Research · November 2026
DMARC adoption in the top 10,000 domains
In November 2026, 82.6% of the 6,972 domains among the 10,000 most popular websites that receive email published a DMARC record that receivers apply. 60.8% enforced it with p=quarantine or p=reject, and 35.1% used p=reject. We measure the same list every month with the DNS checks behind our free tools.
By Ahmet Karaca · Updated · Checked against Tranco on
Key findings
- 17.4% of popular domains that receive email have no DMARC record receivers apply, so mailbox providers get no instruction for mail that fails authentication.
- Among those with DMARC, 26.4% stay at
p=none: they get reports but ask receivers to deliver failing mail as usual. - In the top 1,000, 74.3% enforce DMARC, against 60.8% across all 10,000.
- 2.6% of SPF records need more than 10 DNS lookups, which makes SPF fail with a permanent error at every receiver.
- 0.3% publish a DMARC record that receivers ignore, for example because two records sit at the same name or the
ptag is invalid.
DMARC policies
The policy is the p tag: what the domain asks receivers to do with mail that fails DMARC. p=none only collects reports, p=quarantine sends failing mail to spam and p=reject refuses it. The introduction to DMARC explains each one. Shares below are of all domains in the column.
| DMARC | Top 1,000, mailn = 672 | Top 10,000, mailn = 6,972 | All measuredn = 9,671 |
|---|---|---|---|
| Publish a DMARC record receivers apply | 88.7% | 82.6% | 67.0% |
p=none | 14.4% | 21.8% | 16.8% |
p=quarantine | 23.8% | 25.6% | 19.0% |
p=reject | 50.4% | 35.1% | 31.2% |
| Enforcing (quarantine or reject) | 74.3% | 60.8% | 50.2% |
| Record published but ignored | 0.0% | 0.3% | 0.2% |
How the DMARC records are set up
These shares are of domains that publish a DMARC record receivers apply. A record without rua sends no aggregate reports anywhere, so its owner cannot see who sends mail as the domain. Under RFC 9989, pct below 100 is obsolete and t=y is the way to test a stricter policy; the RFC 9989 summary covers the change.
| Setting | Top 1,000, mailn = 672 | Top 10,000, mailn = 6,972 | All measuredn = 9,671 |
|---|---|---|---|
Ask for aggregate reports (rua) | 93.1% | 87.1% | 86.2% |
pct below 100 | 1.3% | 2.5% | 2.4% |
Testing mode (t=y) | 0.0% | 0.0% | 0.0% |
SPF records
SPF lists the servers allowed to send mail for a domain and ends with an all rule for everything else. -all fails other servers and ~all soft-fails them; with DMARC in place the difference is small, as the softfail vs fail comparison shows. The ending shares below are of domains with an SPF record.
| SPF | Top 1,000, mailn = 672 | Top 10,000, mailn = 6,972 | All measuredn = 9,671 |
|---|---|---|---|
| Publish SPF | 93.6% | 93.0% | 74.9% |
Ends in -all | 54.2% | 47.3% | 50.9% |
Ends in ~all | 43.1% | 49.3% | 45.7% |
Ends in ?all | 2.2% | 2.3% | 2.3% |
Ends in +all | 0.0% | 0.0% | 0.0% |
No all rule or invalid record | 0.5% | 1.0% | 1.0% |
| More than one SPF record | 0.5% | 0.7% | 0.7% |
| Over the 10-lookup limit | 2.9% | 2.6% | 2.4% |
A record over the lookup limit, or a domain with two SPF records, fails SPF everywhere no matter what the record says. The guide to the 10-lookup limit and the guide to merging SPF records show the fixes.
Who receives their mail
We match each domain's MX records against the mailbox services in our sender catalog. Domains that run their own mail servers or route mail through a security gateway first are counted as other.
| Mailbox provider | Domains | Shareof 6,972 |
|---|---|---|
| Google Workspace | 2,404 | 34.5% |
| Microsoft 365 | 1,095 | 15.7% |
| Zoho Mail | 45 | 0.6% |
| Mailgun | 38 | 0.5% |
| Proton Mail | 33 | 0.5% |
| Fastmail | 23 | 0.3% |
| Other or self-hosted | 3,334 | 47.8% |
How we measured
- The list. The top 10,000 entries of the Tranco list Q2VV4, created on November 6, 2026. Tranco is a research ranking that averages several popularity sources so that one source cannot be gamed. 9,986 of the entries are valid public domain names; the rest are skipped.
- The scan. From November 7, 2026 to November 7, 2026, using the same code as our DMARC checker, SPF checker and MX lookup. The DMARC record is found the way receivers find it under RFC 9989, including a record inherited from a parent domain. SPF includes and redirects are followed and counted against the 10-lookup limit.
- Who counts as receiving email. A domain with at least one MX record that is not a null MX. Many popular domains are CDNs, APIs or ad networks that never send or receive mail; the "All measured" column includes them.
- What was left out. 304 domains did not answer every DNS query in time and 11 no longer exist in DNS. Neither group is in any share, so a slow DNS server is never counted as a missing record. 9,671 domains were measured in full.
- Limits. Popularity is not email volume, and a policy in DNS does not show how much of a domain's mail passes. We publish totals only, never a list of domains.
You are welcome to quote these numbers; please link to this page so readers can see the month and the method.
Check your own domain
The domain health check runs the same SPF, DMARC and MX checks on any domain in a few seconds and shows the record that fixes each problem. If you are at p=none, the step-by-step move to p=reject shows how to get to enforcement without blocking your own mail, and DMARC monitoring reads the reports that tell you when it is safe.