Across 100 of 100 NRF-ranked U.S. retailer domains observed, 98.0% published valid DMARC and 86.7% of those publishers enforced quarantine or rejection. This is direct public-DNS measurement of one documented customer-facing domain per retailer, not a deliverability, incident or business-quality score.
Why this matters
This benchmark measures a public DNS instruction for mail that fails authentication, not inbox placement or fraud. An enforcing policy gives participating receivers more direction when a forged exact-domain message fails aligned authentication.
98.0%
DMARC adoption
98 of 100
86.7%
Enforcement among publishers
85 of 98
4.1%
Publishers without aggregate reporting
4 of 98
2.1%
SPF recursive lookup failures
2 of 96
Each row pairs an organization in the NRF 2026 Top 100 Retailers ranking with one documented customer-facing domain scanned in the recorded window. The rank represents U.S. retail sales, not online traffic, brand value or overall company revenue. The CSV and JSON contain the full published field set, including MX answers and aggregate-report destination domains without mailbox local parts.
| Rank | Business & domain | DMARC | Reporting | SPF | SPF lookups | BIMI | Observed MX | Observation |
|---|---|---|---|---|---|---|---|---|
| 1 | Walmartwalmart.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 5 Direct: 5 · total: 5 | Not published | Recognized gateway 10:mxa-000c7201.gslb.pphosted.com · 10:mxb-000c7201.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 2 | Amazon.comamazon.com | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: dmarc.amazon.com | valid Records: 1 · all=fail | 4 Direct: 3 · total: 4 | Published Logo yes · VMC yes | Unknown operator 5:amazon-smtp.amazon.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 3 | Costco Wholesalecostco.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=fail | 1 Direct: 1 · total: 1 | Not published | Recognized gateway 10:mx0a-001f9d01.pphosted.com · 10:mx0b-001f9d01.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 4 | The Kroger Co.kroger.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: auth.returnpath.net, kroger.com | valid Records: 1 · all=fail | 8 Direct: 1 · total: 8 | Not published | Recognized gateway 10:mxa-0019e702.gslb.pphosted.com · 10:mxb-0019e702.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 5 | The Home Depothomedepot.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 2 Direct: 2 · total: 2 | Not published | Mixed operators 10:mxa-000e6608.gslb.pphosted.com · 10:mxb-000e6608.gslb.pphosted.com · 20:mx0a-000e6608.pphosted.com · 20:mx0b-000e6608.pphosted.com · 30:exchanger1.homedepot.com · 30:exchanger2.homedepot.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 6 | CVS Health Corporationcvs.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: rua.agari.com, rep.usb.mimecastdmarcanalyzer.com | valid Records: 1 · all=softfail | 2 Direct: 2 · total: 2 | Published Logo yes · VMC yes | Recognized gateway 10:usb-smtp-inbound-1.mimecast.com · 10:usb-smtp-inbound-2.mimecast.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 7 | Walgreens Boots Alliancewalgreens.com | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: rep.usb.mimecastdmarcanalyzer.com | valid Records: 1 · all=fail | 2 Direct: 2 · total: 2 | Not published | Recognized gateway 10:mx1.hc2985-66.iphmx.com · 10:mx2.hc2985-66.iphmx.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 8 | Targettarget.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 3 Direct: 2 · total: 3 | Not published | Recognized gateway 5:mxa-0020ab02.gslb.pphosted.com · 5:mxb-0020ab02.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 9 | Lowe's Companieslowes.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: vali.email | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Published Logo yes · VMC yes | Microsoft 365 10:lowes-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 10 | Albertsons Companiesalbertsons.com | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com, albertsons.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Not published | Recognized gateway 10:mxa-005e8003.gslb.pphosted.com · 10:mxb-005e8003.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 11 | Apple Stores / iTunesapple.com | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: rua.agari.com | valid Records: 1 · all=softfail | 2 Direct: 2 · total: 2 | Published Logo yes · VMC yes | Unknown operator 10:mx-in.g.apple.com · 20:mx-in-hfd.apple.com · 20:mx-in-ma.apple.com · 20:mx-in-rn.apple.com · 20:mx-in-sg.apple.com · 20:mx-in-vib.apple.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 12 | Publix Super Marketspublix.com | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: publix.com | valid Records: 1 · all=fail | 8 Direct: 6 · total: 8 | Published Logo yes · VMC yes | Microsoft 365 0:publix-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 13 | Royal Ahold Delhaize USAfoodlion.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: vali.email | valid Records: 1 · all=softfail | >10 Direct: 13 · total: 13 | Not published | Microsoft 365 10:foodlion-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 14 | Aldialdi.us | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: mxtoolbox.dmarc-report.com | valid Records: 1 · all=fail | 4 Direct: 4 · total: 4 | Published Logo yes · VMC yes | Unknown operator 1:asgportal.in.tmes.trendmicro.eu | Observed Aug 21, 2026, 04:13 PM UTC |
| 15 | TJX Companiestjmaxx.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=fail | 1 Direct: 1 · total: 1 | Not published | Recognized gateway 10:mxa-00081a02.gslb.pphosted.com · 10:mxb-00081a02.gslb.pphosted.com · 20:mx0a-00081a02.pphosted.com · 20:mx0b-00081a02.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 16 | H.E. Butt Groceryheb.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com, dmarc.postmarkapp.com | valid Records: 1 · all=fail | 1 Direct: 1 · total: 1 | Not published | Recognized gateway 10:mxa-00182402.gslb.pphosted.com · 10:mxb-00182402.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 17 | Dollar Generaldollargeneral.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Not published | Recognized gateway 10:mxa-00155702.gslb.pphosted.com · 10:mxb-00155702.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 18 | Best Buybestbuy.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 3 Direct: 3 · total: 3 | Published Logo yes · VMC yes | Recognized gateway 10:mxa-002a6b01.gslb.pphosted.com · 10:mxb-002a6b01.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 19 | Ace Hardwareacehardware.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 8 Direct: 4 · total: 8 | Not published | Recognized gateway 5:mxa-00247502.gslb.pphosted.com · 5:mxb-00247502.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 20 | 7-Eleven7-eleven.com | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: vali.email | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Not published | Microsoft 365 0:7eleven-com0c.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 21 | Meijermeijer.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com, meijer.com | valid Records: 1 · all=softfail | 2 Direct: 2 · total: 2 | Not published | Recognized gateway 10:mxa-00185501.gslb.pphosted.com · 10:mxb-00185501.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 22 | Ross Storesrossstores.com | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com, ros.com | valid Records: 1 · all=fail | 1 Direct: 1 · total: 1 | Published Logo yes · VMC yes | Unknown operator 10:rossstores.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 23 | AT&T Wirelessatt.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Published Logo yes · VMC yes | Recognized gateway 10:mx0a-00191d01.pphosted.com · 10:mx0b-00191d01.pphosted.com · 20:mxa-00191d01.gslb.pphosted.com · 20:mxb-00191d01.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 24 | Verizon Wirelessverizon.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: auth.returnpath.net | valid Records: 1 · all=softfail | 4 Direct: 1 · total: 4 | Not published | Recognized gateway 15:mxa-0024a201.gslb.pphosted.com · 15:mxb-0024a201.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 25 | Macy'smacys.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com, macys.com | valid Records: 1 · all=softfail | 10 Direct: 6 · total: 10 | Published Logo yes · VMC yes | Recognized gateway 10:mxa-0009cc01.gslb.pphosted.com · 10:mxb-0009cc01.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 26 | BJ's Wholesale Clubbjs.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Published Logo yes · VMC yes | Recognized gateway 10:mx0a-00185201.pphosted.com · 10:mx0b-00185201.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 27 | Dicks Sporting Goodsdickssportinggoods.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Published Logo yes · VMC yes | Recognized gateway 10:mxa-00228b01.gslb.pphosted.com · 10:mxb-00228b01.gslb.pphosted.com · 15:mx0a-00228b01.pphosted.com · 15:mx0b-00228b01.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 28 | Wakefern / ShopRiteshoprite.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Not published | Unknown operator 1:mxhost01.shoprite.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 29 | Dollar Treedollartree.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: ag.us.dmarcian.com | valid Records: 1 · all=fail | 9 Direct: 8 · total: 9 | Not published | Recognized gateway 0:mxa-00a33a02.gslb.pphosted.com · 0:mxb-00a33a02.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 30 | O’Reilly Auto Partsoreillyauto.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Not published | Recognized gateway 10:mxa-00700601.gslb.pphosted.com · 10:mxb-00700601.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 31 | AutoZoneautozone.com | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Published To: rep.dmarcanalyzer.com | valid Records: 1 | 8 Direct: 3 · total: 8 | Not published | Recognized gateway 10:us-smtp-inbound-1.mimecast.com · 10:us-smtp-inbound-2.mimecast.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 32 | Tractor Supply Co.tractorsupply.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 4 Direct: 4 · total: 4 | Published Logo yes · VMC yes | Recognized gateway 10:mxa-0022f601.gslb.pphosted.com · 10:mxb-0022f601.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 33 | Nordstromnordstrom.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 5 Direct: 5 · total: 5 | Not published | Recognized gateway 10:mxa-00411f01.gslb.pphosted.com · 10:mxb-00411f01.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 34 | Kohl'skohls.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: kohls.com | valid Records: 1 · all=softfail | 6 Direct: 4 · total: 6 | Published Logo yes · VMC yes | Recognized gateway 1:mx1.kohlsinbound.iphmx.com · 1:mx2.kohlsinbound.iphmx.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 35 | Hy-Veehy-vee.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: us.cp-dmarc.com | valid Records: 1 · all=fail | 4 Direct: 2 · total: 4 | Not published | Microsoft 365 10:hyvee-com0e.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 36 | Menardsmenards.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 6 Direct: 6 · total: 6 | Not published | Unknown operator 10:ec-dmz-spam1.menard-inc.com · 10:hc-dmz-spam1.menard-inc.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 37 | Gapgap.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: ag.dmarcian.com, auth.returnpath.net, vali.email | valid Records: 1 · all=softfail | 9 Direct: 2 · total: 9 | Not published | Microsoft 365 10:gap-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 38 | Wegmans Food Marketswegmans.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com, wegmans.com | valid Records: 1 · all=softfail | 4 Direct: 3 · total: 4 | Not published | Recognized gateway 10:mxa-00118501.gslb.pphosted.com · 10:mxb-00118501.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 39 | Sherwin-Williamssherwin-williams.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: ag.dmarcian.com | valid Records: 1 · all=softfail | 10 Direct: 5 · total: 10 | Not published | Unknown operator 10:emhost60.sherwin.com · 10:emhost61.sherwin.com · 10:emhost62.sherwin.com · 10:emhost63.sherwin.com · 10:emhost64.sherwin.com · 20:emhost65.sherwin.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 40 | Chewy.comchewy.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: rep.dmarcanalyzer.com, dmarc.inboxmonster.com | valid Records: 1 | 9 Direct: 1 · total: 9 | Published Logo yes · VMC yes | Recognized gateway 10:us-smtp-inbound-1.mimecast.com · 10:us-smtp-inbound-2.mimecast.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 41 | Ulta Beautyulta.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 3 Direct: 3 · total: 3 | Not published | Recognized gateway 10:mxa-001e8203.gslb.pphosted.com · 10:mxb-001e8203.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 42 | Health Mart Systemshealthmart.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=fail | 4 Direct: 3 · total: 4 | Not published | Google Workspace 10:aspmx.l.google.com · 20:alt1.aspmx.l.google.com · 20:alt2.aspmx.l.google.com · 30:aspmx2.googlemail.com · 30:aspmx3.googlemail.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 43 | Family Dollarfamilydollar.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: ag.us.dmarcian.com | valid Records: 1 · all=softfail | 10 Direct: 6 · total: 10 | Not published | Recognized gateway 10:mxa-00183e01.gslb.pphosted.com · 10:mxb-00183e01.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 44 | Alimentation Couche-Tardcirclek.com | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Published To: circlek.com | valid Records: 1 · all=fail | 4 Direct: 4 · total: 4 | Not published | Recognized gateway 10:eu-smtp-inbound-1.mimecast.com · 10:eu-smtp-inbound-2.mimecast.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 45 | Burlingtonburlington.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Not published | Recognized gateway 50:mxa-00013201.gslb.pphosted.com · 50:mxb-00013201.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 46 | Wayfairwayfair.com | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: wayfair.com | valid Records: 1 · all=fail | 9 Direct: 5 · total: 9 | Not published | Recognized gateway 10:mxa-00180701.gslb.pphosted.com · 10:mxb-00180701.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 47 | Winco Foodswincofoods.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Not published | Recognized gateway 10:mxa-002a7701.gslb.pphosted.com · 10:mxb-002a7701.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 48 | Giant Eaglegianteagle.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: rep.dmarcanalyzer.com | valid Records: 1 · all=fail | 3 Direct: 3 · total: 3 | Not published | Recognized gateway 10:mxa-0037d401.gslb.pphosted.com · 10:mxb-0037d401.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 49 | Discount Tirediscounttire.com | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: vali.email | valid Records: 1 · all=softfail | 7 Direct: 5 · total: 7 | Not published | Microsoft 365 5:discounttire-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 50 | Good Neighbor Pharmacymygnp.com | no valid DMARC | Not observed | no SPF Records: 0 | — Direct: 0 · total: | Not published | No published MX | Observed Aug 21, 2026, 04:13 PM UTC |
The named domain is a documented consumer storefront, not necessarily every brand, mail-sending or transactional domain used by the organization. DNS observations do not establish a delivery outcome, compromise, incident or customer experience.
Logos provided by Logo.devKEY FINDINGS
Every row is one NRF-ranked retailer and one documented customer-facing domain, measured in a single recorded scan window. Public DNS shows what a domain owner published, not whether any message reached an inbox.
ENFORCEMENT GAP
13 of 98 DMARC publishers stopped at monitoring
85 retailers enforced quarantine or rejection, 86.7% of publishers. A monitoring-only policy collects reports but asks participating receivers to do nothing with mail that fails authentication. A further 4 of 98 publishers had no aggregate-reporting address, so they receive no reports either.
SPF AND MAIL ROUTING
SPF at 96/100, MX at 95/100
96.0% published a valid SPF record and 95.0% answered with MX records. 2 of 96 SPF publishers exceeded the ten-lookup limit, which makes the record fail to evaluate, and 0 published more than one SPF record.
BRAND INDICATORS
26 of 100 published a default-selector BIMI record
That is 26.0% of the cohort, and 30.6% of the 85 retailers already enforcing. BIMI requires an enforcing DMARC policy, so the enforcing group is the only one that can publish it at all.
A monitoring-only policy is a published DNS instruction, not evidence that a retailer was spoofed, breached or that its mail is failing. The report publishes no rankings, scores or per-retailer judgements.
Why this matters
Consumer-commerce businesses send familiar order, account, loyalty, delivery and payment messages. A missing or monitoring-only DMARC policy leaves less protection at participating receivers when a forged message using the exact visible From domain fails aligned authentication.
Learn how DMARC evaluates a message →01 · DOMAIN IDENTITY
An attacker can send a message that displays the organization's exact domain in the From line. Without a valid DMARC record, participating receivers have no DMARC handling request from that domain owner when aligned SPF and DKIM fail.
02 · PRACTICAL HARM
A forged shipping update, loyalty alert, payment request or account-security email can use a familiar consumer-facing identity to make a malicious link more convincing. A public DNS observation does not establish that any such message was sent, delivered, acted on or attributable to the named business.
Three different DNS states
Risk, not incident evidence: this DNS state does not prove spoofing, fraud, compromise or weak internal controls. DMARC also does not stop lookalike domains, abuse of a compromised legitimate account or every phishing technique.
August 17, 2026
NRF Top 100 source population and official customer-facing domains frozen
August 17, 2026
Public DNS scan and named-row data package completed
August 17, 2026
Table, CSV and JSON released
The release passed the stated evidence and review gates.
Media posture
Share the methodology and complete downloadable row data with specialist editors; describe public DNS configuration without treating a company as an incident or deliverability score.
Groups below the 30-domain threshold are suppressed. Every visible percentage includes its numerator and denominator.
| Group | Observed | DMARC | Enforcement | No reporting | SPF lookup failure | BIMI among enforcing |
|---|---|---|---|---|---|---|
| Recognized gateway | 52 | 100% (52/52) | 90.4% (47/52) | 0% (0/52) | 1.9% (1/52) | 23.4% (11/47) |
SVG and PNG versions are licensed CC BY 4.0.
The aggregate findings and charts are free to quote, republish and build on under CC BY 4.0. Attribute Palisade and link to this report so readers can inspect the methodology and denominators.
Palisade. “DMARC adoption in the NRF Top 100 U.S. retailers, 2026.” 2026-08-21. https://www.palisade.email/research/us-consumer-commerce-email-authentication-2026
Pinned source snapshot
2c07d8cfe731c36753828decfd6a38220c4f391fe6f69cfa16598bced01e37acOpen the exact ranked source listThe complete public 2026 ranking, compiled with Kantar and based on U.S. retail sales.
DMARC discovery, policy and aggregate-reporting semantics used by the DNS parser.
Named rows are limited to NRF-ranked organizations, one documented customer-facing domain and its observed public DNS state. The report does not assign a deliverability rate, reputation score, compromise finding, phishing incident or business-quality rating to any row.