DMARC Adoption Versus Enforcement After the Bulk-Sender Mandates: A Synthesis of Published Measurements, 2022 to 2025

In October 2023 Google and Yahoo announced that, from early 2024, bulk senders to their consumer mailboxes would have to authenticate mail with Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) and publish a Domain-based Message Authentication, Reporting, and Conformance (DMARC) record. Microsoft followed for Outlook.com with requirements effective in May 2025. All three mandates can be met with p=none, which asks receivers to take no action on failure. This narrative synthesis of published measurements from 2022 to 2025 asks whether the mandates were followed by enforcement or only by publication. Drawing on peer-reviewed studies, an institutional technical report, and labeled vendor data, we report only published numbers or arithmetic on them; no new data were collected. Publication rose sharply around the enforcement dates, while enforcing policies grew slowly. In the Tranco top 100 thousand, 55.6% of domains had a DMARC record in April 2025 and 58.4% in December 2025. Configuration 4B of Länge et al. (reject for the domain and its subdomains, with reporting) covered 13.1% and 14.8% of all domains on those dates; 4B is their strictest target, and about 25.8% had at least quarantine for both (derived, April 2025). In European Union country-code domains in the third quarter of 2024, DMARC support reached 84% to 86% and strict policy 39% to 43%. We discuss why this pattern is consistent with a monitoring-only floor, what replacing pct with the t tag in RFC 9989 means for staged enforcement, and limits on cross-study comparison.