46% of the Web's Top Domains Don't Enforce DMARC (2026 Study)

We checked the email authentication records of the top 30,000 domains on the web. Of the 21,440 that actually accept email, 46% are not enforcing DMARC — either they publish no DMARC record at all, or they publish one set to p=none, which instructs receivers to do nothing.

This is our own measurement, run on 8 August 2026. The method is below in full, including its limitations, so you can check it or reproduce it.

The headline numbers

Of 21,440 mail-accepting domains in the top 30,000:

The finding that actually matters

Enforcement falls as you move down the rankings. SPF does not.

Full figures, including the SPF comparison:

Two things stand out.

SPF adoption is essentially flat and near-universal — between 91% and 93% across every band, barely moving over a 30,000-rank spread. DMARC enforcement falls by a third, from 73.7% to 48.3%. Everyone does the old, easy, well-documented thing. Far fewer do the newer one that requires reading reports and making a decision.

The decline is not perfectly smooth. It plateaus between ranks 5,001–10,000 and 10,001–20,000 (54.9% then 54.7%, effectively identical) before dropping again. We report that rather than smoothing it into a tidy line, because a clean gradient would be a more satisfying story than the data supports.

By rank 30,000 — still a substantial, well-known organisation — barely half enforce anything. The companies most people actually prospect sit far below that, and we have not measured there.

Why this matters if you send cold email

The domains you email mostly aren't protecting themselves. That is not your problem to fix, but it shapes the environment: a large share of the business world is spoofable, mailbox providers know it, and they compensate by being more suspicious of unauthenticated mail generally. Everyone sending legitimate cold email pays for that.

More directly: if 46% of well-known domains can't be bothered, the odds your own sending domain is misconfigured are higher than you think. The single most common cause of cold email failing is not copy — it's authentication that was never set up, or set up wrong.

Two failure modes from this data are worth calling out because they are worse than doing nothing:

• Multiple SPF records (0.8% of domains). RFC 7208 is explicit: more than one SPF record is a permanent error. Receivers do not merge them — SPF fails outright. These domains believe they have SPF and do not.
• p=none mistaken for protection. A quarter of DMARC publishers sit here. It is the correct place to start, since it collects reports without affecting delivery, but it is a monitoring mode. Left there indefinitely, it protects nothing.

You can check your own domain against all of this with our free SPF, DKIM and DMARC checker — it flags both of the above, including revoked DKIM keys that most checkers report as valid.

Method

Sample. The Tranco top 30,000, list ID ZJGPG, generated 7 August 2026 from a 30-day window across five providers (CrUX, Farsight, Majestic, Radar, Umbrella). Tranco is built for research reproducibility, which is why we used it instead of a list of our own choosing. Anyone can download the same list and repeat this.

Queries. For each domain: MX, TXT at the apex (for SPF), and TXT at _dmarc.<domain>. Resolved over DNS-over-HTTPS on 8 August 2026.

Denominator. Only domains that accept mail are counted — those with at least one MX record, excluding RFC 7505 null MX (0 .), which is an explicit declaration that a domain receives no mail. 8,560 of the 30,000 were excluded on this basis. Counting parked and infrastructure domains that never receive mail would have understated adoption and described a population nobody emails.

Sensitivity check. Tranco ranks by resolution volume, so CDN and DNS infrastructure hosts (akamaiedge.net, b-cdn.net, domaincontrol.com) rank highly and some carry MX records despite not being organisations anyone would contact. Excluding them by pattern match moves the headline by about 0.3 points (measured on the first 10,000: 40.1% to 39.8% not-enforcing, top band 73.7% to 74.9% enforcing). The effect is small and, if anything, slightly steepens the gradient. We report the unfiltered figures as the headline because the filter is a judgement call and the conclusion does not depend on it.

Limitations

We would rather state these than have them found.

• DKIM is not measured. DKIM records live at <selector>._domainkey.<domain> and selectors cannot be enumerated from DNS. Any DKIM adoption figure derived from probing common selectors would be a floor, not a measurement, so we did not publish one.
• A single point in time. These are records as they stood on 8 August 2026. We have no trend data and make no claim about direction over time.
• Publishing a record is not the same as configuring it correctly. A domain with SPF and p=reject may still have an incomplete sender list. We measured presence and policy, not correctness.
• Tranco is a popularity ranking, not a business directory. It skews toward consumer web traffic. It is a reasonable proxy for "well-known organisations" and a poor proxy for "SMBs in your target market."
• Sample size. 21,440 mail-accepting domains is large enough for the headline figures and the rank bands to be stable, and too small to say anything reliable about subgroups we did not analyse.
• We stopped at rank 30,000. The trend below that is unmeasured. Most cold outreach targets sit far deeper, and we make no claim about them beyond noting the direction of travel.

Reproducing this

Download Tranco list ZJGPG, take the top 30,000, and for each domain query MX, apex TXT and _dmarc TXT. Count only domains with a non-null MX. That is the whole method — there is nothing else in it.

If you repeat it and get materially different numbers, we would genuinely like to know: matt@toolcloud.ai.

Related

• SPF, DKIM & DMARC checker — check a single domain against the same rules
• Cold email deliverability guide — what to do once you know what's missing
• Mailbox calculator — capacity planning before you scale volume