Defaults.Exposed › October 2026 census › v10 registry › DMARC policy
DMARC policy
Methodology v10 · canonical ID dmarc-policy · Email Security · scored
The instruction that tells mail providers to reject impersonated email, the core anti-spoofing control.
DMARC policy: definition
| Canonical ID | dmarc-policy |
|---|---|
| Category | Email Security |
| Grade impact | Scored, counts toward the grade |
| Pass | A valid DMARC (Domain-based Message Authentication, Reporting and Conformance) record at _dmarc.<domain> with an enforcing policy (p=quarantine or p=reject). Passing is not the same as full points: p=reject earns the whole weight and p=quarantine about half of it. |
| Fail | No DMARC record, an unparseable record, or a monitor-only policy (p=none) which observes but does not block. A p=none record fails the check and still earns about a quarter of its points. |
| Example (passing) | v=DMARC1; p=reject; rua=mailto:dmarc@example.com |
DMARC policy across the census
12.0% of graded domains publish an enforcing DMARC policy (p=quarantine or p=reject) (39,758,587 of 332,492,319, as of October 12, 2026).
A further share publish a monitor-only p=none record; that counts as a DMARC record but not enforcement.
Aggregates only: never an individual domain's result.
How this check is scored
DMARC policy is one of the 24 scored checks in methodology v10. It carries points toward the grade, and a pass earns them. When the result cannot be determined for a domain (a timeout, a SERVFAIL, a redacted source), the check returns N/A and drops out of that domain's scoring denominator. A result that could not be determined is never counted as a fail; a determined absence is.
In the October 2026 census, every graded domain had a determinable result for this check.
Every outcome in the census
| Outcome | Domains | Share of graded domains | In the headline figure |
|---|---|---|---|
| p=reject (full points) | 18,601,119 | 5.59% | Yes |
| p=quarantine (about half the points) | 21,157,468 | 6.36% | Yes |
| p=none, monitor only (fails, about a quarter of the points) | 43,680,223 | 13.1% | No |
| DMARC record whose policy does not parse | 27,884 | 0.01% | No |
| No DMARC record | 249,025,625 | 74.9% | No |
Source: the October 2026 census rollup, deduplicated per domain, as of October 12, 2026.
By top-level domain
This splits the share of graded domains that publish an enforcing DMARC policy (p=quarantine or p=reject) by TLD, with generic and country-code TLDs kept apart. A TLD is named below only when at least 100,000 of its domains are in this check's base.
| Kind | Combined share | Highest | Lowest |
|---|---|---|---|
| Generic TLDs (gTLDs): 353 TLDs, 234,547,634 domains | 11.1% | .email 25.4%, .studio 20.2%, .vip 18.4% | .bond 0.25%, .garden 0.45%, .cyou 0.61% |
| Country-code TLDs (ccTLDs): 167 TLDs, 97,233,639 domains | 14.0% | .ch 31.9%, .nl 31.0%, .ai 28.4% | .gq 0.02%, .cf 0.02%, .tk 0.04% |
The largest TLD in this base, .com, stands at 11.5% (17,684,647 of 153,849,480).
Kind follows the IANA (Internet Assigned Numbers Authority) delegation type: every two-letter TLD is a ccTLD. The per-TLD rollup covers 331,781,273 of the 332,492,319 domains in this base. Grade shares for every TLD are on TLDs compared: the census section.
Against the other checks
Among the 7 Email Security checks with a published figure, DMARC policy has the 6th highest pass share. Next above it is SPF (Sender Policy Framework) policy strength: 18.5% of graded domains. Next below it is DMARC reporting: 9.92% of graded domains. Across every check with a published figure it ranks 19th of 24 .
Each share is measured on the check's own base, named on its page, so the ranking compares rates across different sets of domains.
What an unparseable policy looks like
The census policy-token evidence reads the p= value of 83,466,694 published DMARC records. In 44,239 of them the value is not one of the three valid policies (none, quarantine, reject). This is a separate extract from the rollup table above, which counts 27,884 records whose policy does not parse; the two extracts classify these records differently, so the counts are not interchangeable.
27,170 of those records have no p= tag at all. The most common values written in place of a valid policy are “policy” (4,054), “quarentine” (3,840), “quarantaine” (1,461), “p” (482), “non” (443).
Fix it
Plain-English impact, cost of ignoring it, and step-by-step remediation: How to fix DMARC
DMARC setup walkthroughs for 9 providers: AWS Route 53, Cloudflare, GoDaddy, Google Workspace, Hostinger, Microsoft 365, REG.RU, Timeweb, Wix. All of them are on the DMARC setup walkthroughs by provider page.
Cite this check
Defaults.Exposed, "DMARC policy (dmarc-policy)", Grading Methodology v10 (census as of October 12, 2026). https://defaults.exposed/methodology/dmarc-policy
Permalink: https://defaults.exposed/methodology/dmarc-policy ·
All 33 checks: v10 registry ·
Machine-readable: /methodology/checks.json ·
Licence: open data