Defaults.Exposed › Stats › Email authentication (SPF, DKIM, DMARC)
How many domains have full email authentication?
October 2026 census edition
As of October 12, 2026, only 8,262,372 domains (2.5% of the 332 million graded in the Defaults.Exposed census) pass the census's full email-authentication cross-check: SPF (Sender Policy Framework) present, DKIM (DomainKeys Identified Mail) discoverable and an enforcing DMARC (Domain-based Message Authentication, Reporting and Conformance) policy, all on the same domain.
Full email protection means one domain passing every email-authentication check the census runs, all at the same time.
Fully protected email: how it is measured
It comes from the cross-check pass, which takes the per-domain results and counts the combinations: domains holding one control but not another, and domains holding a whole set together. Every domain in the census is measured directly and counted once.
An enforcing DMARC policy is what tells receivers to reject forged mail; SPF and DKIM are the checks it relies on.
The figure is an absolute count of domains rather than a sample scaled up. A domain the census could not decide on is left out rather than estimated.
It moves when domain owners publish, correct or remove the DNS (Domain Name System) records that authenticate their mail. Every one of those records is free and takes minutes to publish, and together they decide whether someone else can send mail as the domain. The number is recomputed from the raw evidence at every edition. What it cannot tell you is where one particular domain stands: for that, see fix your email authentication.
the full grading methodology · the underlying dataset, published open with the counts behind every percentage. If a figure here disagrees with one elsewhere on the site, the dataset is canonical and we would like to know.
Fully protected email: how to cite it
Please cite Defaults.Exposed and link this page. The citation below carries the date.
Defaults.Exposed, "How many domains have full email authentication?" (as of October 12, 2026). https://defaults.exposed/stats/how-many-domains-have-full-email-protection
Permalink: https://defaults.exposed/stats/how-many-domains-have-full-email-protection · Machine-readable: /stats/s/email-fully-protected.json · Licence: open data
Methodology: how we grade the internet · Source data: census data and downloads. Updated with each census edition.