# DMARC adoption in 2026: email authentication on the top 10,000 domains > DMARC adoption in 2026: we scanned the DNS of the top 10,000 domains on November 6, 2026. 82.8% of mail domains publish DMARC, 61.2% enforce it, 13.3% use BIMI. Canonical: https://www.cresca.xyz/research/email-authentication We looked up the public SPF, DMARC, BIMI and MTA-STS records of the 10,000 most popular domains on the Tranco list on November 6, 2026. Of the 7,236 that receive email, 82.8% publish a DMARC record, but only 61.2% enforce it with a quarantine or reject policy. By [Lalit Kumar Jangid](https://www.cresca.xyz/authors/lalit-kumar-jangid), founder of Cresca ยท Published November 7, 2026 [Key findings](https://www.cresca.xyz/research/email-authentication#findings) [Download the data (CSV)](https://www.cresca.xyz/research/email-authentication/data.csv) - Publish DMARC 82.8% of 7,236 mail-receiving domains - Enforce DMARC 61.2% of 7,236 mail-receiving domains - Publish one SPF record 92.7% of 7,236 mail-receiving domains - Publish BIMI 13.3% of 7,236 mail-receiving domains Key findings ## DMARC adoption: the key findings Each finding has its own link, so you can cite it directly. Percentages are of domains that receive email (they publish at least one MX record) unless the finding says otherwise. 1. ### DMARC adoption 82.8% of the 7,236 top domains that receive email publish a valid DMARC record (5,992 domains). 17.0% publish no DMARC record at all. 2. ### DMARC enforcement 61.2% of mail-receiving top domains enforce DMARC with p=quarantine or p=reject: 35.1% use p=reject and 26.1% use p=quarantine. Another 21.5% publish p=none, which monitors but does not stop spoofed email. 3. ### SPF adoption 92.7% of mail-receiving top domains publish exactly one SPF record. 0.6% publish more than one, which makes SPF fail with a permanent error, and 6.6% publish none. 4. ### SPF plus enforced DMARC 60.3% of mail-receiving top domains have both a single SPF record and a DMARC policy of quarantine or reject, the setup that tells receiving servers to quarantine or reject email that spoofs the domain. 5. ### DMARC reporting 87.0% of top domains with a DMARC record ask for aggregate reports (a rua= mailto address), so they can see who sends email using their domain. 6. ### BIMI adoption 13.3% of mail-receiving top domains publish a BIMI record for showing a brand logo in the inbox (959 domains), and 72.1% of those reference a mark certificate (a= tag). 7. ### MTA-STS and TLS-RPT 4.0% of mail-receiving top domains publish an MTA-STS record, which announces a policy asking other servers to deliver email to them only over verified TLS, and 4.5% publish a TLS-RPT record for TLS failure reports. 8. ### Bigger sites enforce more 74.9% of mail-receiving domains in the top 1,000 enforce DMARC (quarantine or reject), compared with 59.8% of those ranked 1,001 to 10,000. 9. ### Domains without a mail server Of the 2,724 top domains with no MX record, only 16.4% are locked against spoofing with both SPF -all and DMARC p=reject. A domain that handles no email can still be put in the From address of a phishing email. By site rank ## DMARC policy by site rank The most visited domains enforce DMARC more often. Shares are of mail-receiving domains in each rank band of the Tranco list. DMARC policy by Tranco rank band | Group | Domains | Valid DMARC | p=reject | p=quarantine | p=none | No DMARC | Enforcing | | --- | --- | --- | --- | --- | --- | --- | --- | | Top 100 | 65 | 86.2% | 56.9% | 18.5% | 10.8% | 13.8% | 75.4% | | 101 to 1,000 | 623 | 89.2% | 49.6% | 25.2% | 14.4% | 10.8% | 74.8% | | 1,001 to 10,000 | 6,548 | 82.2% | 33.6% | 26.3% | 22.3% | 17.6% | 59.8% | | All mail-receiving domains | 7,236 | 82.8% | 35.1% | 26.1% | 21.5% | 17.0% | 61.2% | SPF ## How strict are SPF records? An SPF record ends with an "all" rule that says what receivers should do with mail from servers the record does not list. Shares are of the 6,710 mail-receiving domains with exactly one SPF record. SPF all qualifier | SPF ending | Domains | Share | | --- | --- | --- | | Fail (-all): reject mail from unlisted servers | 3,130 | 46.6% | | Soft fail (~all): accept but mark | 3,199 | 47.7% | | Neutral (?all): no opinion | 143 | 2.1% | | Pass (+all): any server may send | 3 | 0.0% | | No all, uses redirect= | 209 | 3.1% | | No all and no redirect= | 26 | 0.4% | By top-level domain ## DMARC adoption by top-level domain Top-level domains with at least 100 mail-receiving domains in the top 10,000. DMARC policy by top-level domain | Group | Domains | Valid DMARC | p=reject | p=quarantine | p=none | No DMARC | Enforcing | | --- | --- | --- | --- | --- | --- | --- | --- | | .com | 3,655 | 84.7% | 38.5% | 27.5% | 18.7% | 15.1% | 66.0% | | .net | 398 | 64.1% | 25.4% | 16.6% | 22.1% | 35.9% | 42.0% | | .org | 364 | 83.2% | 33.0% | 22.8% | 27.5% | 16.5% | 55.8% | | .ru | 252 | 84.9% | 39.3% | 29.4% | 16.3% | 15.1% | 68.7% | | .de | 166 | 86.1% | 31.9% | 18.7% | 35.5% | 13.9% | 50.6% | | .jp | 163 | 82.2% | 12.9% | 26.4% | 42.9% | 17.8% | 39.3% | | .io | 157 | 77.1% | 28.7% | 27.4% | 21.0% | 22.9% | 56.1% | | .edu | 125 | 99.2% | 34.4% | 28.0% | 36.8% | 0.8% | 62.4% | Parked and web-only domains ## Domains that send no email can still be spoofed 2,724 of the domains we scanned publish no MX record, the usual sign that a domain handles no email (74 of them say so explicitly with a null MX record). Attackers can still put these domains in the From address. 26.3% of them publish DMARC and 20.7% use p=reject. 16.4% have the full lock-down: an SPF record ending in -all plus DMARC p=reject. For senders ## What this means if you send email Gmail and Yahoo require bulk senders to publish DMARC, so a record with p=none is the minimum. The domains above that enforce DMARC usually got there in steps: 1. Publish exactly one SPF record that lists every service that sends for your domain. 2. Sign your email with DKIM on your own domain, so it aligns with your From address. 3. Publish DMARC with p=none and a rua= address, and read the reports for a few weeks. 4. When every legitimate sender passes, move to p=quarantine, then p=reject. 5. For domains that send no email, publish SPF "v=spf1 -all" and DMARC p=reject. Cresca sends from your own verified domain and walks you through the SPF and DKIM records. See [custom sending domains](https://www.cresca.xyz/sending-domains) and the [Gmail and Yahoo sender requirements](https://www.cresca.xyz/blog/gmail-yahoo-sender-requirements). Methodology ## How we measured DMARC adoption - Domains: the top 10,000 of the Tranco top-sites list, list ID K9YYW (a research ranking that combines several traffic sources and is filtered to registrable domains). 1 entry was not a valid hostname and was skipped. - Date: November 6, 2026, between 18:57 and 19:01 UTC. - Lookups: MX; TXT at the domain (SPF), \_dmarc (DMARC), default.\_bimi (BIMI), \_mta-sts (MTA-STS) and \_smtp.\_tls (TLS-RPT), through the public resolvers 1.1.1.1 and 8.8.8.8. - Exclusions: 39 domains where a lookup failed after a retry (32 SERVFAIL, 6 FORMERR, 1 REFUSED). 9,960 domains were analysed. - Definitions: "receives email" means at least one MX record that is not a null MX (a domain without MX can in theory receive mail at its A record, but real mail domains rarely rely on that). A valid DMARC record is exactly one TXT record starting v=DMARC1 at \_dmarc. Enforcing means p=quarantine or p=reject. A valid SPF record is exactly one TXT record starting v=spf1. - Cross-check: a random sample of 40 domains was looked up again through a third resolver (9.9.9.9) with a separate parser; the DMARC policy matched for all 40. Limitations ## What this study does not measure - It is one snapshot of public DNS. Records change, and some domains answer differently by location. - It checks records, not mail. It does not show whether a domain's email actually passes SPF, DKIM or DMARC, and DKIM keys cannot be found without knowing each selector. - DMARC was read at each listed domain only. Subdomain policies (sp=) and records on subdomains are not analysed. - BIMI was checked at the default selector only. MTA-STS policy files were not fetched. - The top 10,000 are popular websites, not a sample of all senders. Smaller domains are likely to adopt these records less often. Cite this study ## How to cite this study You are welcome to quote and reuse these figures with credit and a link to this page. The aggregate tables are available as a CSV file. Suggested citation Cresca (2026). DMARC adoption in 2026: email authentication on the top 10,000 domains. Scan of the Tranco list K9YYW top 10,000 domains on November 6, 2026. https://www.cresca.xyz/research/email-authentication [Download aggregate data (CSV)](https://www.cresca.xyz/research/email-authentication/data.csv) FAQ ## DMARC adoption questions ### What percentage of top domains use DMARC? 82.8% of the 7,236 top domains that receive email publish a valid DMARC record (5,992 domains). 17.0% publish no DMARC record at all. ### How many domains enforce DMARC with quarantine or reject? 61.2% of mail-receiving top domains enforce DMARC with p=quarantine or p=reject: 35.1% use p=reject and 26.1% use p=quarantine. Another 21.5% publish p=none, which monitors but does not stop spoofed email. ### How common is BIMI? 13.3% of mail-receiving top domains publish a BIMI record for showing a brand logo in the inbox (959 domains), and 72.1% of those reference a mark certificate (a= tag). ### How was this DMARC adoption data collected? On November 6, 2026, Cresca looked up the public MX and TXT records (SPF, DMARC, BIMI, MTA-STS and TLS-RPT) of the top 10,000 domains on the Tranco list K9YYW, using the public resolvers 1.1.1.1 and 8.8.8.8. 9,960 domains were analysed; 39 were excluded because a lookup failed after a retry. Send from a domain that passes DMARC Cresca guides SPF and DKIM setup for your own sending domain. Free for 30 days. [Start free](https://www.cresca.xyz/signup) [More research](https://www.cresca.xyz/research)