Why Downgrading DMARC Policies Puts Brands at Risk

September 16, 2025

Allowing unauthenticated emails for CRM compatibility undermines DMARC protection, enabling ongoing spoofing campaigns and strengthening cybercriminal incentives.

Email Security
Email Security
•
1
min read
Why Downgrading DMARC Policies Puts Brands at Risk

Everything you need to know about real estate - earlier today, I noticed that one of our clients, who we had worked with to set their DMARC policy to p=reject, went ahead and downgraded it to p=none with no obvious reason for doing so.

A review of their DMARC reports from the past three months confirmed the domain was still being spoofed, with hundreds of emails originating from 165.154.0.0/16, 138.183.0.0/16, 196.202.0.0/16, and others.

After I followed up directly with the company’s founder, I was told that their CRM provider had advised them to downgrade the policy to allow non-authenticated emails to pass through.

As long as technology providers see moving from p=reject to p=none as a “solution” to get emails delivered, I don’t see how email scams will become any less attractive to cybercriminals.

Email Security
Cybersecurity
Phishing
Spoofing
Related posts
All posts
Coordinated Subdomain Takeover Campaign Targeting US Universities

Attackers are hijacking abandoned .edu subdomains via orphaned CNAME records, serving spam under trusted university domains and exploiting SEO authority.

Coordinated Subdomain Takeover Campaign Targeting US Universities
Email Security
Cloudflare's DMARC Documentation Exposed an Unregistered Domain And Dozens of Organizations Paid the Price

How an unregistered domain in Cloudflare's DMARC documentation silently exposed infrastructure data from dozens of organizations.

Cloudflare's DMARC Documentation Exposed an Unregistered Domain And Dozens of Organizations Paid the Price
Email Security
FinTech AccessPay Exposed Internal Email Infrastructure Data for Years

A misconfigured DMARC record sent sensitive email infrastructure data to an unregistered domain, creating a long-term exposure risk.

FinTech AccessPay Exposed Internal Email Infrastructure Data for Years
Email Security