DMARC
Microsoft 365: 89.4% adoption and 68.3% enforcement
Google Workspace measured 80.6% and 62.1%, respectively. Bases: 12,222 Microsoft 365 and 19,450 Google Workspace domains.
Research dossier · 2026
Published researchReleased August 14, 2026
Observed MX provider benchmark 2026
Across 99,300 observed domains, rank-adjusted DMARC adoption was 89.4% for Microsoft 365 and 80.6% for Google Workspace. The comparison is observational and does not show that either provider caused the difference.
Why this matters
MX provider choice does not substitute for a domain-owner DMARC policy: without enforcement, receivers have less direction when a message using the exact From domain fails aligned authentication.
58.1%
DMARC adoption
57,732 of 99,300
64.0%
Enforcement among publishers
36,938 of 57,732
20.7%
Publishers without aggregate reporting
11,959 of 57,732
2.6%
SPF recursive lookup failures
1,810 of 69,338
KEY FINDINGS
Microsoft 365 leads on DMARC deployment; Google leads on SPF health and BIMI
These are rank-band-standardized comparisons, which reduce the effect of one operator appearing more often among highly ranked domains. Each estimate uses the complete provider base shown below; the downloadable JSON includes the numerator and denominator for every rank-band component.
REPORTING + SPF
The trade-off runs in opposite directions
Publishers without aggregate reporting: 12.6% on Microsoft 365 versus 19.1% on Google. SPF lookup failures: 3.9% versus 2.6%.
BIMI + GATEWAYS
Google’s enforcing domains publish BIMI more often
BIMI among enforcing domains was 18.0% for Google and 12.7% for Microsoft 365. Recognized gateways reached 76.0% enforcement, but gateways may conceal the mailbox platform beneath them.
This study describes public DNS configuration among observed groups. It does not establish that choosing an MX operator improves authentication, and it does not measure compromise, mail delivery or internal security controls.
Why this matters
What is the risk when DMARC is missing?
An observed MX operator describes where inbound mail appears to be handled; it does not automatically protect the organization’s visible sending domain. The domain owner still needs aligned SPF or DKIM and a DMARC policy for participating receivers to apply its requested handling.
Learn how DMARC evaluates a message →Risk context
01 · DOMAIN IDENTITY
The visible From address can be forged
An attacker can send a message that displays the organization's exact domain in the From line. Without a valid DMARC record, participating receivers have no DMARC handling request from that domain owner when aligned SPF and DKIM fail.
02 · PRACTICAL HARM
Trusted business mail can be impersonated
A forged message can imitate an organization’s billing, support, executive or customer-service address, making payment redirection and credential theft more believable. Provider-group differences in this study do not show that a provider caused or prevented that risk.
Three different DNS states
- No valid DMARC
- No domain-owner DMARC policy. Aggregate reports cannot be requested through that record.
- DMARC at p=none
- Monitoring only. Reports may be collected, but the owner requests no DMARC-based quarantine or rejection.
- p=quarantine or reject
- The owner asks receivers to act on messages that fail aligned authentication. Receiver behavior can still vary.
Risk, not incident evidence: this DNS state does not prove spoofing, fraud, compromise or weak internal controls. DMARC also does not stop lookalike domains, abuse of a compromised legitimate account or every phishing technique.
Scope
What this study measures
- 01The same pinned 100,000-domain corpus used by the State of DMARC research.
- 02Complete MX exchanges and priorities, classified with a versioned public rule set.
- 03Raw and rank-band-standardized comparisons, with every denominator exposed.
Research questions
Questions the data answers
- 01Which observed MX groups publish and enforce DMARC most often?
- 02Where are aggregate-reporting addresses missing?
- 03How do SPF multiple-record and recursive lookup failures compare?
- 04How often do enforcing domains publish a BIMI record?
Release record
How this research became citable
August 14, 2026
Classifier and 100-domain manual QA completed
August 14, 2026
Pinned 100,000-domain scan and aggregate frozen
August 14, 2026
Evidence package, charts and report released
The release passed the stated evidence and review gates.
Delivery package
What is available
- Four reusable SVG charts and PNG newsroom exports.
- Aggregate provider and rank-band CSV/JSON tables.
- Methodology, classifier version and citation text.
- A 25–40-target infrastructure and email-operations media brief.
Media posture
Offer 3–5 top-matched journalists a 48-hour first look; the dataset remains non-exclusive.
Published comparisons
How the observed groups compare
Groups below the 30-domain threshold are suppressed. Every visible percentage includes its numerator and denominator.
| Group | Observed | DMARC | Enforcement | No reporting | SPF lookup failure | BIMI among enforcing |
|---|---|---|---|---|---|---|
| Unknown operator | 31,756 | 60.5% (19228/31756) | 56.4% (10840/19228) | 28.8% (5543/19228) | 1.9% (515/27288) | 8.7% (943/10840) |
| No published MX | 27,206 | 15.7% (4267/27206) | 81.3% (3470/4267) | 27% (1151/4267) | 0.6% (28/4486) | 1.8% (62/3470) |
| Google Workspace | 19,450 | 81.1% (15770/19450) | 62.7% (9886/15770) | 18.7% (2954/15770) | 2.6% (458/17294) | 18.3% (1813/9886) |
| Microsoft 365 | 12,222 | 89.5% (10938/12222) | 68% (7436/10938) | 12.8% (1399/10938) | 3.9% (473/12041) | 12.4% (923/7436) |
| Recognized gateway | 5,228 | 95% (4965/5228) | 76.4% (3791/4965) | 5% (249/4965) | 4.5% (231/5109) | 15.6% (591/3791) |
| Mixed operators | 2,117 | 82% (1736/2117) | 61% (1059/1736) | 19.6% (341/1736) | 3.5% (66/1889) | 15.2% (161/1059) |
| Other operator | 1,321 | 62.7% (828/1321) | 55.1% (456/828) | 38.9% (322/828) | 3.2% (39/1231) | 11.2% (51/456) |
Rank-adjusted provider comparison
The same Tranco rank-band distribution is applied to every operator. This reduces rank-composition bias; it does not turn the observational comparison into a causal one.
| Observed MX operator | Base | DMARC | Enforcement | No reporting | SPF lookup failure | BIMI among enforcing |
|---|---|---|---|---|---|---|
| Google Workspace | 19,450 | 80.6% | 62.1% | 19.1% | 2.6% | 18.0% |
| Microsoft 365 | 12,222 | 89.4% | 68.3% | 12.6% | 3.9% | 12.7% |
| Recognized gateway | 5,228 | 94.7% | 76.0% | 5.3% | 4.6% | 15.3% |
| Other operator | 1,321 | 63.3% | 56.4% | 38.3% | 3.2% | 11.3% |
| Mixed operators | 2,117 | 82.0% | 61.3% | 19.4% | 3.5% | 15.6% |
| Unknown operator | 31,756 | 60.8% | 56.7% | 28.4% | 1.9% | 9.0% |
Percentages are weighted estimates. “Base” is the total observed provider group; metric-specific bases and every rank-band numerator and denominator are included in the JSON download.
For editors and analysts
Reusable charts
SVG and PNG versions are licensed CC BY 4.0.
Citation & media kit
Use this research
The aggregate findings and charts are free to quote, republish and build on under CC BY 4.0. Attribute Palisade and link to this report so readers can inspect the methodology and denominators.
Suggested citation
Copy this text when quoting or republishing the dataset.
Palisade. “Observed MX provider benchmark 2026.” 2026-08-14. https://www.palisade.email/research/email-provider-benchmark-2026
Methodology
How we measured this
- 1.Resolve DMARC, SPF, BIMI and MX through the same public resolvers within one 24-hour scan window.
- 2.Classify the observed inbound MX operator from official hostname patterns. Third-party gateways remain a separate group because they can conceal the underlying mailbox platform.
- 3.Standardize each provider result against the corpus rank-band distribution to reduce rank-composition bias.
Measurement record
- Corpus and observations
- 99,300 observed of 100,000
- Scan window
- Aug 14, 2026, 05:00 PM UTC to Aug 14, 2026, 05:08 PM UTC
- Scanner version
- 2.0.0
- MX classifier version
- 2026-08-14.2
Pinned source snapshot
dcf2107c17aee2483b65cde6f9c09c6aa6355adefb987a66a36294d15b29fa7bLimitations
- — MX identifies observed inbound infrastructure, not necessarily the underlying mailbox provider.
- — The results describe configuration differences and do not establish that a provider caused them.
- — The ranked web-domain corpus is not a census of every active business email domain.
Source record
Trace the evidence
Google Workspace MX setup
Official current and legacy Google MX patterns.
Microsoft 365 external DNS records
Official Exchange Online MX hostname pattern.
State of DMARC 2026
Parent corpus, definitions and global baseline.
Publication policy
Publish aggregate provider groups only. Unknown and mixed MX answers remain visible rather than being forced into a vendor category.