Defaults.Exposed › DMARC › DAMMM
DMARC Adoption Report — Monthly: the DMARC Adoption Maturity Matrix (DAMMM)
Edition #1 · data as of 2026-06-29
DAMMM is the recurring measurement of DMARC adoption across the entire census — 261 million domains, restated every month in the same shape so the numbers can be watched, cited and held to account. The matrix is the DMARC Adoption Maturity Model (DAMM) applied to the world.
Edition #1 (2026-06) is the baseline — the line in the sand. No trend claims this month, by design: every future edition measures movement against this one. Trends begin next month.
The Matrix
DAMM stage shares by population cut. Global covers every evaluated domain in the census; the ccTLD and gTLD cuts cover the frozen league (TLDs with at least 50,000 evaluated domains), weighted by domain count.
| DAMM stage | Global | ccTLDs (league) | gTLDs (league) |
|---|---|---|---|
| Stages 1–2 — no DMARC record | 75.1% | 67.2% | 77.9% |
| Stages 3–4 — published, not enforcing | 14.3% | 19.4% | 12.6% |
| Stage 5 — enforcing (quarantine/reject) | 10.6% | 13.4% | 9.5% |
| Stage 6 — hardened (proxy) | from edition #2 | from edition #2 | from edition #2 |
| Maturity Score (0–100) | 17.7 | 23.1 | 15.8 |
| Average DAMM stage (1–6) | 2.16 of 6 | 2.36 of 6 | 2.08 of 6 |
Within Stage 5, enforcement is a dead heat: 13.8 million domains at p=quarantine vs 13.9 million at p=reject.
Stage 6 is a proxy at census level — DMARCbis np=/tree-walk coverage plus MTA-STS and TLS-RPT presence in DNS — and its row joins the matrix from edition #2. The Observing-vs-Visibility split within stages 3–4 requires report data and cannot be derived from a census; it is marked out, not estimated. The EU-vs-rest-of-world cut joins from edition #2.
Movers
Movement needs two editions. From edition #2, this section names the league's best and worst month-on-month movers — measured against a membership frozen at baseline, so movement is real movement.
Wall Watch
14.3% of all evaluated domains — about 37.3 million — are stuck at the wall: DMARC published, nothing enforced. Measured against records rather than all domains, 57.4% of DMARC records sit at p=none. This is the number DAMM exists to move, and the one this report watches every month.
Blind Watch
64.3% of DMARC records request no aggregate reports at all — only 23.2 million of 65 million records carry a rua= address. A record without reporting can't find the senders it needs to align, so these domains have started the journey with the lights off.
Standing caveat: rua= presence is measured across all DMARC records, so its exact overlap with any single policy (such as p=none) is not derivable from the census. Where a claim touches that overlap we state bounds, never exact cross-tabs.
One chart, one story
This edition's story, in one line: for every domain enforcing DMARC, 7.1 publish no record at all. (Text-only this edition; the chart series starts alongside the trend data in edition #2 — one chart per edition, always one story.)
Methodology + changelog
League membership: TLDs with at least 50,000 evaluated domains at edition #1, frozen so month-on-month deltas are real movement. All figures are census figures — the whole measured population, not a sample — and aggregate-only.
Stage mapping, as published in the edition data:
Census-level 6-stage buckets from checks.json total dmarc states (evaluated = n - na; any = evaluated - absent; enforce = quarantine + reject): s12_no_record = 100 - any%, s34_none_only = any% - enforce%, s5_enforced = enforce%. Percentages are shares of the evaluated population (na = 0 at census level, so evaluated = checks.json graded). graded is the tlds.json grade-rollup total, carried for reference; its denominator differs slightly from checks.json.
Maturity Score, as published in the edition data:
maturityScore = ((2.5*none_only_share + 5*enforce_share) / 5) * 100, where shares are fractions of the evaluated population (none_only = (any-enforce)/evaluated, enforce = (quarantine+reject)/evaluated; domains with no record contribute 0). 0 would mean no domain publishes a record; 100 would mean every domain enforces; a published-but-unenforced record earns half-credit (2.5 of 5).
Average DAMM stage, as published in the edition data:
avgStage = 1.5*no_record_share + 3.5*none_only_share + 5*enforce_share, shares as fractions of the evaluated population; 1-6 scale using stage midpoints (no record = 1.5, published-not-enforcing = 3.5, enforcing = 5).
The full league for this edition is downloadable as a static CSV — one row per league TLD (tld, kind, country, evaluated, anyPct, enforcePct, maturityScore, avgStage): dammm-2026-06.csv.
Changelog
- 2026-06 · Edition #1 — baseline established: the Matrix (global + league ccTLD/gTLD cuts), Wall Watch, Blind Watch. League membership frozen at ≥50,000 evaluated domains. The EU-vs-RoW cut, the Stage-6 proxy row, Movers and the chart series begin with edition #2. No trend claims in this edition.
Want to know where your domain stands? Run the free check → — private; we only ever show a domain's grade to its verified owner.
DMARC hub · By TLD · By country · The 6-stage model
How we grade → · Aggregate data only; we never publish an individual domain's grade.