An analysis of 17.8 million phishing emails found 62% were able to pass verification checks for domain-based message authentication, reporting and conformance (DMARC).