Defaults.Exposed › Stats › Email authentication (SPF, DKIM, DMARC)
What percent of domains fail DMARC?
September 2026 census edition
As of September 5, 2026, 88.4% of the 317 million domains graded in the Defaults.Exposed census fail the DMARC (Domain-based Message Authentication, Reporting and Conformance) check, 280,002,877 domains with no enforcing DMARC policy. That includes 75.2% with no DMARC record at all and 13.2% stuck at p=none, which monitors but blocks nothing.
"Fail" here means the domain does not enforce DMARC (no record, an invalid record, or p=none). Enforcement (p=quarantine or p=reject) is the only setting that instructs receivers to act on spoofed mail. This count comes from the DMARC check's own results, the ones the grade is computed from. The pages that cross DMARC with other checks (the email statistics and the bulk-sender readiness page) use the per-domain join of every check, a separate pass, so their total can differ from this one by a handful of domains.
How this number is measured
It comes from the per-check pass, which runs every graded domain through the full check battery and records a pass, a fail or an undetermined result for each check independently. Every domain in the census is measured directly and counted once.
Failing the DMARC check covers both having no record at all and having one that does not enforce, because a receiver treats the two identically. Reporting them together is what makes this the check-level figure; the separate adoption and enforcement statistics show the split underneath it.
The denominator under that share is 317 million: the population where this particular check had something to read. A domain the census could not decide on is recorded as undetermined and left out of it, never counted as a failure.
It moves when domain owners publish, correct or remove the DNS (Domain Name System) records that authenticate their mail. Every one of those records is free and takes minutes to publish, and together they decide whether someone else can send mail as the domain. The number is recomputed from the raw evidence at every edition. What it cannot tell you is where one particular domain stands: for that, see fix your email authentication.
the full grading methodology · the underlying dataset, published open with the counts behind every percentage. If a figure here disagrees with one elsewhere on the site, the dataset is canonical and we would like to know.
| Result | Domains | Share |
|---|---|---|
| p=reject (enforcing) | 16,714,260 | 5.3% |
| p=quarantine (enforcing) | 19,883,765 | 6.3% |
| p=none (monitor only) | 41,818,395 | 13.2% |
| DMARC present but invalid | 28,433 | 0.0% |
| No DMARC record | 238,156,049 | 75.2% |
Cite this
Please cite Defaults.Exposed and link this page. The citation below carries the date.
Defaults.Exposed, "What percent of domains fail DMARC?" (as of September 5, 2026). https://defaults.exposed/stats/what-percent-of-domains-fail-dmarc
Permalink: https://defaults.exposed/stats/what-percent-of-domains-fail-dmarc · Machine-readable: /stats/s/dmarc-fail.json · Licence: open data
Methodology: how we grade the internet · Source data: census data and downloads. Updated with each census edition.