Defaults.Exposed › Stats › Email authentication (SPF, DKIM, DMARC)
What percent of domains have an SPF record?
October 2026 census edition
As of October 12, 2026, 47.2% of the 332 million domains graded in the Defaults.Exposed census publish an SPF (Sender Policy Framework) record: 157,065,571 domains. 46.3% (153,819,856 domains) publish one that ends in an all mechanism (-all, ~all, ?all or +all); the rest of the records have no terminal all, usually a redirect= or include-only record. The remaining 52.8% publish none.
SPF adoption: how it is measured
It comes from the per-check pass, which runs every graded domain through the full check battery and records a pass, a fail or an undetermined result for each check independently. Every domain in the census is measured directly and counted once.
SPF lists which servers may send for a domain, and it is the oldest and most widely adopted of the three email authentication records. Publishing a record and publishing a valid one are counted separately: the headline share includes records the census classes as invalid, which is why the valid share in the answer, and the one on the methodology page, is slightly lower. Adoption is also the least meaningful of the three figures on its own: SPF validates the envelope sender, not the address a recipient actually sees, so publishing it without DMARC (Domain-based Message Authentication, Reporting and Conformance) leaves the visible impersonation route open.
The denominator under that share is 332 million: the population where this particular check had something to read. A domain the census could not decide on is recorded as undetermined and left out of it, never counted as a failure.
It moves when domain owners publish, correct or remove the DNS (Domain Name System) records that authenticate their mail. Every one of those records is free and takes minutes to publish, and together they decide whether someone else can send mail as the domain. The number is recomputed from the raw evidence at every edition. What it cannot tell you is where one particular domain stands: for that, see fix your email authentication.
the full grading methodology · the underlying dataset, published open with the counts behind every percentage. If a figure here disagrees with one elsewhere on the site, the dataset is canonical and we would like to know.
| Result | Domains | Share |
|---|---|---|
| SPF with -all (hard fail) | 61,408,709 | 18.5% |
| SPF with ~all (soft fail) | 87,173,390 | 26.2% |
| SPF with ?all (neutral) | 5,196,769 | 1.6% |
| SPF with +all (allows anyone) | 40,988 | 0.0% |
| SPF present, no terminal all (redirect/include-only) | 3,245,715 | 1.0% |
| No SPF record | 175,426,748 | 52.8% |
SPF adoption: how to cite it
Please cite Defaults.Exposed and link this page. The citation below carries the date.
Defaults.Exposed, "What percent of domains have an SPF record?" (as of October 12, 2026). https://defaults.exposed/stats/what-percent-of-domains-have-spf
Permalink: https://defaults.exposed/stats/what-percent-of-domains-have-spf · Machine-readable: /stats/s/spf-adoption.json · Licence: open data
Methodology: how we grade the internet · Source data: census data and downloads. Updated with each census edition.