Research · October 2026
38.3% of the top 1,000 websites don't enforce DMARC.
We read the public DNS records of the 1,000 most popular domains to see who stops attackers from sending mail in their name, and who doesn't.
Key findings
- 38.3% don't enforce DMARC: 26.6% have no valid DMARC record and 11.7% only monitor with p=none.
- Domains that receive email do better: 75.3% of the 693 domains with an MX record enforce DMARC.
- Popularity barely helps: 66% of the top 100 enforce DMARC, against 61.7% across all 1,000.
- 22 domains publish an SPF record over the 10 DNS lookup limit, so SPF fails for their mail, and 23.6% publish no SPF record at all.
- Newer protections are rare: only 5.1% of mail-receiving domains publish MTA-STS and 6.3% TLS-RPT; 16.4% of all domains publish BIMI.
Tranco top 1,000, public DNS, scanned October 9, 2026. Methodology · How to cite · CSV
don't enforce DMARC (no record, or p=none)
have an SPF record that exceeds the 10-lookup limit
of domains that receive mail publish MTA-STS
DMARC policy
Only quarantine and reject instruct receivers to act on spoofed mail. p=none only collects reports.
Show the data
| Policy | Domains | Share |
|---|---|---|
| No valid record | 266 | 26.6% |
| Monitoring only (p=none) | 117 | 11.7% |
| Quarantine | 172 | 17.2% |
| Reject | 445 | 44.5% |
Show the data
| Rank band | Sites | No valid record | p=none | Quarantine | Reject | Enforce |
|---|---|---|---|---|---|---|
| Rank 1–100 | 100 | 21 | 13 | 15 | 51 | 66% |
| Rank 101–500 | 400 | 122 | 41 | 57 | 180 | 59.3% |
| Rank 501–1000 | 500 | 123 | 63 | 100 | 214 | 62.8% |
Rank 1–100
66% enforce · 100 sites
Rank 101–500
59.3% enforce · 400 sites
Rank 501–1000
62.8% enforce · 500 sites
SPF DNS lookups
RFC 7208 allows at most 10 DNS-querying terms. Above that, receivers return a permanent error and SPF fails.
Show the data
| DNS lookups | Sites |
|---|---|
| 0 | 143 |
| 1 | 121 |
| 2 | 61 |
| 3 | 63 |
| 4 | 61 |
| 5 | 62 |
| 6 | 69 |
| 7 | 63 |
| 8 | 32 |
| 9 | 25 |
| 10 | 42 |
| 11 or more (over the limit) | 22 |
How SPF ends
The final "all" term tells receivers what to do with senders that aren't listed.
Show the data
| Ending | Sites | Share of SPF records |
|---|---|---|
| Hard fail (-all) | 438 | 57.3% |
| Soft fail (~all) | 274 | 35.9% |
| Neutral (?all) | 19 | 2.5% |
| Pass everything (+all) | 0 | 0% |
| Delegated (redirect=) | 33 | 4.3% |
| No all term | 0 | 0% |
Adoption of newer protections
Show the data
| Protection | Adoption |
|---|---|
| SPF (all domains) | 76.4% |
| DMARC reporting, rua (all domains) | 68.6% |
| BIMI logo (all domains) | 16.4% |
| TLS reporting (of 693 mail-receiving domains) | 6.3% |
| MTA-STS (of 693 mail-receiving domains) | 5.1% |
Who handles their inbound mail
Primary MX host of the 693 domains that receive mail (heuristic, by host name).
Show the data
| Provider (primary MX) | Domains | Share |
|---|---|---|
| Other / self-hosted | 254 | 36.7% |
| Google Workspace | 233 | 33.6% |
| Microsoft 365 (Exchange Online) | 93 | 13.4% |
| Proofpoint | 69 | 10% |
| Mimecast | 21 | 3% |
| Yandex Mail | 6 | 0.9% |
| Zoho Mail | 4 | 0.6% |
| GoDaddy | 3 | 0.4% |
What to do about it
If your own domain looks like most of the list, these guides take you from "not enforced" to protected, step by step.
- What is DMARC?How SPF, DKIM and DMARC fit together, and what each policy tells receivers to do.
- Fix "DMARC policy not enabled"Move from no record or p=none to an enforced policy without blocking your own mail.
- Stop email spoofing of your domainThe records that stop strangers sending mail in your name, including for domains that send none.
- SPF too many DNS lookupsBring an SPF record back under the 10-lookup limit so it stops failing.
Check where your domain stands now with the free Email Health Check.
Methodology
- Domains: the first 1,000 entries of the Tranco list PY35J (2026-10-08), a research-oriented ranking that combines several popularity sources.
- Data: public DNS records only (MX, TXT for SPF/DMARC/MTA-STS/TLS-RPT/BIMI), queried on 2026-10-09 through Cloudflare, Google and Quad9 public resolvers with the same engine as our free Email Health Check (ruleset 2026.10.1).
- DMARC: where a domain has no record, the parent domain's record is used if one exists (simplified organizational-domain lookup). "Enforce" means p=quarantine or p=reject.
- SPF lookups: counted recursively across include and redirect, counting include, a, mx, ptr, exists and redirect, as RFC 7208 §4.6.4 specifies.
- Mail-receiving domains: 693 domains with at least one MX record; 9 publish a Null MX (they declare that they accept no email).
Limitations
- Many top domains are CDNs, APIs or asset hosts that never send email. For them, a missing DMARC record is less risky — but anyone can still spoof them unless they publish
v=spf1 -alland DMARCp=reject. - DNS answers can differ by location and change over time. This is a single snapshot.
- Provider detection relies on MX host names and can't see a filter that sits behind a provider's own hostname.
- We did not check DKIM, because selectors can't be discovered from DNS.
Download the data
The aggregate results behind every chart on this page are available as a CSV file: email-security-top-1000.csv. It contains totals and percentages only, not results for individual domains.
You may reuse these figures with attribution to iBlockSpam and a link to this page (CC BY 4.0).
How to cite
iBlockSpam (2026). Email security of the top 1,000 websites. CC BY 4.0. https://iblockspam.com/research/email-security-top-1000
Please link to this page rather than to the CSV, so readers can see the methodology and limitations. Version: 2026-10-09 (Tranco PY35J, ruleset 2026.10.1).
Frequently asked questions
What share of the top 1,000 websites enforce DMARC?
61.7% publish DMARC at p=quarantine or p=reject. 11.7% publish p=none, which only collects reports, and 26.6% have no valid DMARC record. Among the 693 domains that receive email, 75.3% enforce.
Why doesn't DMARC p=none count as enforcement?
p=none asks receivers to send reports but to take no action on mail that fails DMARC, so spoofed messages are still delivered as normal. Only p=quarantine (treat as suspicious) and p=reject (refuse the message) tell receivers to act on mail that fails.
How were the domains chosen and scanned?
We took the first 1,000 domains of Tranco list PY35J (2026-10-08) and queried their public DNS records on 2026-10-09 through public resolvers, using the engine behind our free Email Health Check. DKIM wasn't measured, because selectors can't be discovered from DNS.
Can I reuse these figures?
Yes. The results are published under CC BY 4.0: credit iBlockSpam and link to this page, using the citation above. The CSV download has every aggregate figure behind the charts. We don't publish results for individual domains.