Email Authentication Across the Top 10,000 Domains (August 2026)

Among domains that actually run email, 95.2% publish SPF and 86.4% publish DMARC. That is the result of sustained pressure from mailbox providers, capped by Gmail and Yahoo's 2024 requirement that bulk senders authenticate. At this tier, having the records is table stakes.

Counting all 10,000 domains — including the 1,529 with no MX at all, such as CDN endpoints, link shorteners and parked brand domains — the figures fall to 84.3% for SPF and 76.3% for DMARC. Those domains send no mail, but they can still be forged in the From: header, so publishing a null SPF and a p=reject DMARC record on them is a cheap win most owners skip.

A DMARC record is only as strong as its policy. p=none monitors and reports; it instructs receivers to do nothing. Only p=quarantine and p=reject actually stop a forged message. Here is how the 7,315 DMARC records split:

Nearly three in ten DMARC adopters — 2,151 domains — are still at p=none. The intended path is to start there, collect aggregate reports, confirm every legitimate stream passes with alignment, then move up. 87.9% do request reports, so the monitoring step is working. The step after it is where domains stall.

Add the 13.6% of mail domains with no DMARC record at all, and roughly four in ten domains that run email remain open to exact-domain spoofing — the technique behind most phishing and business-email-compromise attacks.

The mechanism at the end of an SPF record decides what happens to mail from an unlisted server. Only 44.7% of mail domains end theirs with -all; 45.1% use ~all, which asks receivers to accept the message anyway. In practice DMARC alignment matters more than the SPF qualifier — but a record ending in ~all with a p=none DMARC policy provides no protection at all.

Beyond SPF and DMARC, adoption collapses. Only 12.4% of mail-carrying domains sign their zone with DNSSEC, which is what stops an attacker tampering with the MX lookup itself. Just 4.3% publish an MTA-STS policy to force TLS on inbound mail. BIMI, the newest of the three and the only one with a visible payoff — a brand logo in the inbox — is at 11.2%.

Inferred from the lowest-preference MX host of each of the 8,471 mail domains:

Two providers handle more than half of these domains between them. That concentration is why a policy change at Google or Microsoft moves the whole ecosystem — and why the 2024 bulk-sender rules shifted adoption as fast as they did.