DMARC adoption and enforcement statistics from the top 100,000 domains. We resolved their DMARC, SPF, BIMI and MX records on 13 August 2026 and measured what is actually deployed. 58.1% publish a DMARC policy, but only 64.0% of those enforce it , and enforcement collapses as you move down the ranking.
WHY THIS MATTERSWhen a forged message using a domain's exact From address fails aligned authentication, missing or monitoring-only DMARC leaves participating receivers without the domain owner's requested quarantine or rejection action. This is exposure, not proof of abuse.
57,691 of 99,310 observed domains
36,904 of 57,691 domains with DMARC
Monitoring only: asks for no DMARC-based quarantine or rejection
Have DMARC but no rua tag requesting aggregate reports
Publishing a record is not the same as requesting enforcement. Quarantine and reject ask participating receivers to act when aligned authentication fails.
| p=reject: rejection requested | 35.6% (20,537) |
|---|---|
| p=quarantine: quarantine requested | 28.4% (16,367) |
| p=none: monitoring only | 36.0% (20,787) |
Source: Palisade analysis of Tranco list PYGVJ, scan 13 August 2026. Licensed under CC BY 4.0. Download reusable SVG.
Why this matters
For any organization, the practical issue is control of the identity people see in the From line. A missing or monitoring-only DMARC policy leaves less protection at participating receiving mail systems when a message fails aligned authentication.
Learn how DMARC evaluates a message →01 · DOMAIN IDENTITY
An attacker can send a message that displays the organization's exact domain in the From line. Without a valid DMARC record, participating receivers have no DMARC handling request from that domain owner when aligned SPF and DKIM fail.
02 · PRACTICAL HARM
A forged message can imitate a familiar executive, billing team, support desk or customer-service address. That can make payment redirection, credential theft and malicious links more convincing to employees, customers and partners.
Three different DNS states
Risk, not incident evidence: this DNS state does not prove spoofing, fraud, compromise or weak internal controls. DMARC also does not stop lookalike domains, abuse of a compromised legitimate account or every phishing technique.
Each statement below preserves its population and denominator. Quote it with a link to this report; the linked SVG carries the source and licence inside the file.
“83.4% of DMARC publishers in the 1–1k Tranco band enforce, compared with 57.4% in the 90k–100k band.”
997 and 9,914 successfully observed domains, respectively. Enforcement is measured among domains with a valid DMARC record.
Download supporting SVG“20.5% of domains with a valid DMARC record publish no aggregate-reporting address (11,839 of 57,691).”
The denominator is domains publishing a valid DMARC record; the measure is absence of a usable rua tag.
Download supporting SVG“50.2% of SPF-publishing domains end their record with ~all, while 44.8% use -all.”
34,795 of 69,362 use soft fail and 31,086 of 69,362 use hard fail.
Download supporting SVG“74.1% of observed domains with MX publish DMARC, yet only 62.8% of those DMARC publishers enforce.”
72,437 successfully observed domains with MX, from 99,310 observed domains overall.
Download supporting SVG“87.3% of domains that already meet BIMI's DMARC-enforcement prerequisite have not published BIMI (30,883 of 35,362).”
Eligibility means p=quarantine or p=reject and no legacy pct value below 100; BIMI was checked at the default selector.
Download supporting SVGThe blended figure hides the real distribution. Among the 997 domains in the 1–1k band, 83.4% of DMARC publishers enforce. In the 90k–100k band, where 9,914 of the domains in this study sit, it is 57.4%.
| 1–1k: publish DMARC | 72.3% |
|---|---|
| 1–1k, publish DMARC 95% CI | 69.5–75.0% |
| 1–1k: of those, enforce | 83.4% |
| 1–1k, enforcement 95% CI | 80.5–85.9% |
| 1–1k: observed domains | 997 |
| 1k–10k: publish DMARC | 66.1% |
| 1k–10k, publish DMARC 95% CI | 65.1–67.1% |
| 1k–10k: of those, enforce | 73.5% |
| 1k–10k, enforcement 95% CI | 72.4–74.6% |
| 1k–10k: observed domains | 8,965 |
| 10k–20k: publish DMARC | 62.0% |
| 10k–20k, publish DMARC 95% CI | 61.0–62.9% |
| 10k–20k: of those, enforce | 69.9% |
| 10k–20k, enforcement 95% CI | 68.8–71.1% |
| 10k–20k: observed domains | 9,932 |
| 20k–30k: publish DMARC | 58.6% |
| 20k–30k, publish DMARC 95% CI | 57.7–59.6% |
| 20k–30k: of those, enforce | 66.9% |
| 20k–30k, enforcement 95% CI | 65.7–68.1% |
| 20k–30k: observed domains | 9,942 |
| 30k–40k: publish DMARC | 58.0% |
| 30k–40k, publish DMARC 95% CI | 57.0–58.9% |
| 30k–40k: of those, enforce | 65.4% |
| 30k–40k, enforcement 95% CI | 64.2–66.7% |
| 30k–40k: observed domains | 9,922 |
| 40k–50k: publish DMARC | 59.2% |
| 40k–50k, publish DMARC 95% CI | 58.2–60.2% |
| 40k–50k: of those, enforce | 64.1% |
| 40k–50k, enforcement 95% CI | 62.9–65.3% |
| 40k–50k: observed domains | 9,904 |
| 50k–60k: publish DMARC | 62.3% |
| 50k–60k, publish DMARC 95% CI | 61.4–63.3% |
| 50k–60k: of those, enforce | 61.6% |
| 50k–60k, enforcement 95% CI | 60.4–62.8% |
| 50k–60k: observed domains | 9,923 |
| 60k–70k: publish DMARC | 61.0% |
| 60k–70k, publish DMARC 95% CI | 60.0–61.9% |
| 60k–70k: of those, enforce | 61.0% |
| 60k–70k, enforcement 95% CI | 59.7–62.2% |
| 60k–70k: observed domains | 9,938 |
| 70k–80k: publish DMARC | 57.1% |
| 70k–80k, publish DMARC 95% CI | 56.2–58.1% |
| 70k–80k: of those, enforce | 58.2% |
| 70k–80k, enforcement 95% CI | 57.0–59.5% |
| 70k–80k: observed domains | 9,925 |
| 80k–90k: publish DMARC | 48.7% |
| 80k–90k, publish DMARC 95% CI | 47.7–49.6% |
| 80k–90k: of those, enforce | 56.1% |
| 80k–90k, enforcement 95% CI | 54.7–57.5% |
| 80k–90k: observed domains | 9,948 |
| 90k–100k: publish DMARC | 47.3% |
| 90k–100k, publish DMARC 95% CI | 46.3–48.3% |
| 90k–100k: of those, enforce | 57.4% |
| 90k–100k, enforcement 95% CI | 56.0–58.8% |
| 90k–100k: observed domains | 9,914 |
Hover a rank band, or focus the chart and use the arrow keys, to see exact values, 95% confidence intervals and the observed-domain count.
Source: Palisade analysis of Tranco list PYGVJ, scan 13 August 2026. Licensed under CC BY 4.0. Download reusable SVG.
| Rank | Observed | Publish DMARC | 95% CI | Enforce | 95% CI |
|---|---|---|---|---|---|
| 1–1k | 997 | 72.3% | 69.5–75.0% | 83.4% | 80.5–85.9% |
| 1k–10k | 8,965 | 66.1% | 65.1–67.1% | 73.5% | 72.4–74.6% |
| 10k–20k | 9,932 | 62.0% | 61.0–62.9% | 69.9% | 68.8–71.1% |
| 20k–30k | 9,942 | 58.6% | 57.7–59.6% | 66.9% | 65.7–68.1% |
| 30k–40k | 9,922 | 58.0% | 57.0–58.9% | 65.4% | 64.2–66.7% |
| 40k–50k | 9,904 | 59.2% | 58.2–60.2% | 64.1% | 62.9–65.3% |
| 50k–60k | 9,923 | 62.3% | 61.4–63.3% | 61.6% | 60.4–62.8% |
| 60k–70k | 9,938 | 61.0% | 60.0–61.9% | 61.0% | 59.7–62.2% |
| 70k–80k | 9,925 | 57.1% | 56.2–58.1% | 58.2% | 57.0–59.5% |
| 80k–90k | 9,948 | 48.7% | 47.7–49.6% | 56.1% | 54.7–57.5% |
| 90k–100k | 9,914 | 47.3% | 46.3–48.3% | 57.4% | 56.0–58.8% |
Confidence intervals use the 95% Wilson score method. Enforcement is measured only among domains in each band that publish a valid DMARC record.
20.5% of domains with a valid DMARC record publish no rua tag. The policy is live and receivers honour it, but no aggregate report is sent anywhere, so the domain owner cannot see which of their senders are failing, the exact data a move to enforcement depends on.
| Policy state | Collects aggregate reports | Collects no reports |
|---|---|---|
| Enforcingp=quarantine or p=reject | 55.3%31,924 of 57,691 DMARC publishers | 8.6%4,980 of 57,691 DMARC publishers |
| Monitor onlyp=none | 24.1%13,928 of 57,691 DMARC publishers | 11.9%6,859 of 57,691 DMARC publishers |
Source: Palisade analysis of Tranco list PYGVJ, scan 13 August 2026. Licensed under CC BY 4.0. Download reusable SVG.
These four cells are mutually exclusive and sum to every domain publishing a valid DMARC record. Reporting means a usable aggregate-reporting address is present in theruatag; it does not prove somebody is actively reviewing the reports.
| Measure | Share | Of |
|---|---|---|
| No aggregate reporting (rua)Of domains publishing DMARC | 20.5% | 11,839 of 57,691 |
| Legacy pct<100 tagRemoved by RFC 9989; still fails current BIMI readiness | 4.2% | 1,542 of 36,904 |
| Subdomains weaker than the domainsp= set below the organizational policy | 4.6% | 2,663 of 57,691 |
| Multiple DMARC recordsReceivers discard the entire policy | 0.3% | 330 of 99,310 |
| DMARC record missing p=Published at _dmarc but has no usable policy | 0.1% | 71 of 99,310 |
| Invalid p= valueThe policy value is not none, quarantine or reject | 0.0% | 16 of 99,310 |
Source: Palisade analysis of Tranco list PYGVJ, scan 13 August 2026. Licensed under CC BY 4.0. Download reusable SVG.
Alignment is a configuration choice, not a maturity score: 8.2%of DMARC publishers opt into strict DKIM or SPF alignment (4,752 of 57,691). Relaxed alignment is the standards default and is not counted as configuration debt.
The scanner retains pct as a legacy measurement so this scan remains reproducible. The current DMARC standard removed the tag in RFC 9989 because receivers applied it inconsistently. The BIMI Group implementation guide still does not accept a published value below 100 for BIMI readiness.
69.8% of observed domains publish SPF, but 50.2% of those end with ~all rather than -all. A soft fail asks receivers to accept unauthorised mail and mark it, which is the safe setting during a rollout and a weak one to leave in place permanently.
| Soft fail (~all) | 50.2% |
|---|---|
| Hard fail (-all) | 44.8% |
| No all mechanism | 2.8% |
| Neutral (?all) | 2.2% |
| More than one SPF record | 0.9% |
| Over the 10-lookup limit | 2.6% |
Source: Palisade analysis of Tranco list PYGVJ, scan 13 August 2026. Licensed under CC BY 4.0. Download reusable SVG.
The lookup limit is the quiet one. 2.6% of SPF records need more than the ten DNS lookups RFC 7208 §4.6.4 allows (1,776 of 69,362). Every one of those evaluates to PermError, so the record is published, looks correct in a text editor, and authenticates nothing. It usually happens by accretion, each new sending tool adds one more include: until the eleventh tips it over, with no warning anywhere.
72.9% of observed domains publish MX records. Restricting the study to those 72,437 mail-handling domains lifts DMARC adoption from 58.1% to 74.1%, yet enforcement barely moves: 62.8% against 64.0%. Publishing a policy is the step organisations take; enforcing it is the step they stall on.
| Measure | Share | Of |
|---|---|---|
| Publish DMARCOf 72,437 domains with MX | 74.1% | 53,708 of 72,437 |
| Of those, enforcep=quarantine or p=reject | 62.8% | 33,710 of 53,708 |
| Stuck at p=noneOf mail domains publishing DMARC | 37.2% | 19,998 of 53,708 |
| Publish SPFOf 72,437 domains with MX | 89.9% | 65,141 of 72,437 |
Source: Palisade analysis of Tranco list PYGVJ, scan 13 August 2026. Licensed under CC BY 4.0. Download reusable SVG.
BIMI puts a verified logo beside your mail in the inbox, and it only works from DMARC enforcement upward, so the hard prerequisite is the part most organisations never finish. Here the order is reversed: 35,362 domains have already reached enforcement with full coverage, and 87.3% of them have not published BIMI at all. Only 4.9% of observed domains publish a record, and 57.3% of those carry the Verified Mark Certificate Gmail requires before it will draw anything.
| Observed domains | 99,310 |
|---|---|
| Publish DMARC | 57,691 |
| At enforcement, full coverage | 35,362 |
| …and publish BIMI | 4,479 |
| …and carry a VMC | 2,695 |
Source: Palisade analysis of Tranco list PYGVJ, scan 13 August 2026. Licensed under CC BY 4.0. Download reusable SVG.
| Point at a logo | 99.3% |
|---|---|
| Carry a VMC | 57.3% |
| Not at DMARC enforcement | 7.2% |
| Deliberately declined (empty l=) | 0.6% |
Source: Palisade analysis of Tranco list PYGVJ, scan 13 August 2026. BIMI was probed at the default selector.
Records that point at nothing are rare, and more than half carry a certificate, domains that bother with BIMI mostly do it properly. The striking number is the one that is absent: 87.3% of domains that already meet the DMARC prerequisite have not published BIMI at all (30,883 of 35,362). They finished the hard part and skipped the visible reward.
Every figure above can be re-derived from scratch. The corpus is pinned, the scanner is described, and the aggregated dataset is downloadable.
The top 100,000 domains of Tranco list PYGVJ, generated 2026-07-29. Tranco averages several ranking providers over 30 days specifically to resist the day-to-day churn that makes a raw traffic snapshot impossible to reproduce. The list ID is permanent, so the exact corpus behind these numbers can be re-downloaded and re-scanned.
A domain returning NXDOMAIN or NODATA genuinely publishes no such record, and that is data. A domain that times out or returns SERVFAIL was not observed, and is excluded from every figure rather than counted as having no DMARC, treating an unreachable domain as a non-adopter would inflate every number in this report. That exclusion applied to 0.7% of the corpus (690 domains), almost all of them timeouts.
DMARC, SPF, BIMI and MX records were resolved against the public resolvers 8.8.8.8 and 1.1.1.1. BIMI was probed at the default selector, the one providers use when a message carries no BIMI-Selector header, so a domain publishing only under a custom selector is counted as having none. A DMARC record counts only when exactly one v=DMARC1 record carries a valid p= tag; duplicates are discarded by receivers under RFC 9989 §4.10 and are reported here as broken rather than absent. Two or more SPF records are a permanent error under RFC 7208 §4.5 and counted the same way. Aggregate reporting follows RFC 9990.
The lookup figure follows each record's include: and redirect= chain recursively, counting the terms RFC 7208 §4.6.4 charges against the limit of ten and breaking cycles with a visited set. Counting stops once the total passes ten, because the finding at that point is simply “exceeds the limit”: so a domain reported as over is over, but the exact figure past eleven is a floor rather than a total.
Every percentage on this page states what it is a percentage of. Adoption figures are over observed domains; policy and enforcement figures are over domains that publish a valid DMARC record. The two are very different populations, and a report that blurs them is not saying anything checkable.
The rank curve keeps the top 1,000 domains separate, groups ranks 1,001–10,000, then uses 10,000-domain windows through rank 100,000. Each adoption and enforcement estimate includes a 95% Wilson score interval, which remains well behaved near zero and 100%. Enforcement intervals use DMARC publishers in that band as their denominator, not every observed domain.
Published DMARC rates are not directly interchangeable. Corpus size, popularity, scan date, record-validation rules and the denominator can each move the result. The pattern is consistent across the comparable studies: adoption and enforcement are higher among the most-visited domains and fall into the long tail.
| Study | Corpus and date | Observed | DMARC | Of adopters, enforce | What explains the result |
|---|---|---|---|---|---|
| Palisade | Tranco top 100,000 · 13 Aug 2026 | 99,310 | 58.1% | 64.0% | Popularity-weighted, mid-sized sample; only valid policies count. |
| DDMARC | Tranco top 10,000 · 1 Jul 2026 | 8,907 | 68.2% | ≈75.0% | An elite-domain sample; enforcement is derived from its 25% p=none share. |
| DMARCguard | Tranco 5.5 million · Feb 2026 | 5,499,028 | 30.4% | 42.0% | A much larger long-tail sample, where deployment is lower. |
| DMARC.org | DomainTools valid-policy history · through 2025 | Not stated | Not comparable | Not comparable | Counts active valid policies but does not publish an Internet-wide denominator. |
Comparison values reproduce each publisher's own definitions. The ≈75.0% DDMARC enforcement figure is inferred as the complement of its reported 25% p=none share.
The figures above measure a pinned list of the most-visited domains on the web. These studies take the same public-DNS measurements to a named population instead, where every row is one identified organization and one documented domain.
These figures are free to quote, chart and build on, including commercially, under CC BY 4.0. Attribution with a link is all we ask.
Copy a citation
Palisade. (2026). The State of DMARC 2026: Enforcement across the top 100,000 domains (Version 1.4) [Data set]. https://doi.org/10.5281/zenodo.21924607
Palisade. “The State of DMARC 2026: Enforcement across the Top 100,000 Domains.” Version 1.4. 13 August 2026. https://doi.org/10.5281/zenodo.21924607.
ChatGPT
Claude
Gemini
Perplexity
Grok@dataset{palisade_state_of_dmarc_2026,
author = {{Palisade}},
title = {The State of DMARC 2026: Enforcement across the Top 100,000 Domains},
year = {2026},
version = {1.4},
publisher = {Palisade},
url = {https://doi.org/10.5281/zenodo.21924607}
}Get the data
Reusable charts
Media and research summary
Palisade scanned the DMARC, SPF, BIMI and MX records of the top 100,000 domains in pinned Tranco list PYGVJ. Of 99,310 domains successfully observed, 58.1% published a valid DMARC record. Among DMARC publishers, 64.0% enforced with quarantine or reject, while 20.5% collected no aggregate reports. Enforcement ranged from 83.4% in the 1–1k rank band to 57.4% in the 90k–100k band. The study was conducted on 13 August 2026 and the aggregated data and charts are available under CC BY 4.0.
Update history
Press and analyst enquiries: hello@palisade.email.
58.1% of the 99,310 domains we could resolve in the Tranco top 100,000 publish a valid DMARC record (57,691 of 99,310). Among domains that publish MX records (that is, domains actually set up to handle mail) it rises to 74.1%.
64.0% of domains that publish DMARC use an enforcing policy of p=quarantine or p=reject (36,904 of 57,691). The remaining 36.0% sit at p=none, which monitors but never blocks a spoofed message. Measured against all observed domains rather than DMARC users, enforcement covers roughly 37%.
Sharply. In the top 1k of the ranking, 83.4% of DMARC-publishing domains enforce. By the 90k–100k band that falls to 57.4%. Adoption follows the same curve, from 72.3% down to 47.3%.
20.5% of domains with a valid DMARC record publish no rua tag (11,839 of 57,691), so no aggregate reports are sent anywhere. The maturity matrix separates that gap by policy: 8.6% of DMARC publishers enforce without reports, while 11.9% remain at p=none and also collect nothing.
Ending the record with ~all instead of -all: 50.2% of SPF records use soft fail against 44.8% using hard fail. Separately, 0.9% of observed domains publish more than one SPF record (882 of 99,310), which is a permanent error under RFC 7208 and breaks SPF evaluation entirely. The most consequential error is invisible without following the chain: 2.6% of SPF records exceed the ten DNS lookups RFC 7208 §4.6.4 permits (1,776 of 69,362), which also produces a PermError and silently stops the record authenticating anything.
4.9% of observed domains publish a BIMI record at the default selector (4,829 of 99,310), and 57.3% of those carry the Verified Mark Certificate Gmail requires before it will draw the logo. The larger finding is the gap: BIMI only works from DMARC enforcement upward, 35,362 domains already meet that prerequisite, and 87.3% of them have not published a BIMI record at all.
We resolved DMARC, SPF and MX records for every domain in a pinned Tranco snapshot (list PYGVJ) against the public resolvers 8.8.8.8 and 1.1.1.1. Domains that failed to resolve are excluded from every figure rather than counted as having no records, and that exclusion rate, 0.7%, is published alongside the results. The full method and the scanner source are described below.