Defaults.Exposed › Stats › Email authentication (SPF, DKIM, DMARC)

Email authentication (SPF, DKIM, DMARC)

11 statistics · figures as of November 2, 2026 · census snapshot 2026-11-02 · November 2026 edition

SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail) and DMARC (Domain-based Message Authentication, Reporting and Conformance) across the whole census: who publishes them, who enforces them, and how many domains anyone can still forge.

Email authentication is three records that work as a set, and the census measures each one separately because that is how they fail. 47.4% of graded domains publish an SPF record. 25.5% publish a DMARC record. 11.7% have a discoverable DKIM selector, which is 51.0% of the 77 million domains where a selector could be determined. Each of those numbers sounds like partial progress. Read together they describe something less encouraging, because the protection only exists when the set is complete and enforcing.

The decisive figure is enforcement, and it is much smaller than adoption. Only 12.2% of graded domains publish an enforcing DMARC policy, which means quarantine or reject. Everything else either publishes no policy at all or publishes p=none, which tells receiving mail servers to do nothing differently. 52.0% of all published DMARC records sit at p=none. Monitoring mode is a reasonable first step. A domain that stays at p=none keeps letting forged mail through.

293,973,030 domains, 87.8% of everything graded, lack an enforcing DMARC policy and can therefore be impersonated in email. 157,125,096 of them publish neither SPF nor DMARC and have no email authentication at all. A further 92,430,398 publish SPF but no DMARC, which is the most common and most misleading configuration on the internet: it looks like protection, and it tells receivers nothing about what to do when a message fails.

Published records can also fail, and nothing warns the owner when they do. 8,084 SPF records exceed the ten-DNS-lookup limit the specification imposes, which makes them return a permanent error at many receivers and disables the record without warning anyone. 42,873 domains publish an SPF record ending in +all, which authorises the entire internet to send as that domain and is strictly worse than publishing nothing. And among DMARC records, 43,252 are malformed outright, most of them a single misspelled policy value, which receivers ignore entirely.

Reporting is the last gap. Only 40.1% of published DMARC records include a rua= address, so the majority of domains that have gone to the trouble of publishing a policy never see the aggregate reports that would tell them whether it is working or who is sending as them.

Enforcement lags publication so badly because of fear, and the fear is rational; the technical step is small. Moving a DMARC policy from none to quarantine tells the world's mail servers to start acting on failures, and if any legitimate sender was left out of the configuration, their mail begins disappearing. Newsletters, invoicing systems, support desks and the marketing platform nobody remembered all send as the domain. Publishing the policy is one DNS (Domain Name System) edit; knowing it is safe to publish requires having read the reports first, which is exactly what the reporting gap above tells us most domains have never done.

Every record in this section is free and takes minutes. The scan shows which of the three your domain is missing, and what to publish instead.

← All sections · how we grade · data & downloads