Defaults.Exposed › October 2026 Research › MAGY Readiness
The MAGY Readiness Scoreboard
October 2026 census · permanently pinned · methodology v10
MAGY is deliverability shorthand for Microsoft, Apple, Google and Yahoo, the four big consumer mailbox providers. As of October 12, 2026, 19.7% of the world’s 332,492,319 graded domains (65,360,376 domains) publish both an SPF (Sender Policy Framework) record and a DMARC (Domain-based Message Authentication, Reporting and Conformance) record, the two parts of the Google/Yahoo/Microsoft sender baseline that are visible in public DNS (Domain Name System).
Read this before quoting the number
19.7% is the SPF+DMARC portion of the baseline. It is no measure of compliance. Full compliance with the mailbox providers’ bulk-sender requirements also demands DKIM (DomainKeys Identified Mail) signing, SPF/DKIM alignment with the visible From: domain, one-click unsubscribe (RFC 8058) and a spam complaint rate below roughly 0.3%. A DNS census can observe none of these. The strictest rules apply to bulk senders (5,000+ messages/day).
A domain-by-domain DNS census can verify the DNS floor and nothing above it, so the share of domains that would fully pass the baseline is necessarily lower than 19.7%.
What the baseline requires vs what we measure
Census figures as of October 12, 2026 · denominator 332,492,319 graded domains
| Requirement | Visible to a DNS census? | Global share |
|---|---|---|
| Publish an SPF record | Yes, public DNS | 47.2% of graded domains |
| Publish a DMARC record (at least p=none) | Yes, public DNS | 25.1% |
| Both SPF and DMARC (this page’s headline) | Yes, per-domain join | 19.7% |
| Sign mail with DKIM | Partially, we can only probe common selector names | 50.5% of the 76,563,365 domains where a selector could be determined have a discoverable one, 11.6% of all 332,492,319 (not in the headline figure) |
| SPF or DKIM domain alignment with the visible From: | No, message-level, invisible to a DNS census | n/a |
| One-click unsubscribe (RFC 8058) in bulk mail | No, lives in message headers | n/a |
| Spam complaint rate below ≈0.3% | No, provider-internal telemetry | n/a |
| Valid forward + reverse DNS, TLS (Transport Layer Security) on transmission | Partially, connection-level requirements sit outside this join | n/a |
The DKIM figure counts domains where a common selector name answers over DNS; domains using custom selectors are invisible, and the census carries no per-domain SPF ∧ DMARC ∧ DKIM join. That is why DKIM is excluded from the headline figure rather than multiplied in.
How far the world is from the DNS floor
¶ 47.3% of graded domains (157,320,430) publish neither SPF nor DMARC.
¶ 27.6% (91,705,195) publish SPF but no DMARC, the most common half-finished state.
¶ Only 12.0% (39,758,587) go beyond the baseline’s p=none minimum to an enforcing DMARC policy (quarantine or reject).
SPF+DMARC coverage by TLD
TLDs (Top-Level Domains) with at least 100,000 graded domains (133 qualify). Aggregates only: no individual domain is named or graded here.
Highest coverage
| # | TLD | Domains graded | SPF + DMARC |
|---|---|---|---|
| 1 | .hr (Croatia) | 113,053 | 53.9% |
| 2 | .ke (Kenya) | 100,515 | 51.9% |
| 3 | .nl (Netherlands) | 4,055,303 | 51.0% |
| 4 | .ar (Argentina) | 483,864 | 47.4% |
| 5 | .it (Italy) | 2,703,026 | 46.0% |
| 6 | .ro (Romania) | 498,914 | 44.7% |
| 7 | .pt (Portugal) | 317,894 | 43.9% |
| 8 | .gr (Greece) | 418,892 | 43.8% |
| 9 | .pl (Poland) | 2,014,135 | 42.3% |
| 10 | .ch (Switzerland) | 1,849,400 | 41.7% |
Lowest coverage
| # | TLD | Domains graded | SPF + DMARC |
|---|---|---|---|
| 1 | .gq | 276,160 | 0.0% |
| 2 | .cf | 338,364 | 0.0% |
| 3 | .tk | 952,980 | 0.1% |
| 4 | .bond | 1,152,710 | 0.8% |
| 5 | .vip | 1,666,243 | 1.2% |
| 6 | .top | 5,530,948 | 1.2% |
| 7 | .cn (China) | 6,297,295 | 1.4% |
| 8 | .skin | 116,365 | 1.5% |
| 9 | .beer | 137,080 | 1.7% |
| 10 | .rest | 101,734 | 2.0% |
Close the gap on your own domain
The DNS floor is the fixable part, and it is free: publish SPF, publish DMARC, get DKIM signing on. Step-by-step: fix SPF · fix DMARC · fix DKIM.
Is your domain in the 88.0%?
292,733,732 domains, 88.0% of the 332,492,319 domains carrying a grade, have no enforcing DMARC policy, which means anyone can send email that appears to come from them. That is how invoice fraud and CEO-impersonation start.
Checking yours takes about a second and needs no sign-up or email. The result is private to you: we publish aggregates only, never individual domains.
Graded by the same engine behind this census: the score you get is the one in these numbers.
FAQ
What is the MAGY sender baseline?
“MAGY” is deliverability shorthand for Microsoft, Apple, Google and Yahoo, the four big consumer mailbox providers. The enforced, published requirements come from Google and Yahoo (enforcement began February 2024) and Microsoft for consumer Outlook domains (May 2025): authenticate with SPF and DKIM, publish DMARC, align the visible From: domain, support one-click unsubscribe, and keep spam complaints low. Apple publishes similar iCloud Mail guidance without a formal bulk-sender enforcement program.
Is 19.7% the share of domains that comply with the Google/Yahoo rules?
No. 19.7% is the share of the 332,492,319 graded domains that publish both an SPF record and a DMARC record, the two requirements visible in public DNS. Full compliance also requires DKIM signing, domain alignment, one-click unsubscribe and a low spam rate, none of which DNS reveals. The true full-compliance share is therefore necessarily lower than 19.7%.
Do these requirements apply to domains sending fewer than 5,000 emails a day?
Partly. The basic requirements: authenticate with SPF or DKIM, valid reverse DNS, low spam rates, apply to every sender. The full set (SPF and DKIM and DMARC, aligned From:, one-click unsubscribe) binds bulk senders: 5,000+ messages a day to Gmail or Yahoo, and 5,000+ a day to consumer Outlook addresses under Microsoft’s 2025 rules.
Why can’t a census measure DKIM, alignment or unsubscribe headers?
Because they live inside messages, not in a domain’s public DNS. A census can read SPF and DMARC records directly. DKIM keys are only discoverable when a domain uses common selector names, and alignment, List-Unsubscribe headers and spam-rate telemetry are only observable by the receiving mailbox provider.
What happens to senders that miss the baseline?
Increasingly, rejection or the spam folder. Google and Yahoo began phased enforcement in February 2024 (temporary errors, then rejection of non-compliant bulk mail). Microsoft began routing non-compliant high-volume senders to junk for consumer Outlook domains in May 2025. Publishing SPF and DMARC is the DNS-visible floor, the part this page measures.
Cite this
Figures current as of October 12, 2026. Quote the framing with the number: it is the SPF+DMARC portion of the baseline, not full compliance.
Defaults.Exposed, “MAGY Readiness Scoreboard: October 2026” (as of October 12, 2026). https://defaults.exposed/magy-readiness
Permalink: https://defaults.exposed/magy-readiness ·
Census source page: census data and downloads ·
Licence: open data
Methodology: methodology v10. The joint SPF∧DMARC counts come from a per-domain join across census checks (deduped per domain), not from multiplying marginal rates.