Across 100 of 100 NRF-ranked U.S. retailer domains observed, 98.0% published valid DMARC and 86.7% of those publishers enforced quarantine or rejection. This is direct public-DNS measurement of one documented customer-facing domain per retailer, not a deliverability, incident or business-quality score.
Why this matters
This benchmark measures a public DNS instruction for mail that fails authentication, not inbox placement or fraud. An enforcing policy gives participating receivers more direction when a forged exact-domain message fails aligned authentication.
98.0%
DMARC adoption
98 of 100
86.7%
Enforcement among publishers
85 of 98
4.1%
Publishers without aggregate reporting
4 of 98
2.1%
SPF recursive lookup failures
2 of 96
Each row pairs an organization in the NRF 2026 Top 100 Retailers ranking with one documented customer-facing domain scanned in the recorded window. The rank represents U.S. retail sales, not online traffic, brand value or overall company revenue. The CSV and JSON contain the full published field set, including MX answers and aggregate-report destination domains without mailbox local parts.
| Rank | Business & domain | DMARC | Reporting | SPF | SPF lookups | BIMI | Observed MX | Observation |
|---|---|---|---|---|---|---|---|---|
| 51 | Saks Globalsaks.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: vali.email, sakscloudservices.com, dmarc.postmarkapp.com | valid Records: 1 · all=softfail | 3 Direct: 3 · total: 3 | Not published | Google Workspace 1:aspmx.l.google.com · 5:alt1.aspmx.l.google.com · 5:alt2.aspmx.l.google.com · 10:alt3.aspmx.l.google.com · 10:alt4.aspmx.l.google.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 52 | Sephora (LVMH)sephora.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=fail | >10 Direct: 6 · total: 12 | Published Logo yes · VMC yes | Recognized gateway 10:mxa-0024c501.gslb.pphosted.com · 10:mxb-0024c501.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 53 | Sprouts Farmers Marketsprouts.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=fail | 1 Direct: 1 · total: 1 | Not published | Recognized gateway 5:mx0a-00224301.pphosted.com · 5:mx0b-00224301.pphosted.com · 10:mxa-00224301.gslb.pphosted.com · 10:mxb-00224301.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 54 | Harbor Freight Toolsharborfreight.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 7 Direct: 6 · total: 7 | Not published | Recognized gateway 10:mxa-00515601.gslb.pphosted.com · 10:mxb-00515601.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 55 | Northeast Grocerypricechopper.com | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Published To: vali.email | valid Records: 1 · all=softfail | 7 Direct: 6 · total: 7 | Not published | Microsoft 365 0:pricechopper-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 56 | Petsmartpetsmart.com | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com, petsmart.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Not published | Recognized gateway 10:mxa-003bb001.gslb.pphosted.com · 10:mxb-003bb001.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 57 | Chedrauielsupermarkets.com | no valid DMARC | Not observed | valid Records: 1 · all=fail | 1 Direct: 1 · total: 1 | Not published | Microsoft 365 0:elsupermarkets-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 58 | Bass Probasspro.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: vali.email | valid Records: 1 · all=fail | 2 Direct: 2 · total: 2 | Published Logo yes · VMC yes | Microsoft 365 0:basspro-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 59 | Williams-Sonomawilliams-sonoma.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 6 Direct: 5 · total: 6 | Not published | Microsoft 365 0:williamssonoma-com02b.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 60 | Army and Air Force Exchange Serviceshopmyexchange.com | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: aafes.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Published Logo yes · VMC yes | Microsoft 365 0:shopmyexchange-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 61 | Amwayamway.com | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=fail | 1 Direct: 1 · total: 1 | Not published | Microsoft 365 0:amway-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 62 | Hobby Lobby Storeshobbylobby.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Not published | Recognized gateway 10:mxa-0024a001.gslb.pphosted.com · 10:mxb-0024a001.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 63 | QVC Groupqvc.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: rua.dmp.cisco.com | valid Records: 1 · all=fail | 2 Direct: 2 · total: 2 | Published Logo yes · VMC yes | Microsoft 365 100:qvc-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 64 | AVB Brandsourcebrandsource.com | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Published To: ag.us.dmarcian.com | valid Records: 1 · all=softfail | 10 Direct: 3 · total: 10 | Not published | Microsoft 365 0:brandsource-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 65 | Bath & Body Worksbathandbodyworks.com | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Not published | valid Records: 1 · all=softfail | 2 Direct: 2 · total: 2 | Published Logo yes · VMC yes | Microsoft 365 10:bathandbodyworks-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 66 | Dell Technologiesdell.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com, dell.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Not published | Recognized gateway 10:mxa-00154901.gslb.pphosted.com · 10:mxb-00154901.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 67 | True Value Co.truevalue.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 2 Direct: 2 · total: 2 | Not published | Recognized gateway 10:mxa-0004a501.gslb.pphosted.com · 10:mxb-0004a501.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 68 | Total Wine & Moretotalwine.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Not published | Recognized gateway 5:mxa-001ae701.gslb.pphosted.com · 5:mxb-001ae701.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 69 | Camping Worldcampingworld.com | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Not published | Recognized gateway 10:mxb-00175601.gslb.pphosted.com · 20:mxa-00175601.gslb.pphosted.com · 30:mx0a-00175601.pphosted.com · 30:mx0b-00175601.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 70 | JD Sportsjdsports.com | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 7 Direct: 5 · total: 7 | Not published | Recognized gateway 10:mxa-00158f01.gslb.pphosted.com · 10:mxb-00158f01.gslb.pphosted.com · 100:mx0a-00158f01.pphosted.com · 100:mx0b-00158f01.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 71 | Lululemonlululemon.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: ag.ca.dmarcian.com | valid Records: 1 · all=fail | 3 Direct: 3 · total: 3 | Not published | Microsoft 365 5:lululemon-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 72 | Caseys General Storecaseys.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Not published | Recognized gateway 10:mxa-0025e701.gslb.pphosted.com · 10:mxb-0025e701.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 73 | Dillardsdillards.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Not published | Recognized gateway 45:mx0a-00085101.pphosted.com · 45:mx0b-00085101.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 74 | Signet Jewelerskay.com | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: rep.dmarcanalyzer.com | valid Records: 1 · all=softfail | 10 Direct: 2 · total: 10 | Not published | Recognized gateway 10:us-smtp-inbound-1.mimecast.com · 10:us-smtp-inbound-2.mimecast.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 75 | Staplesstaples.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: vali.email, inbound.dmarcdigests.com | valid Records: 1 · all=softfail | 3 Direct: 3 · total: 3 | Not published | Microsoft 365 10:staples-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 76 | Academy Sportsacademy.com | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Not published | valid Records: 1 · all=softfail | 8 Direct: 4 · total: 8 | Not published | Microsoft 365 10:academy-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 77 | J.C. Penney Companyjcpenney.com | quarantine p=quarantine · pct=10 Strict alignment: DKIM no · SPF no | Published To: mxtoolbox.dmarc-report.com | valid Records: 1 · all=fail | 2 Direct: 2 · total: 2 | Not published | Microsoft 365 10:jcpenney-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 78 | Piggly Wigglypigglywiggly.com | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Published To: vali.email | no SPF Records: 0 | — Direct: 0 · total: | Not published | No published MX | Observed Aug 21, 2026, 04:13 PM UTC |
| 79 | Petcopetco.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: petco.com | valid Records: 1 · all=softfail | 2 Direct: 2 · total: 2 | Not published | Microsoft 365 0:petco-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 80 | Raley's Supermarketsraleys.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Not published | valid Records: 1 · all=softfail | 6 Direct: 4 · total: 6 | Not published | Microsoft 365 10:raleys-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 81 | My Demoulasshopmarketbasket.com | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Published To: vali.email | valid Records: 1 · all=softfail | 2 Direct: 2 · total: 2 | Not published | Microsoft 365 0:shopmarketbasket-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 82 | Victoria's Secretvictoriassecret.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Published Logo yes · VMC yes | No published MX | Observed Aug 21, 2026, 04:13 PM UTC |
| 83 | Ikea North America Svcsikea.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: ikea.com | valid Records: 1 · all=fail | 2 Direct: 2 · total: 2 | Published Logo yes · VMC yes | Unknown operator 0:ikea-com.i-v1.mx.microsoft | Observed Aug 21, 2026, 04:13 PM UTC |
| 84 | Michaels Storesmichaels.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com, dmarc.everest.email, rua.easydmarc.us | valid Records: 1 · all=softfail | 7 Direct: 5 · total: 7 | Not published | Recognized gateway 10:mxa-005f4f01.gslb.pphosted.com · 10:mxb-005f4f01.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 85 | Defense Commissary Agencycommissaries.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: deca.mil, mail.mil | no SPF Records: 0 | — Direct: 0 · total: | Not published | No published MX | Observed Aug 21, 2026, 04:13 PM UTC |
| 86 | Stater Bros Holdingsstaterbros.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: staterbros.com | valid Records: 1 · all=fail | 2 Direct: 2 · total: 2 | Published Logo yes · VMC no | Unknown operator 10:primary.us.email.fireeyecloud.com · 20:alt1.us.email.fireeyecloud.com · 30:alt2.us.email.fireeyecloud.com · 40:alt3.us.email.fireeyecloud.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 87 | Exxon Mobil Corporationexxon.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com, exxonmobil.com | no SPF Records: 0 | — Direct: 0 · total: | Not published | No published MX | Observed Aug 21, 2026, 04:13 PM UTC |
| 88 | Overstock.comoverstock.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: rua.dmarc.emailanalyst.com, us.cp-dmarc.com | valid Records: 1 · all=fail | 3 Direct: 2 · total: 3 | Published Logo yes · VMC yes | Microsoft 365 0:overstock-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 89 | Five Belowfivebelow.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com, mxtoolbox.dmarc-report.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Not published | Recognized gateway 10:mxa-00231601.gslb.pphosted.com · 10:mxb-00231601.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 90 | American Eagleae.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: rua.dmarc.emailanalyst.com, emaildefense.proofpoint.com | valid Records: 1 · all=softfail | 2 Direct: 2 · total: 2 | Not published | Recognized gateway 10:mxa-0017bf01.gslb.pphosted.com · 20:mxb-0017bf01.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 91 | Grocery Outletgroceryoutlet.com | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: us.cp-dmarc.com | valid Records: 1 · all=fail | 2 Direct: 1 · total: 2 | Not published | Google Workspace 1:aspmx.l.google.com · 5:alt1.aspmx.l.google.com · 5:alt2.aspmx.l.google.com · 10:aspmx2.googlemail.com · 10:aspmx3.googlemail.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 92 | Weis Marketsweismarkets.com | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: weismarkets.com, vali.email | valid Records: 1 · all=fail | 7 Direct: 6 · total: 7 | Not published | Microsoft 365 0:weismarkets-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 93 | Urban Outfittersurbanoutfitters.com | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Not published | valid Records: 1 · all=fail | 2 Direct: 2 · total: 2 | Not published | Google Workspace 1:smtp.google.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 94 | Inglesingles-markets.com | none p=none · pct=100 Strict alignment: DKIM no · SPF no | Published To: us1.smtp.az.brand.darktrace.com | valid Records: 1 · all=softfail | 8 Direct: 5 · total: 8 | Not published | Microsoft 365 10:inglesmarkets-com01e.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 95 | Tapestrycoach.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: emaildefense.proofpoint.com, vali.email | valid Records: 1 · all=softfail | 2 Direct: 2 · total: 2 | Published Logo yes · VMC yes | Recognized gateway 10:mxa-0015f701.gslb.pphosted.com · 10:mxb-0015f701.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 96 | Murphy USAmurphyusa.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: murphyusa.com | valid Records: 1 · all=fail | 9 Direct: 8 · total: 9 | Not published | Microsoft 365 0:murphyusa-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 97 | Advance Autoadvanceautoparts.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: advance-auto.com, ag.us.dmarcian.com | valid Records: 1 · all=softfail | 1 Direct: 1 · total: 1 | Not published | Recognized gateway 10:mxa-0013d101.gslb.pphosted.com · 10:mxb-0013d101.gslb.pphosted.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 98 | Schnucksschnucks.com | quarantine p=quarantine · pct=50 Strict alignment: DKIM no · SPF no | Published To: rep.dmarcanalyzer.com, rep.usb.mimecastdmarcanalyzer.com | valid Records: 1 | 2 Direct: 1 · total: 2 | Not published | Recognized gateway 10:usb-smtp-inbound-1.mimecast.com · 10:usb-smtp-inbound-2.mimecast.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 99 | Abercrombie & Fitchabercrombie.com | reject p=reject · pct=100 Strict alignment: DKIM no · SPF no | Published To: abercrombie.com | valid Records: 1 · all=softfail | 9 Direct: 4 · total: 9 | Not published | Microsoft 365 10:abercrombie-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
| 100 | Save-A-Lotsavealot.com | quarantine p=quarantine · pct=100 Strict alignment: DKIM no · SPF no | Published To: us.cp-dmarc.com | valid Records: 1 · all=softfail | 10 Direct: 6 · total: 10 | Published Logo yes · VMC yes | Microsoft 365 5:savealot-com.mail.protection.outlook.com | Observed Aug 21, 2026, 04:13 PM UTC |
The named domain is a documented consumer storefront, not necessarily every brand, mail-sending or transactional domain used by the organization. DNS observations do not establish a delivery outcome, compromise, incident or customer experience.
Logos provided by Logo.devKEY FINDINGS
Every row is one NRF-ranked retailer and one documented customer-facing domain, measured in a single recorded scan window. Public DNS shows what a domain owner published, not whether any message reached an inbox.
ENFORCEMENT GAP
13 of 98 DMARC publishers stopped at monitoring
85 retailers enforced quarantine or rejection, 86.7% of publishers. A monitoring-only policy collects reports but asks participating receivers to do nothing with mail that fails authentication. A further 4 of 98 publishers had no aggregate-reporting address, so they receive no reports either.
SPF AND MAIL ROUTING
SPF at 96/100, MX at 95/100
96.0% published a valid SPF record and 95.0% answered with MX records. 2 of 96 SPF publishers exceeded the ten-lookup limit, which makes the record fail to evaluate, and 0 published more than one SPF record.
BRAND INDICATORS
26 of 100 published a default-selector BIMI record
That is 26.0% of the cohort, and 30.6% of the 85 retailers already enforcing. BIMI requires an enforcing DMARC policy, so the enforcing group is the only one that can publish it at all.
A monitoring-only policy is a published DNS instruction, not evidence that a retailer was spoofed, breached or that its mail is failing. The report publishes no rankings, scores or per-retailer judgements.
Why this matters
Consumer-commerce businesses send familiar order, account, loyalty, delivery and payment messages. A missing or monitoring-only DMARC policy leaves less protection at participating receivers when a forged message using the exact visible From domain fails aligned authentication.
Learn how DMARC evaluates a message →01 · DOMAIN IDENTITY
An attacker can send a message that displays the organization's exact domain in the From line. Without a valid DMARC record, participating receivers have no DMARC handling request from that domain owner when aligned SPF and DKIM fail.
02 · PRACTICAL HARM
A forged shipping update, loyalty alert, payment request or account-security email can use a familiar consumer-facing identity to make a malicious link more convincing. A public DNS observation does not establish that any such message was sent, delivered, acted on or attributable to the named business.
Three different DNS states
Risk, not incident evidence: this DNS state does not prove spoofing, fraud, compromise or weak internal controls. DMARC also does not stop lookalike domains, abuse of a compromised legitimate account or every phishing technique.
August 17, 2026
NRF Top 100 source population and official customer-facing domains frozen
August 17, 2026
Public DNS scan and named-row data package completed
August 17, 2026
Table, CSV and JSON released
The release passed the stated evidence and review gates.
Media posture
Share the methodology and complete downloadable row data with specialist editors; describe public DNS configuration without treating a company as an incident or deliverability score.
5 other groups were observed but fall below the 30-domain threshold, so their rates are not published. The largest held back had 29 domains. Every visible percentage includes its numerator and denominator.
| Group | Observed | DMARC | Enforcement | No reporting | SPF lookup failure | BIMI among enforcing |
|---|---|---|---|---|---|---|
| Recognized gateway | 52 | 100% (52/52) | 90.4% (47/52) | 0% (0/52) | 1.9% (1/52) | 23.4% (11/47) |
SVG and PNG versions are licensed CC BY 4.0.
The aggregate findings and charts are free to quote, republish and build on under CC BY 4.0. Attribute Palisade and link to this report so readers can inspect the methodology and denominators.
Palisade. “DMARC adoption in the NRF Top 100 U.S. retailers, 2026.” 2026-08-21. https://www.palisade.email/research/us-consumer-commerce-email-authentication-2026
Pinned source snapshot
2c07d8cfe731c36753828decfd6a38220c4f391fe6f69cfa16598bced01e37acOpen the exact ranked source listThe complete public 2026 ranking, compiled with Kantar and based on U.S. retail sales.
DMARC discovery, policy and aggregate-reporting semantics used by the DNS parser.
Named rows are limited to NRF-ranked organizations, one documented customer-facing domain and its observed public DNS state. The report does not assign a deliverability rate, reputation score, compromise finding, phishing incident or business-quality rating to any row.