Publishing a DMARC record is only the beginning. New data show that many domains lack enforcement or reporting, exposing a gap between adopting email authentication and operating it effectively enough to detect problems and deter impersonation.