DMARC Census, September 2026

Key findings

• In the September 2026 scan of the Tranco top million and a US federal cohort, 131,008 domains publish p=none and name no reporting address that can receive a report. That's 27.7% of the 472,655 valid DMARC records in the scan.
• 47.2% of the 1,000,424 domains we could measure in September 2026 publish a DMARC record receivers can act on. 47.8% publish something at the _dmarc name. 52.2% publish nothing.
• 20.8% of the domains measured in September 2026, 208,354 of them, publish quarantine or reject with no pct or sp tag weakening it. 11.8% publish p=reject.
• 34,749 domains in the September 2026 scan name an outside reporting address that has never published the record authorizing them. A receiver that follows RFC 7489 sends nothing to that address.
• Of the top 1,000 domains in the September 2026 scan, 72.3% publish a valid DMARC record and 56.1% are in the enforced tier. Across ranks 100,000 to 1,000,000, those shares are 46.0% and 19.4%.
• 402 of the domains with a usable SPF record in the September 2026 scan end it with +all. That lets any host on the internet send as them.
• Of 1,321 registered US federal .gov domains, 81.0% publish p=reject in the September 2026 scan and 174 publish no DMARC record. That list is wider than the mail-sending executive-branch set that Binding Operational Directive 18-01 has held to p=reject since October 2018, so the gap isn't a count of agencies breaking the directive.
• Between the August 2026 and September 2026 scans, 3,004 domains moved to a stronger policy, 1,302 of them by publishing a first p=none record, and 1,059 moved to a weaker one. 99.6% of the 926,567 domains measured both months didn't move.

What changed since August 2026

We compare every domain that was on the list both months, and answered both times, policy against policy on a four-step ladder: no usable record, p=none, p=quarantine, p=reject. A broken record counts as no usable record. If DNS failed on either side, the pair is dropped rather than counted as a change.

926,567 domains were on both lists and answered both times. 922,504 of them didn't move between August 2026 and September 2026. 3,004 moved up the ladder and 1,059 moved down it. Moving up includes publishing a first p=none record, and 1,302 domains did exactly that. 1,435 reached quarantine or reject from p=none or no usable record. 831 of those had been sitting at p=none. The single most common move was no usable record to p=none, on 1,302 domains.

The headline shares, month against month

Each month's share is over that month's own population, and 73,642 of this month's rows weren't on last month's list. So some of every change here is the list changing, not domains changing. The moves below only count domains present both months. Trust those first.

Every policy move, largest first

73,642 domains in the September 2026 scan weren't on the August 2026 list, so there's nothing earlier to compare them with. 558 pairs were on both lists but failed to resolve in one month or the other. They're left out of every count here.

One month of movement is one data point. We'll draw trend lines once three editions exist, and not before.

The quality tiers

Each domain lands in one tier. Two questions decide it: do receivers act on its policy, and can anyone receive the reports it asks for?

• No record 522,642 domains (52.2%) No DMARC record at the _dmarc name.
• Broken 5,127 domains (0.5%) A record exists and receivers ignore it: more than one record, a bad v= tag, or no usable p=.
• Dead reporting 131,008 domains (13.1%) p=none, and no rua destination that can receive a report.
• Monitoring 106,056 domains (10.6%) p=none, with at least one rua destination that can receive a report, or one the scan could not rule out.
• Partial enforcement 27,237 domains (2.7%) quarantine or reject, weakened by pct below 100 or a softer sp=.
• Enforced 208,354 domains (20.8%) quarantine or reject, with no pct or sp tag weakening it.

Two tags weaken a policy without changing it. pct= applies the policy to only that share of failing mail, and sp= sets a separate, often softer, policy for subdomains.

5,127 domains publish a broken record that receivers can't use, including 4,478 with more than one DMARC record. RFC 7489 tells receivers to treat that as no record at all. Broken rows aren't in the valid-record count.

Of the 472,655 valid records, 50.2% set p=none, 24.8% set p=quarantine and 25.1% set p=reject.

How much DMARC adoption there is depends on what you count. 47.8% of measured domains publish something at the _dmarc name, but that count mixes every tier, broken records included. 208,354 domains (20.8%) reach the enforced tier. 522,642 (52.2%) publish no record. Most of what's left sits at p=none: 131,008 dead and 106,056 monitoring.

Among domains at quarantine or reject, 10,279 apply the policy to only part of their failing mail with pct below 100, and 18,546 leave subdomains weaker than the organizational domain. Some do both. That's why those two figures add up to more than the 27,237-domain partial-enforcement tier.

Shares are of the 1,000,424 domains whose DMARC lookup answered. 343 domains failed to resolve after retries. They're excluded, not counted as having no record.

Run the same tier rules against your own domain.

Valid records and enforcement by rank

The top 1,000 domains publish and enforce at far higher rates than the rest of the million, so their numbers say little about it. Both series are shares of the domains in that bucket whose DMARC lookup answered.

Fewer domains publish a record the further down the list you go, and the enforced share falls faster than the valid-record share.

The buckets cover the Tranco million only. The 767 federal cohort domains outside the million count in the overall shares and sit in no bucket.

Adoption by country

Countries with a ccTLD of their own, shaded by the share of its measured domains publishing a valid DMARC record. Hover a country for its numbers.

• under 30%
• 30 to 39%
• 40 to 49%
• 50 to 59%
• 60% and up
• under 200 domains

106 countries have at least 200 measured domains under their ccTLD in this snapshot, and 89 of them are shaded on the map. Norway leads: 78.2% of measured .no domains publish a valid DMARC record, against 15.9% for .cn at the other end.

A domain counts toward a country by its TLD alone: every .de domain is Germany, wherever it is hosted or owned. Domains on gTLDs like .com carry no country signal and sit outside the map, which is what the TLD table below is for. ccTLDs registered mostly from outside their country, .io, .ai, .co, .tv and .me among them, are measured and tabled but never shaded, rather than coloring the wrong place. Countries with fewer than 200 measured domains stay uncolored. A few too small to draw at this size, Singapore and Hong Kong among them, are marked with a dot in the same colors.

Adoption by TLD

The same measurement with the country question dropped, so the generic TLDs the map cannot show are here too. Every TLD with at least 1,000 measured domains, biggest first.

.com is the largest registry in the snapshot at 426,315 measured domains, 48.2% of them publishing a valid DMARC record. 61 further TLDs clear the 1,000-domain bar and are not listed here; the full set is in the published aggregates.

A domain counts under the last label of its name, so a .co.uk domain is counted under .uk. Shares divide by measured domains, the rows whose DMARC lookup answered, which is the same denominator the rest of this report uses.

Reports that go nowhere

The rua tag on a DMARC record names the addresses receivers send aggregate reports to. A record with a rua on it looks like monitoring. Whether anything can arrive depends on a second record, and the destination has to publish that one.

131,008 domains publish a p=none DMARC record whose reporting address is missing, dead, or never authorized. That's 13.1% of measured domains and 27.7% of every valid record in the scan. We call it monitoring theater. The record passes a presence scan as adoption, and no report it asks for ever arrives.

The scan reads DNS, so it can see whether a destination can receive a report. It can't see whether anyone reads one. The monitoring tier means a report can arrive, and nothing stronger.

When a rua address sits on another organization's domain, RFC 7489 requires an authorization TXT record at <domain>._report._dmarc.<rua-host>. A receiver that finds no DMARC version tag there must not send the report, and it raises no error to the domain that named the address. 34,749 domains in this scan name at least one outside address that never authorized them. Reports to that address never arrive. Some of those domains also name an address that does work, and those reports still arrive.

30,036 domains name only destinations that are provably dead. They're the part of the unauthorized group with no working address beside the dead one. Neither group covers the whole dead tier, because a p=none record with no rua tag is dead too: it names no destination at all.

193,499 domains name at least one outside reporting address. 141 of them name at least one address the scan could not resolve to a verdict, which counts as neither authorized nor dead. A domain is counted once in each category it has an address in, so the categories overlap. At least 2,053 domains name more than one kind, which is why the counts sum past the total.

SPF

DMARC passes on SPF or DKIM alignment. An SPF record that receivers refuse to evaluate takes half the alignment surface with it.

641,215 of the 1,000,424 measured domains publish an SPF record. 36,598 of those records (5.7%) return permerror, which means receivers refuse to evaluate the record at all. 16,482 exceed the ten-lookup limit and 10,448 publish more than one record. The scan also flags an include that points at a name with no SPF record, and an include or redirect loop. It doesn't parse for other syntax errors, so the permerror count is a floor.

How the records end

Shares are of the 604,617 domains with a usable SPF record. Records that already permerror are left out, because receivers never reach their final mechanism.

US federal .gov domains

Every registered federal .gov zone, from CISA's public registry: executive, legislative and judicial. CISA's Binding Operational Directive 18-01 required executive-branch domains that send mail to reach p=reject by October 2018. This list is wider than that, and its parked and redirect names have no mail to protect, so its reject share is not a compliance rate.

The enforced count, 1,087, sits above the reject count, 1,070, because 26 quarantine domains join the tier and 9 weakened domains leave it.

The federal reject share is 81.0% (1,070 domains). Across the whole scan it's 11.8% (118,536 domains), and that figure already includes this cohort. 174 federal domains (13.2%) publish no DMARC record, and 25 publish a dead one. Some of those are parked names that send no mail. The registry doesn't say which.

1,321 domains in the cohort. 81.0% publish p=reject and 83.0% publish quarantine or reject.

Who is named to receive the reports

The rua tag is the one part of a DMARC record that names a collector, so counting those names shows which platforms are named to receive reports. A name in DNS isn't proof a report arrives, and this isn't advertised market share. The largest named collector is Cloudflare, on 28,095 domains, then Brevo at 16,177 and Valimail at 14,333.

Free collectors matter here. A working rua is exactly what moves a record from dead to monitoring, and a free one means an operator doesn't need a contract to get a first report. Cloudflare, the largest collector in the scan, includes collection with the domain. Postmark's free DMARC Digests is the sixth largest collector.

Each bar counts the domains whose rua list names a destination on that platform, once per domain. A domain naming two platforms counts for both.

141,242 matches across 27 platforms. The largest destination matching no platform in the list is axa.com, named by 4,114 domains. A destination like this is usually a company collecting reports for its own portfolio of domains rather than a vendor.

MTA-STS, TLS-RPT and BIMI

Each of these three records sits far behind DMARC.

As shares of the 1,000,424 measured domains: 1.0% MTA-STS, 1.2% TLS-RPT and 1.7% BIMI.

Methodology

Limitations

The scan reads what domains publish in DNS. Nothing here is a delivered-mail pass rate or an actual rejection.

A domain whose reporting address couldn't be resolved to a verdict counts as neither authorized nor dead. That holds the headline figures down, not up.

• Two editions give one month of change. That's a data point. We'll draw trend lines once there are three.
• DNS at a million names still fails. 343 lookups ended in error after retries and are excluded rather than scored as no DMARC. The flakiness that remains is a bound on every rate.
• rua authorization was checked at scan time only. A destination that authorized the next day, or revoked the next day, isn't in this snapshot.
• The named cohort is one list so far: 1,321 US federal domains. Other planned cohorts aren't in this edition.
• Vendor classification of rua hosts is incomplete. Unmatched destinations will move into named platforms in later revisions.

The data

• aggregates.json: every count and share on this page, as published. Dates, list ids and the scanner version are in the manifest next to it.
• Data repository: the per-snapshot files.

Using this

The aggregate data is published under CC BY 4.0. Reuse it, including commercially, with attribution. Suggested citation: