DMARC Census, August 2026

Key findings

• In the August 2026 scan of the Tranco top million and a US federal cohort, 128,980 domains publish p=none and name no reporting address that can receive a report. That's 27.5% of the 469,415 valid DMARC records in the scan.
• 46.9% of the 1,000,296 domains we could measure in August 2026 publish a DMARC record receivers can act on. 47.4% publish something at the _dmarc name. 52.6% publish nothing.
• 20.8% of the domains measured in August 2026, 207,651 of them, publish quarantine or reject with no pct or sp tag weakening it. 11.8% publish p=reject.
• 34,506 domains in the August 2026 scan name an outside reporting address that has never published the record authorizing them. A receiver that follows RFC 7489 sends nothing to that address.
• Of the top 1,000 domains in the August 2026 scan, 72.1% publish a valid DMARC record and 55.8% are in the enforced tier. Across ranks 100,000 to 1,000,000, those shares are 45.7% and 19.4%.
• 427 of the domains with a usable SPF record in the August 2026 scan end it with +all. That lets any host on the internet send as them.
• Of 1,321 registered US federal .gov domains, 79.2% publish p=reject in the August 2026 scan and 198 publish no DMARC record. That list is wider than the mail-sending executive-branch set that Binding Operational Directive 18-01 has held to p=reject since October 2018, so the gap isn't a count of agencies breaking the directive.

The quality tiers

Each domain lands in one tier. Two questions decide it: do receivers act on its policy, and can anyone receive the reports it asks for?

• No record 525,752 domains (52.6%) No DMARC record at the _dmarc name.
• Broken 5,129 domains (0.5%) A record exists and receivers ignore it: more than one record, a bad v= tag, or no usable p=.
• Dead reporting 128,980 domains (12.9%) p=none, and no rua destination that can receive a report.
• Monitoring 105,464 domains (10.5%) p=none, with at least one rua destination that can receive a report, or one the scan could not rule out.
• Partial enforcement 27,320 domains (2.7%) quarantine or reject, weakened by pct below 100 or a softer sp=.
• Enforced 207,651 domains (20.8%) quarantine or reject, with no pct or sp tag weakening it.

Two tags weaken a policy without changing it. pct= applies the policy to only that share of failing mail, and sp= sets a separate, often softer, policy for subdomains.

5,129 domains publish a broken record that receivers can't use, including 4,477 with more than one DMARC record. RFC 7489 tells receivers to treat that as no record at all. Broken rows aren't in the valid-record count.

Of the 469,415 valid records, 49.9% set p=none, 24.9% set p=quarantine and 25.2% set p=reject.

How much DMARC adoption there is depends on what you count. 47.4% of measured domains publish something at the _dmarc name, but that count mixes every tier, broken records included. 207,651 domains (20.8%) reach the enforced tier. 525,752 (52.6%) publish no record. Most of what's left sits at p=none: 128,980 dead and 105,464 monitoring.

Among domains at quarantine or reject, 10,318 apply the policy to only part of their failing mail with pct below 100, and 18,596 leave subdomains weaker than the organizational domain. Some do both. That's why those two figures add up to more than the 27,320-domain partial-enforcement tier.

Shares are of the 1,000,296 domains whose DMARC lookup answered. 470 domains failed to resolve after retries. They're excluded, not counted as having no record.

Run the same tier rules against your own domain.

Valid records and enforcement by rank

The top 1,000 domains publish and enforce at far higher rates than the rest of the million, so their numbers say little about it. Both series are shares of the domains in that bucket whose DMARC lookup answered.

Fewer domains publish a record the further down the list you go, and the enforced share falls faster than the valid-record share.

The buckets cover the Tranco million only. The 766 federal cohort domains outside the million count in the overall shares and sit in no bucket.

Adoption by country

Countries with a ccTLD of their own, shaded by the share of its measured domains publishing a valid DMARC record. Hover a country for its numbers.

• under 30%
• 30 to 39%
• 40 to 49%
• 50 to 59%
• 60% and up
• under 200 domains

106 countries have at least 200 measured domains under their ccTLD in this snapshot, and 89 of them are shaded on the map. Norway leads: 78.4% of measured .no domains publish a valid DMARC record, against 15.1% for .cn at the other end.

A domain counts toward a country by its TLD alone: every .de domain is Germany, wherever it is hosted or owned. Domains on gTLDs like .com carry no country signal and sit outside the map, which is what the TLD table below is for. ccTLDs registered mostly from outside their country, .io, .ai, .co, .tv and .me among them, are measured and tabled but never shaded, rather than coloring the wrong place. Countries with fewer than 200 measured domains stay uncolored. A few too small to draw at this size, Singapore and Hong Kong among them, are marked with a dot in the same colors.

Adoption by TLD

The same measurement with the country question dropped, so the generic TLDs the map cannot show are here too. Every TLD with at least 1,000 measured domains, biggest first.

.com is the largest registry in the snapshot at 428,071 measured domains, 47.6% of them publishing a valid DMARC record. 61 further TLDs clear the 1,000-domain bar and are not listed here; the full set is in the published aggregates.

A domain counts under the last label of its name, so a .co.uk domain is counted under .uk. Shares divide by measured domains, the rows whose DMARC lookup answered, which is the same denominator the rest of this report uses.

Reports that go nowhere

The rua tag on a DMARC record names the addresses receivers send aggregate reports to. A record with a rua on it looks like monitoring. Whether anything can arrive depends on a second record, and the destination has to publish that one.

128,980 domains publish a p=none DMARC record whose reporting address is missing, dead, or never authorized. That's 12.9% of measured domains and 27.5% of every valid record in the scan. We call it monitoring theater. The record passes a presence scan as adoption, and no report it asks for ever arrives.

The scan reads DNS, so it can see whether a destination can receive a report. It can't see whether anyone reads one. The monitoring tier means a report can arrive, and nothing stronger.

When a rua address sits on another organization's domain, RFC 7489 requires an authorization TXT record at <domain>._report._dmarc.<rua-host>. A receiver that finds no DMARC version tag there must not send the report, and it raises no error to the domain that named the address. 34,506 domains in this scan name at least one outside address that never authorized them. Reports to that address never arrive. Some of those domains also name an address that does work, and those reports still arrive.

29,782 domains name only destinations that are provably dead. They're the part of the unauthorized group with no working address beside the dead one. Neither group covers the whole dead tier, because a p=none record with no rua tag is dead too: it names no destination at all.

192,507 domains name at least one outside reporting address. 143 of them name at least one address the scan could not resolve to a verdict, which counts as neither authorized nor dead. A domain is counted once in each category it has an address in, so the categories overlap. At least 2,066 domains name more than one kind, which is why the counts sum past the total.

SPF

DMARC passes on SPF or DKIM alignment. An SPF record that receivers refuse to evaluate takes half the alignment surface with it.

639,844 of the 1,000,296 measured domains publish an SPF record. 36,735 of those records (5.7%) return permerror, which means receivers refuse to evaluate the record at all. 16,591 exceed the ten-lookup limit and 10,474 publish more than one record. The scan also flags an include that points at a name with no SPF record, and an include or redirect loop. It doesn't parse for other syntax errors, so the permerror count is a floor.

How the records end

Shares are of the 603,109 domains with a usable SPF record. Records that already permerror are left out, because receivers never reach their final mechanism.

US federal .gov domains

Every registered federal .gov zone, from CISA's public registry: executive, legislative and judicial. CISA's Binding Operational Directive 18-01 required executive-branch domains that send mail to reach p=reject by October 2018. This list is wider than that, and its parked and redirect names have no mail to protect, so its reject share is not a compliance rate.

The enforced count, 1,063, sits above the reject count, 1,046, because 26 quarantine domains join the tier and 9 weakened domains leave it.

The federal reject share is 79.2% (1,046 domains). Across the whole scan it's 11.8% (118,165 domains), and that figure already includes this cohort. 198 federal domains (15.0%) publish no DMARC record, and 25 publish a dead one. Some of those are parked names that send no mail. The registry doesn't say which.

1,321 domains in the cohort. 79.2% publish p=reject and 81.2% publish quarantine or reject.

Who is named to receive the reports

The rua tag is the one part of a DMARC record that names a collector, so counting those names shows which platforms are named to receive reports. A name in DNS isn't proof a report arrives, and this isn't advertised market share. The largest named collector is Cloudflare, on 27,809 domains, then Brevo at 15,817 and Valimail at 14,379.

Free collectors matter here. A working rua is exactly what moves a record from dead to monitoring, and a free one means an operator doesn't need a contract to get a first report. Cloudflare, the largest collector in the scan, includes collection with the domain. Postmark's free DMARC Digests is the sixth largest collector.

Each bar counts the domains whose rua list names a destination on that platform, once per domain. A domain naming two platforms counts for both.

140,950 matches across 27 platforms. The largest destination matching no platform in the list is axa.com, named by 3,904 domains. A destination like this is usually a company collecting reports for its own portfolio of domains rather than a vendor.

MTA-STS, TLS-RPT and BIMI

Each of these three records sits far behind DMARC.

As shares of the 1,000,296 measured domains: 1.0% MTA-STS, 1.1% TLS-RPT and 1.7% BIMI.

Methodology

Limitations

The scan reads what domains publish in DNS. Nothing here is a delivered-mail pass rate or an actual rejection.

A domain whose reporting address couldn't be resolved to a verdict counts as neither authorized nor dead. That holds the headline figures down, not up.

• This edition covers one scan window, so it reports a level and not a trend.
• DNS at a million names still fails. 470 lookups ended in error after retries and are excluded rather than scored as no DMARC. The flakiness that remains is a bound on every rate.
• rua authorization was checked at scan time only. A destination that authorized the next day, or revoked the next day, isn't in this snapshot.
• The named cohort is one list so far: 1,321 US federal domains. Other planned cohorts aren't in this edition.
• Vendor classification of rua hosts is incomplete. Unmatched destinations will move into named platforms in later revisions.

The data

• aggregates.json: every count and share on this page, as published. Dates, list ids and the scanner version are in the manifest next to it.
• Data repository: the per-snapshot files.

Using this

The aggregate data is published under CC BY 4.0. Reuse it, including commercially, with attribution. Suggested citation: