RESEARCH DOSSIER / 2026
Across 999 of 1,000 observed Tranco-ranked domains, 71.9% published valid DMARC and 83.1% of those publishers enforced quarantine or rejection. This is direct public-DNS measurement of ranked domains—not a brand-value, deliverability or incident score.
WHY THIS MATTERSThis DNS benchmark measures a domain owner’s published direction for failing mail—not inbox placement or fraud—but an enforcing policy gives participating receivers more instruction when a forged exact-domain message fails aligned authentication.
71.9%
DMARC adoption
718 of 999
83.1%
Enforcement among publishers
597 of 718
6.8%
Publishers without aggregate reporting
49 of 718
2.8%
SPF recursive lookup failures
21 of 756
NAMED-ROW DATA
Each row is the exact Tranco-ranked hostname scanned in the recorded window. Tranco rank is a web-domain popularity signal, not a corporate revenue or brand-value score. The CSV and JSON contain the full published field set, including MX answers and aggregate-report destination domains without mailbox local parts.
| Rank | Domain | DMARC | Reporting | SPF | SPF lookups | BIMI | Observed MX | Observation |
|---|---|---|---|---|---|---|---|---|
| 1 | google.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: google.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Not published | Google Workspace 10:smtp.google.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 2 | cloudflare.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: dmarc-reports.cloudflare.net, cloudflare.com | valid Records: 1 · all=fail | 7 Direct: 6 · total: 7 | Published Logo yes · VMC yes | Unknown operator 5:mxa-canary.global.inbound.cf-emailsecurity.net · 5:mxb-canary.global.inbound.cf-emailsecurity.net · 10:mxa.global.inbound.cf-emailsecurity.net · 10:mxb.global.inbound.cf-emailsecurity.net | Observed Aug 17, 2026, 02:52 PM UTC |
| 3 | facebook.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: dmarc.facebookmail.com | valid Records: 1 | 1 Direct: 1 · total: 1 | Not published | Unknown operator 10:smtpin.vvv.facebook.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 4 | gstatic.com | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Published To: google.com | valid Records: 1 · all=neutral | 0 Direct: 0 · total: 0 | Not published | No published MX | Observed Aug 17, 2026, 02:52 PM UTC |
| 5 | gtld-servers.net | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: rua.agari.com, verisign.com | no SPF Records: 0 | — Direct: 0 · total: | Not published | No published MX | Observed Aug 17, 2026, 02:52 PM UTC |
| 6 | googleapis.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: google.com | valid Records: 1 · all=fail | 0 Direct: 0 · total: 0 | Not published | No published MX | Observed Aug 17, 2026, 02:52 PM UTC |
| 7 | microsoft.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: microsoft.com | valid Records: 1 · all=fail | 7 Direct: 5 · total: 7 | Not published | Microsoft 365 10:microsoft-com.mail.protection.outlook.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 8 | amazonaws.com | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: dmarc.amazonaws.com | valid Records: 1 · all=softfail | 5 Direct: 1 · total: 5 | Not published | Unknown operator 10:amazon-smtp.amazon.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 9 | youtube.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: google.com | valid Records: 1 · all=fail | 3 Direct: 2 · total: 3 | Not published | Google Workspace 0:smtp.google.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 10 | apple.com | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: rua.agari.com | valid Records: 1 · all=softfail | 2 Direct: 2 · total: 2 | Published Logo yes · VMC yes | Unknown operator 10:mx-in.g.apple.com · 20:mx-in-hfd.apple.com · 20:mx-in-ma.apple.com · 20:mx-in-rn.apple.com · 20:mx-in-sg.apple.com · 20:mx-in-vib.apple.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 11 | instagram.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: dmarc.facebookmail.com | valid Records: 1 · all=fail | 6 Direct: 2 · total: 6 | Not published | Recognized gateway 10:mxa-00082601.gslb.pphosted.com · 10:mxb-00082601.gslb.pphosted.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 12 | mail.ru | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: corp.mail.ru | valid Records: 1 | 1 Direct: 1 · total: 1 | Not published | Unknown operator 10:mxs.mail.ru | Observed Aug 17, 2026, 02:52 PM UTC |
| 13 | akamai.net | no valid DMARC | Not observed | no SPF Records: 0 | — Direct: 0 · total: | Not published | Recognized gateway 100:mx0a-00190b01.pphosted.com · 100:mx0b-00190b01.pphosted.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 14 | ezviz7.com | no valid DMARC | Not observed | valid Records: 1 · all=fail | 1 Direct: 1 · total: 1 | Not published | Unknown operator 10:mail.ezviz7.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 15 | fbcdn.net | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Published To: dmarc.facebookmail.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Not published | No published MX | Observed Aug 17, 2026, 02:52 PM UTC |
| 16 | twitter.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: rua.dmarc.emailanalyst.com | valid Records: 1 · all=fail | 4 Direct: 2 · total: 4 | Not published | Google Workspace 1:aspmx.l.google.com · 5:alt1.aspmx.l.google.com · 5:alt2.aspmx.l.google.com · 10:alt3.aspmx.l.google.com · 10:alt4.aspmx.l.google.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 17 | dzen.ru | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: dzen.ru | valid Records: 1 | 1 Direct: 1 · total: 1 | Not published | Unknown operator 10:emx.mail.ru | Observed Aug 17, 2026, 02:52 PM UTC |
| 18 | linkedin.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: rua.agari.com, rua.dmarc.emailanalyst.com | valid Records: 1 · all=softfail | 2 Direct: 2 · total: 2 | Published Logo yes · VMC yes | Unknown operator 10:mail-a.linkedin.com · 10:mail-c.linkedin.com · 10:mail-d.linkedin.com · 20:mail.linkedin.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 19 | office.com | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: dmarc.microsoft | no SPF Records: 0 | — Direct: 0 · total: | Not published | No published MX | Observed Aug 17, 2026, 02:52 PM UTC |
| 20 | googlevideo.com | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Published To: google.com | valid Records: 1 · all=neutral | 0 Direct: 0 · total: 0 | Not published | No published MX | Observed Aug 17, 2026, 02:52 PM UTC |
| 21 | hicloudcam.com | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Published To: ibesecurity.com | valid Records: 1 · all=fail | 6 Direct: 2 · total: 6 | Not published | Unknown operator 5:mxn.mxhichina.com · 10:mx01.dm.aliyun.com · 10:mxw.mxhichina.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 22 | googletagmanager.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: google.com | valid Records: 1 · all=fail | 0 Direct: 0 · total: 0 | Not published | No published MX | Observed Aug 17, 2026, 02:52 PM UTC |
| 23 | domaincontrol.com | no valid DMARC | Not observed | valid Records: 1 · all=fail | 0 Direct: 0 · total: 0 | Not published | Unknown operator 0:smtp.secureserver.net · 10:mailstore1.secureserver.net | Observed Aug 17, 2026, 02:52 PM UTC |
| 24 | akamaiedge.net | no valid DMARC | Not observed | no SPF Records: 0 | — Direct: 0 · total: | Not published | Recognized gateway 100:mx0a-00190b01.pphosted.com · 100:mx0b-00190b01.pphosted.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 25 | amazon.com | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: dmarc.amazon.com | valid Records: 1 · all=fail | 4 Direct: 3 · total: 4 | Published Logo yes · VMC yes | Unknown operator 5:amazon-smtp.amazon.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 26 | live.com | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Published To: dmarc.microsoft | valid Records: 1 · all=softfail | 5 Direct: 5 · total: 5 | Not published | Unknown operator 2:live-com.olc.protection.outlook.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 27 | akadns.net | no valid DMARC | Not observed | valid Records: 1 · all=fail | 0 Direct: 0 · total: 0 | Not published | Recognized gateway 100:mx0a-00190b01.pphosted.com · 100:mx0b-00190b01.pphosted.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 28 | azure.com | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Published To: dmarc.microsoft | valid Records: 1 · all=softfail | 2 Direct: 1 · total: 2 | Not published | Microsoft 365 10:azure-com.mail.protection.outlook.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 29 | bing.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: microsoft.com | valid Records: 1 · all=fail | 1 Direct: 1 · total: 1 | Not published | Microsoft 365 10:bing-com.mail.protection.outlook.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 30 | github.com | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: github.com | valid Records: 1 · all=softfail | 10 Direct: 8 · total: 10 | Not published | Microsoft 365 0:github-com.mail.protection.outlook.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 31 | wikipedia.org | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: wikimedia.org | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Not published | Unknown operator 10:mx-in1001.wikimedia.org · 10:mx-in2001.wikimedia.org | Observed Aug 17, 2026, 02:52 PM UTC |
| 32 | whatsapp.net | no valid DMARC | Not observed | valid Records: 1 · all=fail | 0 Direct: 0 · total: 0 | Not published | No published MX | Observed Aug 17, 2026, 02:52 PM UTC |
| 33 | fastly.net | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: fastly.com, vali.email | valid Records: 1 · all=fail | 0 Direct: 0 · total: 0 | Not published | Google Workspace 10:aspmx.l.google.com · 20:alt1.aspmx.l.google.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 34 | apple-dns.net | no valid DMARC | Not observed | no SPF Records: 0 | — Direct: 0 · total: | Not published | No published MX | Observed Aug 17, 2026, 02:52 PM UTC |
| 35 | appsflyersdk.com | no valid DMARC | Not observed | no SPF Records: 0 | — Direct: 0 · total: | Not published | No published MX | Observed Aug 17, 2026, 02:52 PM UTC |
| 36 | googleusercontent.com | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Published To: google.com | valid Records: 1 · all=neutral | 1 Direct: 1 · total: 1 | Not published | No published MX | Observed Aug 17, 2026, 02:52 PM UTC |
| 37 | doubleclick.net | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Published To: google.com | valid Records: 1 · all=neutral | 1 Direct: 1 · total: 1 | Not published | Google Workspace 10:aspmx.l.google.com · 20:alt1.aspmx.l.google.com · 30:alt2.aspmx.l.google.com · 40:alt3.aspmx.l.google.com · 50:alt4.aspmx.l.google.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 38 | aaplimg.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: rua.agari.com | valid Records: 1 · all=fail | 0 Direct: 0 · total: 0 | Not published | No published MX | Observed Aug 17, 2026, 02:52 PM UTC |
| 39 | netflix.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: rua.netcraft.com, netflix.com, dmarc.250ok.net | valid Records: 1 · all=fail | 7 Direct: 6 · total: 7 | Not published | Google Workspace 1:aspmx.l.google.com · 5:alt1.aspmx.l.google.com · 5:alt2.aspmx.l.google.com · 10:aspmx2.googlemail.com · 10:aspmx3.googlemail.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 40 | microsoftonline.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: dmarc.microsoft | valid Records: 1 · all=fail | 6 Direct: 5 · total: 6 | Not published | Microsoft 365 10:messaging-microsoft-com.mail.protection.outlook.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 41 | office.net | no valid DMARC | Not observed | no SPF Records: 0 | — Direct: 0 · total: | Not published | No published MX | Observed Aug 17, 2026, 02:52 PM UTC |
| 42 | trafficmanager.net | no valid DMARC | Not observed | no SPF Records: 0 | — Direct: 0 · total: | Not published | No published MX | Observed Aug 17, 2026, 02:52 PM UTC |
| 43 | wordpress.org | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: ag.dmarcian.com | valid Records: 1 · all=fail | 1 Direct: 1 · total: 1 | Not published | Unknown operator 10:smtp1-dca.wordpress.org · 10:smtp2-dca.wordpress.org | Observed Aug 17, 2026, 02:52 PM UTC |
| 44 | gandi.net | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Published To: gandi.net | valid Records: 1 · all=fail | 2 Direct: 1 · total: 2 | Not published | Unknown operator 10:mail12.gandi.net · 30:mail8.gandi.net | Observed Aug 17, 2026, 02:52 PM UTC |
| 45 | sharepoint.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: dmarc.microsoft | valid Records: 1 · all=fail | 5 Direct: 1 · total: 5 | Not published | Microsoft 365 0:sponaeop.mail.protection.outlook.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 46 | digicert.com | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: vali.email, digicert.com | valid Records: 1 · all=softfail | 2 Direct: 2 · total: 2 | Published Logo yes · VMC yes | Microsoft 365 0:digicert-com.mail.protection.outlook.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 47 | youtu.be | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: google.com | valid Records: 1 · all=softfail | 3 Direct: 2 · total: 3 | Not published | Mixed operators 0:smtp.google.com · 10:gmr-smtp-in.l.google.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 48 | skype.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: dmarc.microsoft, rua.netcraft.com | valid Records: 1 · all=fail | 2 Direct: 1 · total: 2 | Not published | Microsoft 365 10:skype-com.mail.protection.outlook.com | Observed Aug 17, 2026, 02:52 PM UTC |
| 49 | goo.gl | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: google.com | valid Records: 1 · all=fail | 0 Direct: 0 · total: 0 | Not published | No published MX | Observed Aug 17, 2026, 02:52 PM UTC |
| 50 | outlook.com | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Published To: dmarc.microsoft | valid Records: 1 · all=fail | 1 Direct: 1 · total: 1 | Not published | Unknown operator 5:outlook-com.olc.protection.outlook.com | Observed Aug 17, 2026, 02:52 PM UTC |
“No valid DMARC” and “no SPF” describe records observed at the named DNS location during this scan. They do not establish missing mail authentication on every sending subdomain, a delivery outcome, compromise or an incident.
WHY THIS MATTERS
High-visibility web domains are familiar to customers, staff and partners. A missing or monitoring-only DMARC policy leaves less protection at participating receivers when a forged message using the exact visible From domain fails aligned authentication.
Learn how DMARC evaluates a message →01 / DOMAIN IDENTITY
An attacker can send a message that displays the organization's exact domain in the From line. Without a valid DMARC record, participating receivers have no DMARC handling request from that domain owner when aligned SPF and DKIM fail.
02 / PRACTICAL HARM
A forged message can imitate a widely recognized domain in an account, billing, support or delivery workflow. That can make a malicious link or payment request more convincing. A public DNS observation does not show that any such message was sent, delivered or acted on.
THREE DIFFERENT DNS STATES
Risk, not incident evidence: this DNS state does not prove spoofing, fraud, compromise or weak internal controls. DMARC also does not stop lookalike domains, abuse of a compromised legitimate account or every phishing technique.
SCOPE
RESEARCH QUESTIONS
RELEASE RECORD
August 17, 2026
Current Tranco top-1,000 source snapshot pinned
August 17, 2026
Public DNS scan and named-row data package completed
August 17, 2026
Table, CSV and JSON released
The release passed the stated evidence and review gates.
DELIVERY PACKAGE
Media posture
Share the complete methodology and downloadable row data with specialist editors; describe observed DNS configuration without treating a domain as an incident or performance score.
Groups below the 30-domain threshold are suppressed. Every visible percentage includes its numerator and denominator.
| Group | Observed | DMARC | Enforcement | No reporting | SPF lookup failure | BIMI among enforcing |
|---|---|---|---|---|---|---|
| No published MX | 310 | 36.1% (112/310) | 84.8% (95/112) | 8.9% (10/112) | 0% (0/114) | 2.1% (2/95) |
| Unknown operator | 254 | 78.3% (199/254) | 74.9% (149/199) | 13.1% (26/199) | 2.2% (5/227) | 28.2% (42/149) |
| Google Workspace | 225 | 94.2% (212/225) | 87.7% (186/212) | 4.7% (10/212) | 4.2% (9/214) | 35.5% (66/186) |
| Recognized gateway | 98 | 94.9% (93/98) | 89.2% (83/93) | 0% (0/93) | 1.1% (1/93) | 32.5% (27/83) |
| Microsoft 365 | 94 | 92.6% (87/94) | 82.8% (72/87) | 2.3% (2/87) | 5.4% (5/92) | 29.2% (21/72) |
SVG and PNG versions are licensed CC BY 4.0.
CITATION & MEDIA KIT
The aggregate findings and charts are free to quote, republish and build on under CC BY 4.0. Attribute Palisade and link to this report so readers can inspect the methodology and denominators.
Suggested citation
Palisade. “Top 1,000 global web brands email-authentication benchmark 2026.” 2026-08-17. https://www.palisade.email/research/global-top-1000-web-brands-email-authentication-2026
Pinned source snapshot
9007a42efc2f980ac0d2f2c18bd53512cc84737a89d926bfe18feaadc43cabcbOpen the exact ranked source listA reproducible research ranking that combines multiple popularity signals; the report retains the permanent current-list URL for every row.
DMARC discovery, policy and aggregate-reporting semantics used by the DNS parser.
Named rows are limited to direct Tranco source domains and their observed public DNS state. The report does not assign a corporate owner, brand value, deliverability rate, reputation score, compromise finding or phishing incident to any row.