DMARC has been public since 2012 but most company domains still don't enforce it