DMARC Adoption in the Top 1,000 Domains (October 2026)

On 19 October 2026 we read the DMARC, SPF and BIMI records of the first 1,000 domains on the Tranco list. Of the 688 domains that have an MX record, 346 (50.3%) publish p=reject, 508 (73.8%) are at quarantine or reject, and 79 (11.5%) publish no DMARC record at all.

The tables are free to reuse: download the aggregate CSV. We report totals only and do not name individual organisations.

How we ran the scan

• The list. Tranco list ID 467YX, first 1,000 entries, in rank order. Tranco blends several popularity rankings, so it contains websites, CDNs, ad networks and API hostnames.
• The lookups. Plain public DNS queries on 19 October 2026 (UTC): TXT at _dmarc.<domain>, TXT at the domain itself for SPF, TXT at default._bimi.<domain> for BIMI, and MX at the domain.
• The mail filter. A domain counts as a "mail domain" if the MX query returned an answer. 688 of the 1,000 did.
• Classification. The DMARC policy is the p= value. SPF is classified by the qualifier on its final all term (-all, ~all, ?all), or as redirect when the record hands off with redirect=. A domain with no v=DMARC1 TXT record at _dmarc is "none published".

We queried the exact name on the list. We did not walk up to a parent domain, and we did not send or receive any mail.

Headline numbers

One record was neither: it publishes the bare string v=DMARC1 with no p= tag and no rua=. Under RFC 7489 section 6.6.3 a receiver applies no DMARC processing to that. The newer RFC 9989 treats a record without p= as p=none.

The mail filter changes the picture a lot. Of the 278 domains with no DMARC record, 199 have no MX record either. Many of those are CDN edges, DNS infrastructure or telemetry hosts that never put their name in a From header. They still benefit from a p=reject record, because spoofers do not care whether a domain sends mail. 89 of the 312 non-mail domains already publish p=reject.

Enforcement by rank

Higher rank does not mean better DMARC. Among mail domains, the top 100 and the bottom half of the list sit within about two points of each other.

The 101 to 250 band is the strongest on both measures. The number of mail domains with no DMARC record runs 8, 11, 20 and 40 across the four bands.

SPF: how the record ends

The all qualifier tells a receiver what to do with a server the record does not list. -all is a hard fail, ~all a soft fail, ?all neutral (RFC 7208, section 4.6.2). Under DMARC the qualifier matters less than it used to, because the DMARC policy decides the outcome. It still shows intent.

Three mail domains publish two SPF records at once. RFC 7208 section 4.5 says that is a permerror, so SPF cannot pass for them at receivers that follow the RFC. All three still had both records when we checked again later the same day.

BIMI

161 of the 1,000 domains (16.1%) publish a BIMI record at default._bimi. Among mail domains it is 160 of 688 (23.3%). 117 of the 161 include an a= URL pointing to a mark certificate.

BIMI only works at enforcement. The BIMI Group implementation guide says the DMARC policy must be quarantine or reject, and that p=none or a pct below 100 is not accepted. 113 BIMI publishers are at p=reject and 45 at p=quarantine. Three are at p=none, so mailbox providers that follow the guide will not show their logo.

Patterns worth knowing

Consumer mailbox providers split their policy. Several of the largest consumer mail domains publish p=none with sp=quarantine, while the same companies' corporate domains publish p=reject. People send as a consumer address through mailing lists, forwarders and other services the provider does not control, so rejecting failures would break real mail.

Open source projects stop at p=none. Projects that run public mailing lists sit at p=none with a rua= address. Mailing lists rewrite subjects and footers, which breaks DKIM, and SPF fails once the list server resends the message.

Some records ask for nothing. A few domains publish v=DMARC1; p=none; and no other tag. That record requests no action and no reports, so it tells the owner nothing.

Partial enforcement. 10 records set pct below 100. Two use p=quarantine; pct=0, a pattern RFC 9989 appendix A.6 says some receivers treated as a signal to rewrite the From header rather than apply the policy. One publishes p=reject with pct=5.

The newer tags. Only two domains use np= (the policy for non-existent subdomains), both with np=reject. Three use psd=.

What the records ask for

Of the 722 domains with a DMARC record:

• 670 include rua= for aggregate reports. 52 do not, including 26 at p=reject.
• 396 include ruf= for failure reports, the per-message reports that can contain message content.
• 102 set adkim= and 121 set aspf=. Strict alignment (s) appears 51 times for DKIM and 44 times for SPF.
• 170 set sp=. 19 domains at p=reject relax their subdomains to sp=none.

For what each tag does and its default, see our DMARC record syntax guide.

Limitations

• Not every listed name sends mail. Tranco includes CDN, API and tracking hostnames. That is why we report mail domains separately. The MX test is a rough filter: three names counted as mail domains answered the MX query with a CNAME, not a real MX record. We left them in so the numbers match the CSV.
• One point in time. This is a single read on one day. Records change, and we will rerun the scan.
• DNS only. We read what domains publish. We did not test whether their real mail passes SPF, DKIM or alignment. A domain at p=reject can still have broken senders, and a domain at p=none may be fully aligned and waiting.
• No parent lookup. We queried _dmarc.<name> for the exact name on the list. A listed subdomain could inherit a policy from its parent in practice.
• Multi-string TXT records. DNS joins the strings of a TXT record with no space. Our scanner joined them with a space, which garbled two records, although both read correctly when the strings are joined. We count them as published.

Check your own domain

Run your domain through the DMARC checker to see your policy, then the SPF checker for the qualifier and lookup count. If you have no record yet, the record generator builds a p=none starting record with rua=, and How to implement DMARC in 5 steps covers the move to reject.

Frequently asked questions

Sources

• Tranco list 467YX (the domain list we scanned)
• RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC)
• RFC 9989: DMARC (Standards Track, May 2026, obsoletes RFC 7489)
• RFC 7208: Sender Policy Framework (SPF)
• BIMI Group: Implementation guide (DMARC enforcement requirement)