Email authentication is now an accountability problem, and it needs an owner

For years, DMARC was a project a single administrator finished and moved on from. Publish the record, watch it for a while, call it done. That era is over.

Since February 2024, Google and Yahoo have required DMARC for bulk senders. Microsoft followed in May 2025, enforcing authentication for high-volume senders into Outlook, Hotmail, and Live. Regulators pushed in the same direction, so the sender rules now sit alongside PCI DSS for card payments, the EU’s NIS2 and DORA for operational resilience, and BOD 18-01 for US federal agencies. Email authentication stopped being optional and became something an organization has to answer for.

That shift raises a question most teams have not caught up to. Not whether DMARC is configured, but who is accountable for keeping it enforced, and whether the team is built to carry that. The cost of getting it wrong is not theoretical. The FBI’s Internet Crime Complaint Center (IC3) put business email compromise losses at $2.77 billion across 21,442 reported cases in 2024, and authentication is the control that blocks the spoofing those attacks lean on.

Give email authentication an accountable owner, not just a configured record

Most organizations can point to whoever published the DMARC record. Far fewer can name the person accountable for what that record does six months later. Those are two different jobs. Configuring SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a task with an end. Owning email authentication is a standing responsibility: keeping your authorized sender inventory current, reading the aggregate reports as vendors and tools come and go, and deciding when your domain is clean enough to advance from p=none to p=quarantine to p=reject. Enforcement is a milestone, not a finish line, and even a careful guide to running a DMARC test before enforcement only pays off if someone owns the monitoring in between.

Accountability also means authority. When a business unit’s mail starts failing because a new marketing platform was never added to the sender list, the owner needs the standing to fix the configuration rather than roll the policy back under pressure. Without that authority, enforcement quietly erodes, and a domain sitting at p=none protects no one while still looking configured on paper.

Certify the competence to own it

The person accountable for all of this needs range. Reading a DMARC aggregate report is the easy part. The harder work is judging risk, holding a policy under business pressure, mapping enforcement to regulation, and explaining a deliverability incident to executives and auditors in terms they act on. That is security management, not record syntax.

This is where a credential like the CISSP (Certified Information Systems Security Professional) earns its place. It certifies broad competence across security and risk management, identity and access, governance, and the legal and regulatory side, which is the exact remit of someone who owns authentication as a program rather than a task. Specialist security certification providers like Destination Certification focus on building that competence. For anyone looking to get certified, their CISSP training is widely regarded as one of the best.

Build the security function around that accountability

An accountable owner with no structure behind them is a single point of failure. Authentication touches more than one team’s work. DNS sits with infrastructure, sending platforms sit with marketing platforms and IT, incident response sits with security, and the audit trail sits with compliance. Someone has to hold those threads together.

That is why the reporting line matters as much as the skill set. A security function buried inside general IT tends to lose its enforcement argument to whichever deadline is loudest that week. Give email authentication a home in a function that reports to a security or risk leader, and p=reject holds even when a product team wants it relaxed for a campaign. Map what authentication depends on before an incident forces the question: every legitimate sender, who controls the DNS zone, how a sudden spike in failures gets triaged, and where the reports actually live.

Connect enforcement to the mandates it answers to

Enforcement is no longer just good hygiene. It maps to specific obligations, and an owner who cannot draw that map leaves the organization exposed at audit time.

The sender requirements from Google, Yahoo, and Microsoft are the visible edge. Behind them sit PCI DSS for anyone handling card payments, NIS2 and DORA for operational resilience in the EU, and BOD 18-01 for US federal agencies and the vendors who sell to them. A single view of which mandates apply to you, and how DMARC enforcement helps satisfy each, turns authentication from a technical setting into documented, auditable evidence. DMARC Report’s own rundown of the mandates making email authentication mandatory is a practical place to start that mapping. From there, the team’s job is to keep the enforcement state and the reporting current enough that the evidence holds when an auditor asks for it.

Hire for judgment, then build the skill

When it is time to add people, the instinct is to screen for tool familiarity. Judgment matters more. The owner and the team around them decide when a domain is ready to enforce, whether an unfamiliar source in the reports is a new vendor or an attacker, and how to respond when legitimate mail starts bouncing an hour before a product launch. None of that comes from memorizing record syntax. Communication carries equal weight. The people who run authentication brief auditors, push back on a business unit that wants enforcement relaxed, and explain to leadership why a spoofing attempt matters. An analyst who can make that case gets the budget and the backing to hold the line. Screen for how a candidate reasons through an ambiguous report or explains a technical failure to a non-technical audience, then train the DMARC specifics on top of that.

Measure enforcement, and keep the competence current

A program no one measures is a program leadership will not fund. For email authentication, the useful numbers are specific: the share of legitimate mail that authenticates cleanly, how many domains and subdomains sit at p=reject rather than p=none, how quickly an unknown source in the reports gets identified and resolved, and whether the enforcement evidence is ready for an audit on short notice. Those tell a leader far more than a raw count of Message blocking. The competence behind the numbers has to stay current too, because the standard itself keeps moving. The DMARCbis update revises how DMARC works, provider requirements tighten year over year, and new regulations keep landing. A one-time certification and a one-time deployment both age. An annual habit of training and review keeps the people accountable for authentication ahead of the changes rather than reacting after a mandate or a bounce storm forces the issue.

Email authentication is no longer a box an administrator ticks and forgets. Mandates, regulators, and a $2.77 billion fraud problem have turned it into something the organization has to answer for. The record on your DNS is the easy part. The accountable owner behind it, and the team and competence that keep enforcement holding, are what actually protect the domain.