Defaults.Exposed › September 2026 Research › MAGY Readiness
The MAGY Readiness Scoreboard
September 2026 (v10) census · permanently pinned · methodology v10
As of September 5, 2026, 19.4% of the world’s 316,600,902 graded domains (61,364,052 domains) publish both an SPF record and a DMARC record — the two parts of the Google/Yahoo/Microsoft sender baseline that are visible in public DNS.
Read this before quoting the number
19.4% is the SPF+DMARC portion of the baseline — not a compliance rate. Full compliance with the mailbox providers’ bulk-sender requirements also demands DKIM signing, SPF/DKIM alignment with the visible From: domain, one-click unsubscribe (RFC 8058) and a spam complaint rate below roughly 0.3% — none of which a DNS census can observe. The strictest rules apply to bulk senders (5,000+ messages/day).
A domain-by-domain DNS census can verify the DNS floor and nothing above it, so the share of domains that would fully pass the baseline is necessarily lower than 19.4%.
What the baseline requires vs what we measure
Census figures as of September 5, 2026 · denominator 316,600,902 graded domains
| Requirement | Visible to a DNS census? | Global share |
|---|---|---|
| Publish an SPF record | Yes, public DNS | 47.4% of graded domains |
| Publish a DMARC record (at least p=none) | Yes, public DNS | 24.8% |
| Both SPF and DMARC (this page’s headline) | Yes, per-domain join | 19.4% |
| Sign mail with DKIM | Partially, we can only probe common selector names | 50.1% have a discoverable selector (not in the headline figure) |
| SPF or DKIM domain alignment with the visible From: | No, message-level, invisible to a DNS census | — |
| One-click unsubscribe (RFC 8058) in bulk mail | No, lives in message headers | — |
| Spam complaint rate below ≈0.3% | No, provider-internal telemetry | — |
| Valid forward + reverse DNS, TLS on transmission | Partially, connection-level requirements sit outside this join | — |
The DKIM figure counts domains where a common selector name answers over DNS; domains using custom selectors are invisible, and the census carries no per-domain SPF ∧ DMARC ∧ DKIM join — which is why DKIM is excluded from the headline figure rather than multiplied in.
How far the world is from the DNS floor
¶ 47.2% of graded domains (149,416,895) publish neither SPF nor DMARC.
¶ 28.0% (88,739,150) publish SPF but no DMARC — the most common half-finished state.
¶ Only 11.6% (36,598,026) go beyond the baseline’s p=none minimum to an enforcing DMARC policy (quarantine or reject).
SPF+DMARC coverage by TLD
TLDs with at least 100,000 graded domains (126 qualify). Aggregates only — no individual domain is named or graded here.
Highest coverage
| # | TLD | Domains graded | SPF + DMARC |
|---|---|---|---|
| 1 | .hr (Croatia) | 110,818 | 53.5% |
| 2 | .nl (Netherlands) | 3,748,769 | 51.3% |
| 3 | .ar (Argentina) | 444,118 | 46.5% |
| 4 | .it (Italy) | 2,558,090 | 46.2% |
| 5 | .pl (Poland) | 1,906,113 | 44.5% |
| 6 | .ro (Romania) | 487,810 | 44.3% |
| 7 | .pt (Portugal) | 308,532 | 43.7% |
| 8 | .gr (Greece) | 406,813 | 43.4% |
| 9 | .ch (Switzerland) | 1,683,273 | 42.4% |
| 10 | .si (Slovenia) | 132,526 | 42.3% |
Lowest coverage
| # | TLD | Domains graded | SPF + DMARC |
|---|---|---|---|
| 1 | .bond | 1,146,725 | 0.6% |
| 2 | .skin | 165,973 | 0.9% |
| 3 | .top | 5,343,770 | 1.1% |
| 4 | .vip | 1,637,496 | 1.1% |
| 5 | .cn (China) | 4,810,319 | 1.4% |
| 6 | .beer | 147,153 | 1.5% |
| 7 | .lol | 1,017,425 | 1.6% |
| 8 | .bet | 172,146 | 1.9% |
| 9 | .cc | 1,880,789 | 2.8% |
| 10 | .icu | 398,218 | 2.9% |
Close the gap on your own domain
The DNS floor is the fixable part, and it is free: publish SPF, publish DMARC, get DKIM signing on. Step-by-step: fix SPF · fix DMARC · fix DKIM.
Is your domain in the 80.6%?
280,002,876 domains — 88.4% of the internet — have no enforcing DMARC policy, which means anyone can send email that appears to come from them. Invoice fraud and CEO-impersonation start exactly there.
Checking yours takes about a second. No sign-up, no email required, and the result is private to you — we publish aggregates only, never individual domains.
Graded by the same engine behind this census — the score you get is the one in these numbers.
FAQ
What is the MAGY sender baseline?
“MAGY” is deliverability shorthand for Microsoft, Apple, Google and Yahoo, the four big consumer mailbox providers. The enforced, published requirements come from Google and Yahoo (enforcement began February 2024) and Microsoft for consumer Outlook domains (May 2025): authenticate with SPF and DKIM, publish DMARC, align the visible From: domain, support one-click unsubscribe, and keep spam complaints low. Apple publishes similar iCloud Mail guidance without a formal bulk-sender enforcement program.
Is 19.4% the share of domains that comply with the Google/Yahoo rules?
No. 19.4% is the share of the 316,600,902 graded domains that publish both an SPF record and a DMARC record, the two requirements visible in public DNS. Full compliance also requires DKIM signing, domain alignment, one-click unsubscribe and a low spam rate, none of which DNS reveals. The true full-compliance share is therefore necessarily lower than 19.4%.
Do these requirements apply to domains sending fewer than 5,000 emails a day?
Partly. The basic requirements: authenticate with SPF or DKIM, valid reverse DNS, low spam rates, apply to every sender. The full set (SPF and DKIM and DMARC, aligned From:, one-click unsubscribe) binds bulk senders: 5,000+ messages a day to Gmail or Yahoo, and 5,000+ a day to consumer Outlook addresses under Microsoft’s 2025 rules.
Why can’t a census measure DKIM, alignment or unsubscribe headers?
Because they live inside messages, not in a domain’s public DNS. A census can read SPF and DMARC records directly. DKIM keys are only discoverable when a domain uses common selector names, and alignment, List-Unsubscribe headers and spam-rate telemetry are only observable by the receiving mailbox provider.
What happens to senders that miss the baseline?
Increasingly, rejection or the spam folder. Google and Yahoo began phased enforcement in February 2024 (temporary errors, then rejection of non-compliant bulk mail). Microsoft began routing non-compliant high-volume senders to junk for consumer Outlook domains in May 2025. Publishing SPF and DMARC is the DNS-visible floor, the part this page measures.
Cite this
Figures current as of September 5, 2026. Quote the framing with the number: it is the SPF+DMARC portion of the baseline, not full compliance.
Defaults.Exposed, “MAGY Readiness Scoreboard: September 2026 (v10)” (as of September 5, 2026). https://defaults.exposed/v10/magy-readiness
Permalink: https://defaults.exposed/v10/magy-readiness ·
Census source page: /v10/data ·
Licence: open data
Methodology: methodology v10. The joint SPF∧DMARC counts come from a per-domain join across census checks (deduped per domain), not from multiplying marginal rates.