Defaults.Exposed › October 2026 census › v10 registry › DMARC reporting
DMARC reporting
Methodology v10 · canonical ID dmarc-reporting · Email Security · scored
Reports who's sending mail as you, so you spot abuse and misconfiguration.
DMARC reporting: definition
| Canonical ID | dmarc-reporting |
|---|---|
| Category | Email Security |
| Grade impact | Scored, counts toward the grade |
| Pass | The DMARC (Domain-based Message Authentication, Reporting and Conformance) record includes an aggregate-report address (rua=mailto:…) so the owner receives spoofing reports. |
| Fail | The DMARC record has no rua reporting address, or no DMARC record exists. |
| Example (passing) | v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com |
DMARC reporting across the census
9.92% of graded domains publish a DMARC record with an aggregate-reporting (rua) address (32,980,787 of 332,492,319, as of October 12, 2026).
Aggregates only: never an individual domain's result.
How this check is scored
DMARC reporting is one of the 24 scored checks in methodology v10. It carries points toward the grade, and a pass earns them. When the result cannot be determined for a domain (a timeout, a SERVFAIL, a redacted source), the check returns N/A and drops out of that domain's scoring denominator. A result that could not be determined is never counted as a fail; a determined absence is.
In the October 2026 census, every graded domain had a determinable result for this check.
Every outcome in the census
The table covers the 83,466,694 domains that publish a DMARC record. The other 249,025,625 of the 332,492,319 graded domains publish none.
| Outcome | Domains | Share of domains that publish a DMARC record | In the headline figure |
|---|---|---|---|
| Record carries a rua= reporting address | 32,980,787 | 39.5% | Yes |
| Record has no rua= address | 50,485,907 | 60.5% | No |
Source: the October 2026 census rollup, deduplicated per domain, as of October 12, 2026.
By top-level domain
This splits the share of graded domains that publish a DMARC record with an aggregate-reporting (rua) address by TLD, with generic and country-code TLDs kept apart. A TLD is named below only when at least 100,000 of its domains are in this check's base.
| Kind | Combined share | Highest | Lowest |
|---|---|---|---|
| Generic TLDs (gTLDs): 353 TLDs, 234,547,634 domains | 10.1% | .help 36.5%, .email 20.0%, .agency 19.1% | .bond 0.24%, .sbs 0.47%, .cyou 0.51% |
| Country-code TLDs (ccTLDs): 167 TLDs, 97,233,639 domains | 9.59% | .ai 29.9%, .in 22.9%, .co 21.2% | .gq 0.01%, .cf 0.02%, .tk 0.03% |
The largest TLD in this base, .com, stands at 10.9% (16,829,670 of 153,849,480).
Kind follows the IANA (Internet Assigned Numbers Authority) delegation type: every two-letter TLD is a ccTLD. The per-TLD rollup covers 331,781,273 of the 332,492,319 domains in this base. Grade shares for every TLD are on TLDs compared: the census section.
Against the other checks
Among the 7 Email Security checks with a published figure, DMARC reporting has the 7th highest pass share. Next above it is DMARC policy: 12.0% of graded domains. Across every check with a published figure it ranks 20th of 24 .
Each share is measured on the check's own base, named on its page, so the ranking compares rates across different sets of domains.
Fix it
Plain-English impact, cost of ignoring it, and step-by-step remediation: How to fix DMARC
DMARC setup walkthroughs for 9 providers: AWS Route 53, Cloudflare, GoDaddy, Google Workspace, Hostinger, Microsoft 365, REG.RU, Timeweb, Wix. All of them are on the DMARC setup walkthroughs by provider page.
Cite this check
Defaults.Exposed, "DMARC reporting (dmarc-reporting)", Grading Methodology v10 (census as of October 12, 2026). https://defaults.exposed/methodology/dmarc-reporting
Permalink: https://defaults.exposed/methodology/dmarc-reporting ·
All 33 checks: v10 registry ·
Machine-readable: /methodology/checks.json ·
Licence: open data