DMARC Census, October 2026

Key findings

• 35,050 domains in the October 2026 scan name an outside reporting address, and the address's owner hadn't published an authorization record for them when we scanned. Receivers that check for that record won't send reports there. 30,229 of these domains in the October 2026 scan name only outside addresses without authorization.
• In the October 2026 scan of the Tranco top million and a US federal cohort, 129,483 domains publish p=none and name no reporting address that can receive a report. That's 27.5% of the 470,797 valid DMARC records in the scan.
• 47.1% of the 1,000,420 domains we could measure in October 2026 publish a DMARC record receivers can act on. 47.6% publish something at the _dmarc name. 52.4% publish nothing.
• 20.7% of the domains measured in October 2026, 207,185 of them, publish quarantine or reject with no pct or sp tag weakening it. 11.5% publish p=reject.
• Of the top 1,000 domains in the October 2026 scan, 73.7% publish a valid DMARC record and 57.3% are in the enforced tier. Across ranks 100,000 to 1,000,000, those shares are 45.8% and 19.2%.
• 387 of the domains with a usable SPF record in the October 2026 scan end it with +all. That lets any host on the internet send as them.
• Of 1,321 registered US federal .gov domains, 80.3% publish p=reject in the October 2026 scan and 183 publish no DMARC record. That list is wider than the mail-sending executive-branch set that Binding Operational Directive 18-01 has held to p=reject since October 2018, so the gap isn't a count of agencies breaking the directive.
• Between the September 2026 and October 2026 scans, 8,103 domains moved to a stronger policy, 3,420 of them by publishing a first p=none record, and 2,129 moved to a weaker one. 98.8% of the 853,407 domains we measured in both months kept the same policy.

What changed since September 2026

We compare the policy of every domain that was on the list in both months and whose lookup got an answer both times. From weakest to strongest, the policies are no usable record, p=none, p=quarantine and p=reject. A broken record counts as no usable record. If DNS failed in either month, we leave the domain out and don't count it as a change.

853,407 domains were on both lists and got an answer both times. 843,175 of them kept the same policy from September 2026 to October 2026. 8,103 moved to a stronger policy and 2,129 to a weaker one. The stronger count includes 3,420 domains that published their first p=none record. 4,034 reached quarantine or reject from p=none or no usable record, and 2,432 of those had been at p=none. The most common change was no usable record to p=none, on 3,420 domains.

The headline shares, month against month

The Tranco list changes from month to month. 146,921 domains in the October 2026 scan weren't on the September 2026 list, so part of every change in this table comes from that turnover. The changes below count only domains that were on both lists, so start with those.

Every policy change, largest first

146,921 domains in the October 2026 scan weren't on the September 2026 list, so there's nothing earlier to compare them with. 438 pairs were on both lists but failed to resolve in one month or the other. They're left out of every count here.

This table compares one month with the month before, so it shows one month of movement.

The quality tiers

We put each domain in one tier, based on whether receivers act on its policy and whether anyone can receive its DMARC reports.

• No record 524,568 domains (52.4%) No DMARC record at the _dmarc name.
• Broken 5,055 domains (0.5%) A record exists and receivers ignore it: more than one record, a bad v= tag, or no usable p=.
• Dead reporting 129,483 domains (12.9%) p=none, and no rua destination that can receive a report.
• Monitoring 106,661 domains (10.7%) p=none, with at least one rua destination that can receive a report, or one the scan could not rule out.
• Partial enforcement 27,468 domains (2.7%) quarantine or reject, weakened by pct below 100 or a softer sp=.
• Enforced 207,185 domains (20.7%) quarantine or reject, with no pct or sp tag weakening it.

Two tags weaken a policy without changing it. pct= applies the policy to only that share of failing mail, and sp= sets a separate, often softer, policy for subdomains.

5,055 domains publish a broken record that receivers can't use, including 4,318 with more than one DMARC record. RFC 7489 tells receivers to treat that as no record at all, so we don't count broken records as valid.

Of the 470,797 valid records, 50.2% set p=none, 25.4% set p=quarantine and 24.5% set p=reject.

47.6% of measured domains publish something at the _dmarc name, but that count mixes every tier, broken records included. 207,185 domains (20.7%) reach the enforced tier. 524,568 (52.4%) publish no record. Most of the rest publish p=none, with 129,483 in the dead tier and 106,661 in monitoring.

Among domains at quarantine or reject, 10,378 apply the policy to only part of their failing mail with pct below 100, and 18,692 leave subdomains weaker than the organizational domain. Some domains do both, so the two figures add up to more than the 27,468 domains in the partial-enforcement tier.

Percentages are out of the 1,000,420 domains whose DMARC lookup got an answer. We left out the 346 domains whose lookup failed after retries, because a failed lookup can't show whether a record exists.

Run the same tier rules against your own domain.

Valid records and enforcement by rank

The top 1,000 domains publish and enforce at far higher rates than the rest of the million, so don't quote their percentages for the whole list. Both bars are percentages of the domains in that rank range whose DMARC lookup got an answer.

Fewer domains publish a record the further down the list you go, and the enforced share falls faster than the valid-record share.

The rank ranges cover the Tranco million only. The 766 federal domains outside the million count toward the overall percentages but not toward any rank range.

Adoption by country

The map shades each country by the percentage of measured domains under its ccTLD that publish a valid DMARC record. Hover over a country to see its numbers.

• under 30%
• 30 to 39%
• 40 to 49%
• 50 to 59%
• 60% and up
• under 200 domains

106 countries have at least 200 measured domains under their ccTLD in this snapshot, and 89 of them are shaded on the map. Norway is highest, with 78.2% of measured .no domains publishing a valid DMARC record. China is lowest, at 15.0% of measured .cn domains.

A domain counts toward a country by its TLD alone. Every .de domain counts as Germany, wherever it's hosted or owned. Domains on gTLDs like .com have no country in their name, so they're left off the map. The TLD table below covers them. ccTLDs registered mostly from outside their country, .io, .ai, .co, .tv and .me among them, are measured and listed in the table but not shaded, because shading them would color the wrong country. Countries with fewer than 200 measured domains stay uncolored. A few too small to draw at this size, Singapore and Hong Kong among them, are marked with a dot in the same colors.

Adoption by TLD

The same measurement grouped by TLD, so it includes generic TLDs like .com that the map can't show. Every TLD with at least 1,000 measured domains, biggest first.

.com is the largest registry in the snapshot at 421,486 measured domains, 47.9% of them publishing a valid DMARC record. 61 further TLDs clear the 1,000-domain bar and aren't listed here. The full set is in the published aggregates.

Domains are grouped by the last label of their name, so .co.uk is grouped under .uk. All percentages are based on the domains whose DMARC lookup got an answer, which matches the rest of this report.

Reports that go nowhere

The rua tag on a DMARC record holds the addresses receivers send aggregate reports to. A record with a rua on it looks like monitoring. Whether anything can arrive depends on a second record, and the destination has to publish that one.

129,483 domains publish a p=none DMARC record whose reporting address is missing, dead, or not authorized by its owner. That's 12.9% of measured domains and 27.5% of every valid record in the scan. We call it monitoring theater. The record passes a presence scan as adoption, but receivers that follow the standard send the domain no reports.

The scan reads DNS, so it can see whether a destination can receive a report. It can't see whether anyone reads one. The monitoring tier means a report can arrive. It doesn't mean anyone reads it.

When a rua address sits on another organization's domain, RFC 7489 requires an authorization TXT record at <domain>._report._dmarc.<rua-host>. A receiver that finds no DMARC version tag there must not send the report, and it raises no error to the domain that named the address. 35,050 domains in this scan name at least one outside address whose owner hadn't authorized them when we scanned. Receivers that run this check send nothing to that address. Some of those domains also name another address, on their own domain or with authorization, and receivers can still send reports there.

30,229 domains name only outside addresses without authorization. They're the domains in the unauthorized group with no other address to fall back on. Neither group covers the whole dead tier, because a p=none record with no rua tag is dead too. It gives receivers nowhere to send a report.

190,774 domains name at least one outside reporting address. 148 of them name at least one address the scan could not resolve to a verdict, which counts as neither authorized nor dead. A domain is counted once in each category it has an address in, so the categories overlap. At least 2,108 domains name more than one kind, which is why the counts sum past the total.

SPF

DMARC passes on SPF or DKIM alignment. When receivers can't evaluate a domain's SPF record, its mail can pass DMARC only on DKIM.

635,855 of the 1,000,420 measured domains publish an SPF record. 37,033 of those records (5.8%) return permerror for at least some of the mail checked against them. 17,398 exceed the ten-lookup limit, where receivers fail any sender they need an eleventh lookup to find. 9,942 publish more than one record, which receivers refuse to evaluate at all. The scan also flags an include that points at a name with no SPF record, and an include or redirect loop. It doesn't check for other syntax errors, so the true permerror count can only be higher.

How the records end

Percentages are out of the 598,822 domains with a usable SPF record. Records that already permerror are left out, because receivers never reach their final mechanism.

US federal .gov domains

This is every registered federal .gov zone in CISA's public registry, across the executive, legislative and judicial branches. CISA's Binding Operational Directive 18-01 required executive-branch domains that send mail to reach p=reject by October 2018. This list is wider than that, and its parked and redirect names have no mail to protect, so its reject share is not a compliance rate.

The enforced count, 1,079, sits above the reject count, 1,061, because 26 quarantine domains join the tier and 8 weakened domains leave it.

The federal reject share is 80.3% (1,061 domains). Across the whole scan it's 11.5% (115,277 domains), and that figure already includes this cohort. 183 federal domains (13.9%) publish no DMARC record, and 26 publish a dead one. Some of those are parked names that send no mail. The registry doesn't say which.

1,321 domains in the cohort. 80.3% publish p=reject and 82.3% publish quarantine or reject.

Who is named to receive the reports

The rua tag lists where a domain wants its reports sent, so counting rua hosts shows which platforms domains pick to receive them. A rua entry doesn't prove a report arrives, and these counts aren't the platforms' customer numbers. The largest named collector is Cloudflare, on 28,968 domains, then Brevo at 16,363 and Valimail at 14,432.

A p=none domain moves from the dead tier to monitoring once it has a working rua address. With a free collector, an operator can get a first report without signing a contract. Cloudflare, the largest collector in the scan, includes collection with the domain. Postmark's free DMARC Digests is the fifth largest collector.

Each bar counts the domains whose rua list includes a destination on that platform, once per domain. A domain naming two platforms counts for both.

141,749 matches across 27 platforms. The largest destination matching no platform in the list is gmail.com, named by 2,450 domains.

MTA-STS, TLS-RPT and BIMI

Far fewer domains publish these three records than publish DMARC.

Out of the 1,000,420 measured domains, 1.0% publish MTA-STS, 1.2% TLS-RPT and 1.8% BIMI.

Methodology

Limitations

The scan reads what domains publish in DNS. Nothing here is a delivered-mail pass rate or an actual rejection.

A domain whose reporting address couldn't be resolved to a verdict counts as neither authorized nor dead. At p=none that puts it in monitoring, so the true dead-reporting count can only be higher.

• With 3 editions there are 2 months of change. This page compares only the latest month with the one before.
• Some DNS lookups fail even after retries. 346 ended in error and are excluded rather than scored as no DMARC. If those lookups had succeeded, any count on this page could have moved by up to that many domains.
• We checked rua authorization at scan time only. If a destination's owner added or removed an authorization after the scan, this snapshot doesn't show it.
• So far the only named cohort is the 1,321 US federal domains. Other planned cohorts aren't in this edition.
• We haven't matched every rua host to a platform yet. As we add more, some unmatched destinations will move into named platforms.

The data

• aggregates.json: every count and percentage on this page, as published. Dates, list ids and the scanner version are in the manifest next to it.
• Data repository: the per-snapshot files.
• Hugging Face dataset: the same files for every edition, with the headline counts as one CSV.
• Zenodo archive of this edition: zenodo.org/records/23540130 (doi:10.5281/zenodo.23540130).

Citing and reusing the data

We publish the aggregate data under CC BY 4.0. Reuse it, including commercially, with attribution. Suggested citation: