Defaults.Exposed › Stats › Email authentication (SPF, DKIM, DMARC)

Email authentication (SPF, DKIM, DMARC)

11 statistics · figures as of September 5, 2026 · census snapshot 2026-09-05 · September 2026 edition

SPF, DKIM and DMARC across the whole census: who publishes them, who enforces them, and how many domains anyone can still forge.

Email authentication is three records that work as a set, and the census measures each one separately because that is how they fail. 47.4% of graded domains publish an SPF record. 24.8% publish a DMARC record. 50.1% have a discoverable DKIM selector. Each of those numbers sounds like partial progress. Read together they describe something less encouraging, because the protection only exists when the set is complete and enforcing.

The decisive figure is enforcement, and it is much smaller than adoption. Only 11.6% of graded domains publish an enforcing DMARC policy, which means quarantine or reject. Everything else either publishes no policy at all or publishes p=none, which tells receiving mail servers to do nothing differently. 53.3% of all published DMARC records sit at p=none. Monitoring mode is a legitimate first step and a poor permanent state: it collects reports while letting forged mail through untouched.

Put the gap in one number and it is this: 280,002,876 domains, 88.4% of everything graded, lack an enforcing DMARC policy and can therefore be impersonated in email. 149,416,895 of them publish neither SPF nor DMARC and have no email authentication at all. A further 88,739,150 publish SPF but no DMARC, which is the most common and most misleading configuration on the internet: it looks like protection, and it tells receivers nothing about what to do when a message fails.

The failure modes inside published records are worth their own attention, because they are silent. 7,408 SPF records exceed the ten-DNS-lookup limit the specification imposes, which makes them return a permanent error at many receivers and disables the record without warning anyone. 39,589 domains publish an SPF record ending in +all, which authorises the entire internet to send as that domain and is strictly worse than publishing nothing. And among DMARC records, 43,329 are malformed outright, most of them a single misspelled policy value, which receivers ignore entirely.

Reporting is the last gap and the one that keeps the others invisible. Only 39.6% of published DMARC records include a rua= address, so the majority of domains that have gone to the trouble of publishing a policy never see the aggregate reports that would tell them whether it is working or who is sending as them. A policy without reporting is a decision made once and never checked.

The reason enforcement lags publication so badly is not technical, it is fear, and the fear is rational. Moving a DMARC policy from none to quarantine tells the world's mail servers to start acting on failures, and if any legitimate sender was left out of the configuration, their mail begins disappearing. Newsletters, invoicing systems, support desks and the marketing platform nobody remembered all send as the domain. Publishing the policy is one DNS edit; knowing it is safe to publish requires having read the reports first, which is exactly what the reporting gap above tells us most domains have never done.

Every record in this section is free and takes minutes. The scan shows which of the three your domain is missing, and what to publish instead.

← All sections · how we grade · data & downloads