Great article.
At one occasion, after implementing DMARC for our domains (we completed the clean-up in a few months, using MxToolBox professional services), we were pretty much sure that our outgoing emails were well delivered and we could redirect complaining external receivers to their own IT teams and (far more important) we gained visibility on shadow IT developments.
After a few months, i suggested to block/quarantine incoming emails from external correspondants failing DMARC checks.
The conversation went like:
IT: “By intercepting DMRC non compliant message, we will decrease the surface attack for mail-vector attacks”
Buisness:”We cannot miss emails”,
IT: “We should invite pur correspondents to make sure their mail traffic is well formatted”
Business: “We cannot oblige our correspondents to change anything.”

Of course we had other armors availble to protect our mailboxes from nasty emails, but at the time I was not able to push for that.

Basically ww were armoring outgoing traffic, but still leaving room to suspect incoming traffic.

The digital world is not an ideal place.

It would be better if basic IT features were enabled, adopted and promoted by as many organization.

Thanks!

Nicola Guarino