The Uptime report

Uptime Report Research · Original DNS Measurement

DMARC Adoption Statistics 2026: We Checked 15,000 Domains, and Enforcement Halves Outside the Top 10,000

DMARC adoption statistics tell you whether a domain asks other mail servers to block messages that spoof it. This is an independent measurement from public DNS: on October 19, 2026 we queried every one of the 10,000 most popular domains on the Tranco research list, plus a random sample of 5,000 less popular ones, and classified each domain’s DMARC and SPF policy. Among the most popular domains that receive email, a majority now enforce DMARC; in the long tail, fewer than a third do.

Version 1.0 · Published October 19, 2026 · Data as of DNS scan of October 19, 2026

Key findings

  1. Among the top 10,000 domains that receive email, 60.8% enforce DMARC with a quarantine or reject policy (95% CI 59.6 to 61.9; n = 7,266).
  2. In a random sample of the long tail (Tranco ranks 10,001 to 1,000,000), only 30.5% enforce (95% CI 29.0 to 32.1; n = 3,277); the difference is significant (Fisher exact p < 0.001).
  3. Enforcement is similar across the top 1,000 (75% of the top 100 mail domains, 74% of ranks 101 to 1,000) and drops to 59% for ranks 1,001 to 10,000.
  4. 17.2% of top-10k mail domains publish no DMARC record at all, and a further 21.7% publish p=none, which monitors but does not block.
  5. 6.8% of top-10k mail domains have no SPF record; 4 domains in the full scan publish an SPF record ending in +all or a bare all, which authorizes any server on the internet to send as them.
  6. By top-level domain (at least 40 mail domains in the top 10,000), .uk has the highest enforcement rate at 87% (n = 75), followed by .gov at 81% (n = 94); the .gov figure is consistent with the federal requirement in CISA Binding Operational Directive 18-01.

From record to enforcement

Top 10,000 domains

Mail domains100.0%
Publish a DMARC record82.8%
Enforce (quarantine or reject)60.8%
Reject outright35.2%

n = 7,266 domains with MX records

Long-tail sample

Mail domains100.0%
Publish a DMARC record66.0%
Enforce (quarantine or reject)30.5%
Reject outright14.8%

n = 3,277 domains with MX records

Enforcement drops further down the ranking

Domain group (mail domains only) n Any DMARC Enforcing (95% CI) Reject
Ranks 1 to 100 67 88.1% 74.6% (63 to 84) 56.7%
Ranks 101 to 1,000 620 89.0% 74.2% (71 to 77) 49.8%
Ranks 1,001 to 10,000 6,579 82.1% 59.4% (58 to 61) 33.5%
Long tail sample (ranks 10,001 to 1,000,000) 3,277 66.0% 30.5% (29 to 32) 14.8%

SPF, the other half of authentication

DMARC builds on SPF and DKIM. SPF policy of top-10k mail domains:

  • soft fail (~all)44.0%
  • hard fail (-all)43.3%
  • none6.8%
  • redirect2.9%
  • neutral (?all)2.0%
  • invalid0.7%
  • no all mechanism0.3%
  • pass all (+all or bare all)0.0%

We also found 29 domains publishing more than one DMARC record and 113 publishing more than one SPF record, both of which make the policy invalid, 2 records whose policy tag is not separated from the version tag by a semicolon, 8 records with no policy tag at all, and policy values that are misspelled (p=100, p=nonr, p=quarentine). Receivers may ignore all of these.

By top-level domain

TLD Mail domains in top 10k Any DMARC Enforcing
.gov 94 99% 81%
.uk 75 97% 87%
.edu 124 99% 61%
.com 3644 84% 65%
.org 352 84% 55%
.de 156 87% 51%
.jp 159 83% 37%
.net 403 63% 40%
.cn 61 41% 23%

TLDs with at least 40 mail domains in the top 10,000.

What this means for MSPs

DMARC at p=none is a common resting state: it produces reports but blocks nothing. For client domains, the path is to publish a record with reporting (rua), fix the senders the reports reveal, and move to quarantine and then reject. Domains that never send mail should publish p=reject and an SPF record of v=spf1 -all, which costs nothing and closes an easy spoofing route.

Frequently asked questions

What percentage of domains use DMARC?

In our October 2026 scan, 67.7% of the Tranco top 10,000 domains publish a DMARC record, and 46.6% of a random long-tail sample do. Among domains that receive email, 60.8% of the top 10,000 enforce it.

What is DMARC p=none?

A DMARC policy of none asks receiving mail servers to report authentication failures but not to act on them. It is a monitoring stage. Quarantine sends failing mail to spam, and reject blocks it.

How many companies have DMARC set to reject?

35.2% of top-10k mail domains publish p=reject, against 14.8% in the long-tail sample.

Why should domains that do not send email publish DMARC?

Attackers can spoof any domain, including ones that never send mail. A p=reject record with an SPF record of v=spf1 -all tells receivers to block all mail claiming to come from it. Only 23.4% of top-10k domains without MX records enforce DMARC.

How was this data collected?

We queried DNS-over-HTTPS for the _dmarc TXT record, the apex TXT records (SPF), and MX records of 15,000 domains between 2026-10-19 19:42 and 2026-10-19 19:55 UTC. The domain list is Tranco list 467YX.

Download the data. dmarc-spf-scan-15000-domains-2026.csv (CSV). Licensed under CC BY 4.0: free to reuse with attribution to The Uptime Report.
Data dictionary (10 fields)
rank Tranco rank in list 467YX
domain Registrable domain
frame top10k (ranks 1 to 10,000) or tail (random sample of ranks 10,001 to 1,000,000, seed 42)
has_mx 1 if the domain has MX records other than a null MX
dmarc_policy none, quarantine, reject, invalid (several records or unknown p value), or blank if no record
dmarc_record Raw DMARC TXT record
spf_policy SPF all-mechanism or none/invalid
spf_record Raw SPF TXT record
dns_status DNS response code for _dmarc lookup: 0 NOERROR, 3 NXDOMAIN
checked_utc Timestamp of the lookup

Methodology

Sample. Tranco list 467YX (https://tranco-list.eu/list/467YX/1000000), a research-oriented ranking that averages several popularity sources. All ranks 1 to 10,000 (a census of the top 10,000) plus a simple random sample of 5,000 ranks from 10,001 to 1,000,000 (Python random.seed(42)).

Measurement. For each domain we queried TXT at _dmarc.domain, TXT at the domain apex (SPF), and MX, through Cloudflare DNS-over-HTTPS with Google DNS as fallback on resolver errors, between 2026-10-19 19:42 and 2026-10-19 19:55 UTC. 74 domains with resolver errors were excluded. Mail domains are those with an MX record that is not a null MX.

Classification. DMARC policy is the p tag of a single v=DMARC1 record; several records or an unrecognized p value count as invalid. We did not evaluate the subdomain policy (sp), pct below 100, or DKIM, which cannot be enumerated from DNS without selectors. Confidence intervals are 95% Wilson intervals; the top-versus-tail comparison uses Fisher’s exact test.

Limitations. A DMARC record shows a domain’s published policy, not whether its legitimate mail passes authentication. Popularity lists include infrastructure domains (content delivery, APIs) that do not handle mail, which is why we report mail domains separately.

Not advice. This is a measurement of public DNS records, not an assessment of any organization’s security.

Cite as:The Uptime Report. "DMARC Adoption Statistics 2026: We Checked 15,000 Domains, and Enforcement Halves Outside the Top 10,000." October 2026. https://theuptimereport.com/dmarc-adoption-statistics/

References

  1. Le Pochat et al., Tranco: A Research-Oriented Top Sites Ranking. List 467YX.
  2. RFC 7489, Domain-based Message Authentication, Reporting, and Conformance (DMARC).
  3. RFC 7208, Sender Policy Framework (SPF).
  4. CISA, Binding Operational Directive 18-01.

Research library

More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research

Threats and breaches

Infrastructure and uptime

Regulation and disclosure

Workforce and pay

MSP market and spending

Comments

Leave a Reply

Your email address will not be published. Required fields are marked *

More posts