dns.pizza research
The State of DMARC 2026: adoption across the top 100,000 domains
We measured DMARC records on 78,743 of the world's most-visited domains. Most still publish nothing, and a third of the records that do exist enforce nothing.
Published July 12, 2026 · data collected June 2026–July 2026 · download the data
39.7%
publish a DMARC record at all
25.1%
actually enforce (quarantine or reject)
36.7%
of existing records are parked at p=none
78.9%
of publishers request aggregate reports
Key findings
- Three in five top domains have no DMARC at all. 47,445 of 78,743 domains (60.3%) publish no record — twelve years after the standard shipped, spoofing their names remains trivial.
- Only one domain in four enforces. 19,762 domains (25.1%) use p=quarantine or p=reject. Everyone else is either absent or in monitoring mode.
- p=none is where DMARC deployments go to sleep. 36.7% of all published records (11,500 domains) enforce nothing. Monitoring mode is the right first step — but as a permanent state it advertises "we know about DMARC and chose not to finish."
- The biggest sites publish less, but enforce far harder. Top-1,000 adoption (34.9%) is actually below the 10k–100k tier (40.8%) — infrastructure and CDN domains that send no mail skew the top of the list. But among top-1k domains that do publish, 57.1% go straight to p=reject, versus 34.1% in the mid-tail.
- Countries have personalities. Japan publishes but won't enforce: 69.2% of .jp records sit at p=none, the highest of any major TLD. .cn barely engages (19.1% adoption). .uk publishers are the strictest: 76.6% of their records enforce. .edu has high adoption (69.6%) but a p=none habit (44.2% of records).
- The fine print leaks. 1,435 enforcing domains explicitly relax their subdomain policy to sp=none — the exact hole attackers use (billing.yourbank.com). 1,051 more enforce only a percentage of mail (pct<100), and 1,338 publish DMARC with no SPF record at all.
DMARC policy mix by popularity tier
Share of domains in each Tranco rank tier, by effective policy.
Source: dns.pizza email-authentication checks · snapshot July 12, 2026
Adoption vs enforcement by TLD
TLDs with at least 200 measured domains. Publishing a record and enforcing it are very different things.
Source: dns.pizza email-authentication checks · snapshot July 12, 2026
The numbers
| Segment | Domains | DMARC | none | quarantine | reject | Enforcing |
|---|---|---|---|---|---|---|
| All domains | 78,743 | 39.7% | 14.6% | 11% | 14.1% | 25.1% |
| Top 1,000 | 1,002 | 34.9% | 6.1% | 8.9% | 20% | 28.8% |
| 1,001 – 10,000 | 9,361 | 32.7% | 9% | 9.2% | 14.5% | 23.7% |
| 10,001 – 100,000 | 68,380 | 40.8% | 15.5% | 11.3% | 13.9% | 25.2% |
| .com | 36,387 | 40.5% | 14.3% | 11.2% | 15% | 26.2% |
| .net | 5,169 | 26.9% | 10.6% | 6.6% | 9.7% | 16.3% |
| .org | 3,152 | 46.4% | 18% | 13.4% | 15% | 28.4% |
| .ru | 2,864 | 42.3% | 14% | 14.2% | 14% | 28.2% |
| .io | 1,480 | 40.2% | 14.1% | 11.6% | 14.4% | 26% |
| .jp | 1,459 | 45% | 31.1% | 7.8% | 6% | 13.8% |
| .de | 1,365 | 53.9% | 22.2% | 14.9% | 16.7% | 31.6% |
| .br | 1,120 | 48.3% | 19.6% | 15.9% | 12.6% | 28.5% |
| .in | 1,102 | 35.5% | 10.2% | 11.5% | 13.8% | 25.3% |
| .uk | 1,036 | 56.1% | 13.1% | 17.3% | 25.7% | 43% |
| .fr | 766 | 52.9% | 20.4% | 12.9% | 19.6% | 32.5% |
| .cn | 747 | 19.1% | 7.1% | 4.8% | 7% | 11.8% |
| .it | 683 | 51.4% | 24% | 16.5% | 10.8% | 27.4% |
| .co | 680 | 38.7% | 12.6% | 13.8% | 12.2% | 26% |
| .edu | 647 | 69.6% | 30.8% | 21.5% | 17.3% | 38.8% |
Methodology
dns.pizza continuously runs email-authentication checks (SPF, DKIM, DMARC, MX) while generating domain intelligence reports across the Tranco top 100,000. This report aggregates the latest conclusive check per domain — 78,743 domains measured between June 10, 2026 and July 12, 2026.
One vote per domain (latest check only). Checks whose DMARC DNS lookup failed are excluded from every denominator — an unreachable record is unknown, not absent. "Enforcing" means p=quarantine or p=reject on the organizational domain's record at _dmarc.<domain>. Only domains ranked in the Tranco top 100,000 at snapshot time are included, so the three rank tiers together cover the entire corpus. Per-TLD rows require at least 200 measured domains.
Limitations: the corpus is the most-visited slice of the web, so absolute adoption rates will read higher than the web at large; policy percentages describe published records, not mailbox-provider behavior; and domains that send no email have legitimate reasons to skip DMARC (though publishing p=reject on a no-mail domain is free and recommended).
The data is free to cite and reuse (CC BY 4.0, credit "dns.pizza"). For questions or the raw per-domain data, get in touch.
Where does your domain land?
Check your DMARC policy — and whether it actually enforces anything — in one click.