A third of European companies with DMARC records lack reporting addresses, leaving their email authentication policies blind to spoofing and misconfigurations. Among those with reporting configured, most send feedback to external domains rather than their own, distributed across thousands of providers.