Defaults.Exposed › DMARC
DMARC: adoption, maturity and league tables
Data as of 2026-06-29 · Edition #1 · data as of 2026-06-29
DMARC is the DNS record that tells the world's inboxes what to do with email that pretends to come from your domain — deliver it, quarantine it, or reject it. Publish nothing (or leave it in monitor-only mode) and anyone can put your name in the "From" line of an email. This section measures how the whole internet actually uses DMARC — and gives the results plain, citable names.
Census, not sample: 261 million domains measured. 10.6% enforce DMARC; 75.1% publish no record at all.
The model: the DMARC Adoption Maturity Model (DAMM)
Adoption numbers only mean something against a map. Ours is the DMARC Adoption Maturity Model — DAMM: six stages from Unprotected to Hardened, one move per stage, and one honest wall in the middle — the step from Observing (reports flowing) to Visibility (every sender accounted for) that most domains never climb. Every table and report in this section is DAMM applied to the census.
It's time to give a DAMM.
The standing denominators
Every DMARC page on this site uses the same denominators, so no statistic here can quietly switch its base:
- 65 million domains publish a DMARC record — 24.9% of the 261 million domains evaluated.
- 27.6 million enforce (p=quarantine or p=reject) — 42.5% of records, 10.6% of all domains evaluated.
- Figures as of 2026-06-29 (edition #1); refreshed monthly with the census.
Which stage are you at? Six questions
Start at question 0, then answer in order — the first "no" is your stage. Nothing needed beyond a look at your own DNS records and mailbox — and if you can't answer one, don't guess: the free check reads your live DNS and answers questions 1, 2, 3 and 5 for you.
0. Does your domain send email at all?
No → your journey collapses to a single step: publish SPF v=spf1 -all and DMARC p=reject today. A domain that never sends has no legitimate mail to protect — nothing to observe, no wall to climb — so it goes straight to Stage 5 — Enforced in one DNS change. Yes → next question.
1. Do SPF and DKIM exist and pass for the mail you send?
No → you're likely at Stage 1 — Unprotected. Your next move: configure SPF and DKIM for your primary mail and confirm both authenticate and align — align meaning the domain SPF or DKIM validates is the same domain a person sees in the visible "From:" line, which is the match DMARC actually tests. DMARC is built on both. Yes → next question.
2. Do you publish a DMARC record?
No → you're likely at Stage 2 — Authenticated. Your next move: publish a DMARC record at p=none with a rua= reporting address — one DNS record, nothing breaks. Yes → next question.
3. Does your record request reports (rua=) that someone actually receives?
No → you're likely stuck between Stages 2 and 3 — published, but blind. Your next move: add a rua= address (one DNS edit) so aggregate reports flow — a record that isn't watching can't find the senders you'll need to align. Yes → next question.
4. Have you identified every legitimate sender of your domain's mail — and does each one align?
No → you're likely at Stage 3 — Observing, in front of the wall where most domains stall. Your next move: inventory every service that sends as your domain (the newsletter tool, the invoicing system, the CRM) and get each one aligned. This is also the stage where owners most often bring in help — an IT provider or a DMARC monitoring service can do the sender-identification work; the stages stay the same either way. Yes → next question.
5. Is your policy p=quarantine or p=reject?
No → you're likely at Stage 4 — Visibility, and you can enforce safely. Your next move: raise the policy in steps — none → quarantine → reject. Yes → you're at Stage 5 — Enforced. Your next move: the hardening layer — np= coverage, MTA-STS and TLS-RPT — plus continuous monitoring. That's Stage 6.
All five yes, hardening in place, and someone still watching the reports? That's Stage 6 — Hardened. The move there is to stay: new senders appear, providers change IPs, configurations rot. Not sure about an answer? Run the free check — it settles questions 1, 2, 3 and 5 from your live DNS in under a minute, privately.
The league tables and the monthly report
- DMARC maturity by TLD
155 domain endings ranked by Maturity Score — the leaders, the laggards, and the frozen-membership rule that keeps the ranking honest. - DMARC maturity by country
68 countries ranked via their national domain endings — who enforces, who watches, who publishes nothing. - DAMMM — the DMARC adoption report, monthly
The DMARC Adoption Maturity Matrix — Monthly: stages × population cuts, Wall Watch, Blind Watch. Edition #1 is the baseline.
Deep dives
- The 6 stages of DMARC maturity — the model itself
- Publishing Blind — most DMARC records ask for no reports
- SPF is not enough — the count of domains that rely on SPF alone
- The Fully-Protected Few — what the domains that finished do differently
Want to know where your domain stands? Run the free check → — private; we only ever show a domain's grade to its verified owner.
How we grade → · Aggregate data only; we never publish an individual domain's grade.