DMARC adoption in the NRF Top 100 U.S. retailers, 2026 ====================================================== Status: Published 2026-08-21T16:17:37.413Z Audience: Retail, ecommerce, CRM, email, consumer-trust and brand-protection publications Contact target: 40–60 retail, ecommerce, CRM, email-operations and brand-protection publications Plain-language summary A public-DNS benchmark of the complete NRF 2026 Top 100 Retailers population. Every row pairs one ranked U.S. retailer with a documented customer-facing domain; it does not identify every brand or sending domain operated by that business. Key findings - 100 of 100 domains were observed during the recorded scan window. - Rank-adjusted DMARC adoption: Microsoft 365 96.6% (base 29) vs Google Workspace 100.0% (base 4). - Rank-adjusted enforcement among DMARC publishers: Microsoft 365 78.6% vs Google Workspace 75.0%. - Publishers without aggregate reporting: Microsoft 365 10.7% vs Google Workspace 25.0%. - SPF lookup-limit failures: Microsoft 365 3.4% vs Google Workspace 0.0%. - BIMI among enforcing domains: Google Workspace 0.0% vs Microsoft 365 36.4%. - Recognized gateways measured 90.4% rank-adjusted enforcement (base 52); gateways may conceal the underlying mailbox platform. - These are observational comparisons. They do not show that provider choice caused the differences. Embargo approach Share the methodology and complete downloadable row data with specialist editors; describe public DNS configuration without treating a company as an incident or deliverability score. Pitch angles - Consumer trust: A transparent public-DNS view of the 100 largest U.S. retailers by retail sales, with every domain row downloadable. - Operational: Where ranked U.S. retailers publish DMARC, reporting and SPF controls, and where public records show gaps. - Standards: Why public DNS configuration can inform anti-impersonation posture without proving inbox placement or customer experience. Methodology - Use the complete public NRF Top 100 Retailers 2026 ranking, compiled with Kantar. The list ranks retail sales in the United States, not website traffic, brand value or overall company revenue. - Pair each ranked organization with one documented customer-facing official website domain. This mapping provides a transparent, repeatable DNS target, but does not claim that it is the organization’s only brand or mail-sending domain. - Query public resolvers for DMARC, apex SPF, default-selector BIMI and MX records in one recorded scan window. Resolver failures remain visible and are excluded from percentage denominators. - Publish the named rows, scan time and all classification fields. Do not infer inbox placement, sender reputation, compromise, phishing activity or business quality from DNS alone. Limitations - The NRF list is a U.S. retail-sales ranking. It is not a census of global ecommerce companies, direct-to-consumer brands or all consumer businesses. - One customer-facing website domain cannot represent every retail banner, regional domain, transactional sender or marketing platform used by a company. - DNS configuration is not a deliverability test and does not show whether a forged message was sent, accepted or delivered. - A single scan is time-bounded. Domains can update DNS after the recorded window; resolver failures remain visible and are not called missing records. Publication policy Named rows are limited to NRF-ranked organizations, one documented customer-facing domain and its observed public DNS state. The report does not assign a deliverability rate, reputation score, compromise finding, phishing incident or business-quality rating to any row. Sources - National Retail Federation Top 100 Retailers 2026: https://nrf.com/research-insights/top-retailers/top-100-retailers/top-100-retailers-2026-list, The complete public 2026 ranking, compiled with Kantar and based on U.S. retail sales. - RFC 7489 (DMARC): https://www.rfc-editor.org/rfc/rfc7489, DMARC discovery, policy and aggregate-reporting semantics used by the DNS parser. Suggested citation Palisade. “DMARC adoption in the NRF Top 100 U.S. retailers, 2026.” 2026-08-21. https://www.palisade.email/research/us-consumer-commerce-email-authentication-2026 Reusable charts - adoption (SVG): https://www.palisade.email/research/us-consumer-commerce-email-authentication-2026/charts/adoption.svg - adoption (PNG): https://www.palisade.email/research/us-consumer-commerce-email-authentication-2026/charts/adoption.png - reporting (SVG): https://www.palisade.email/research/us-consumer-commerce-email-authentication-2026/charts/reporting.svg - reporting (PNG): https://www.palisade.email/research/us-consumer-commerce-email-authentication-2026/charts/reporting.png - spf (SVG): https://www.palisade.email/research/us-consumer-commerce-email-authentication-2026/charts/spf.svg - spf (PNG): https://www.palisade.email/research/us-consumer-commerce-email-authentication-2026/charts/spf.png - bimi (SVG): https://www.palisade.email/research/us-consumer-commerce-email-authentication-2026/charts/bimi.svg - bimi (PNG): https://www.palisade.email/research/us-consumer-commerce-email-authentication-2026/charts/bimi.png Visible attribution: Source: Palisade: DMARC adoption in the NRF Top 100 U.S. retailers, 2026 (https://www.palisade.email/research/us-consumer-commerce-email-authentication-2026), CC BY 4.0.