Google, Yahoo, and Microsoft, which require DMARC implementation for bulk senders. Despite these mandates, many organizations have adopted DMARC at a basic level without full enforcement, leaving them vulnerable to spoofing attacks.

Bridging the Enforcement Gap: A Call to Action

Valimail's report serves as a critical call to action for organizations to move beyond mere DMARC adoption and implement full enforcement policies. Without enforcement, organizations remain exposed to sophisticated phishing attacks that can compromise sensitive information and damage reputations. Implementing a 'p=reject' or 'p=quarantine' policy is essential to protect against domain spoofing and ensure email security.

Conclusion

The 2026 State of DMARC Report highlights a significant vulnerability in email security due to the lack of enforcement in DMARC policies. As AI-driven phishing attacks become more prevalent and sophisticated, organizations must prioritize closing the Enforcement Gap to safeguard their communications and maintain trust with their stakeholders.

For more detailed insights, refer to the full report by Valimail: Valimail 2026 Report.