State of DMARC

State of DMARC, 2026-08

We scanned 1,000,766 domains in one pass and recorded two facts about each: whether it publishes a DMARC policy receivers can act on, and whether anyone can receive the reports it requests.

The population is the Tranco top 1 million domains (list id JZ8PY) plus 1,321 US federal domains, scanned on 2026-08-20 and 2026-08-21 by reading each domain's public TXT records for DMARC and SPF. 555 federal domains also rank inside the million and were scanned once, so the dataset holds 1,000,766 rows. Every share on this page has the same denominator: the 1,000,296 domains whose DMARC lookup answered, called the measured domains. The 470 lookups that failed after retries are excluded, never counted as having no record.

Jump to tiers, rank, countries, TLDs, monitoring theater, SPF, the federal cohort, vendors, methodology or the data.

Key findings

  • In the August 2026 scan of the Tranco top million and a small federal cohort, 128,980 domains, which is 27.5% of the 469,415 valid DMARC records, publish p=none and name no reporting destination that can receive anything.
  • In August 2026, 47.4% of the 1,000,296 scanned domains whose DMARC lookup answered publish a DMARC record, 46.9% publish one that receivers can act on, and 52.6% publish none.
  • 20.8% of the domains measured in August 2026, which is 207,651 domains, publish quarantine or reject with no pct or sp tag weakening it, and 11.8% publish p=reject.
  • 34,506 domains in the August 2026 scan name an external reporting address that has published no authorization record, so receivers that follow RFC 7489 send nothing there.
  • Of the top 1,000 domains in the August 2026 scan, 72.1% publish a valid DMARC record and 55.8% are in the enforced tier; across ranks 100,000 to 1,000,000 those shares fall to 45.7% and 19.4%.
  • 427 of the domains scanned in August 2026 end their SPF record with a plus-all mechanism, which authorizes every host on the internet to send as them.
  • Of 1,321 US federal domains under Binding Operational Directive 18-01, which has required p=reject since October 2018, 79.2% publish p=reject in the August 2026 scan while 198 publish no DMARC record at all.

The quality tiers

These tiers sort each domain by whether receivers act on its record and whether anyone receives the reports it requests.

Quality tiers across 1,000,296 measured domains No record 52.6%, Broken 0.5%, Dead reporting 12.9%, Monitoring 10.5%, Partial enforcement 2.7%, Enforced 20.8%. No record: 525,752 domains, 52.6% Broken: 5,129 domains, 0.5% Dead reporting: 128,980 domains, 12.9% Monitoring: 105,464 domains, 10.5% Partial enforcement: 27,320 domains, 2.7% Enforced: 207,651 domains, 20.8%
TierDomainsShare
No record 525,752 52.6%
Broken 5,129 0.5%
Dead reporting 128,980 12.9%
Monitoring 105,464 10.5%
Partial enforcement 27,320 2.7%
Enforced 207,651 20.8%
  • No record 525,752 domains (52.6%) No DMARC record at the _dmarc name.
  • Broken 5,129 domains (0.5%) A record exists and receivers ignore it: more than one record, a bad v= tag, or no usable p=.
  • Dead reporting 128,980 domains (12.9%) p=none, and no rua destination that can receive a report.
  • Monitoring 105,464 domains (10.5%) p=none, with at least one rua destination that can receive a report.
  • Partial enforcement 27,320 domains (2.7%) quarantine or reject, weakened by pct below 100 or a softer sp=.
  • Enforced 207,651 domains (20.8%) quarantine or reject, with no pct or sp tag weakening it.

Two tags weaken a policy without changing it: pct= applies the policy to only that share of failing mail, and sp= sets a separate, often softer, policy for subdomains.

5,129 domains publish a broken record that receivers cannot use, including 4,477 with more than one DMARC record, which RFC 7489 treats as invalid. Broken rows are not scored as adoption.

Headline adoption figures depend on what gets counted. 47.4% of measured domains publish something at the _dmarc name, but that count mixes every tier, broken records included. 207,651 domains (20.8%) reach the enforced tier, and 525,752 (52.6%) publish no record at all. Most of what remains sits at p=none: 128,980 dead and 105,464 monitoring.

Among domains at quarantine or reject, 10,318 apply the policy to only part of their failing mail with pct below 100, and 18,596 leave subdomains weaker than the organizational domain. Some domains do both, and the overlap is why those two figures sum to more than the 27,320-domain partial-enforcement tier.

Shares are of the 1,000,296 domains whose DMARC lookup answered. 470 domains failed to resolve after retries and are excluded rather than counted as having no record.

Run the same tier rules against your own domain.

Valid records and enforcement by rank

The top 1,000 domains publish and enforce at far higher rates than the rest of the million, so their numbers do not represent it. Both series are shares of the domains in that bucket whose DMARC lookup answered.

DMARC adoption and enforcement by Tranco rank bucket Top 1k: Valid DMARC record 72.1%, Enforced tier 55.8%. 1k to 10k: Valid DMARC record 66.0%, Enforced tier 43.8%. 10k to 100k: Valid DMARC record 57.0%, Enforced tier 31.5%. 100k to 1M: Valid DMARC record 45.7%, Enforced tier 19.4%. 0% 25% 50% 75% 100% Valid DMARC record Enforced tier Top 1k, Valid DMARC record: 72.1% 72.1% Top 1k, Enforced tier: 55.8% 55.8% Top 1k 1k to 10k, Valid DMARC record: 66.0% 66.0% 1k to 10k, Enforced tier: 43.8% 43.8% 1k to 10k 10k to 100k, Valid DMARC record: 57.0% 57.0% 10k to 100k, Enforced tier: 31.5% 31.5% 10k to 100k 100k to 1M, Valid DMARC record: 45.7% 45.7% 100k to 1M, Enforced tier: 19.4% 19.4% 100k to 1M domaincanary.com/research/state-of-dmarc
Rank bucket Measured Valid DMARC Enforced tier
Top 1k 1,000 72.1% 55.8%
1k to 10k 8,998 66.0% 43.8%
10k to 100k 89,924 57.0% 31.5%
100k to 1M 899,608 45.7% 19.4%

Fewer domains publish a record further down the list, and the enforced share falls faster than the valid-record share.

The buckets cover the Tranco million only; the 766 federal cohort domains outside the million are measured in the overall shares but sit in no bucket.

Adoption by country

Countries with a ccTLD of their own, shaded by the share of its measured domains publishing a valid DMARC record. Hover a country for its numbers.

Valid DMARC share by country-code TLD A world map shaded by valid DMARC share. 106 countries clear the 200-domain bar and 89 of them are shaded here. Norway leads at 78.4% and China trails at 15.1%. The table after the map lists every country measured. United Arab Emirates (.ae): 728 measured, 66.3% valid DMARC, 40.5% at enforcementAfghanistan: under 200 measured domainsAlbania: under 200 measured domainsArmenia (.am): 352 measured, 55.7% valid DMARC, 38.1% at enforcementAngola: under 200 measured domainsArgentina (.ar): 3,230 measured, 67.0% valid DMARC, 25.5% at enforcementAustria (.at): 2,985 measured, 62.9% valid DMARC, 31.7% at enforcementAustralia (.au): 8,418 measured, 72.4% valid DMARC, 40.8% at enforcementAzerbaijan (.az): 544 measured, 41.9% valid DMARC, 28.3% at enforcementBosnia and Herzegovina (.ba): 314 measured, 64.3% valid DMARC, 37.3% at enforcementBangladesh (.bd): 659 measured, 58.9% valid DMARC, 38.1% at enforcementBelgium (.be): 3,301 measured, 68.8% valid DMARC, 39.0% at enforcementBurkina Faso: under 200 measured domainsBulgaria (.bg): 1,191 measured, 64.7% valid DMARC, 30.9% at enforcementBurundi: under 200 measured domainsBenin: under 200 measured domainsBrunei: under 200 measured domainsBolivia (.bo): 200 measured, 70.0% valid DMARC, 51.5% at enforcementBrazil (.br): 16,992 measured, 61.7% valid DMARC, 26.9% at enforcementBahamas: under 200 measured domainsBhutan: under 200 measured domainsBotswana: under 200 measured domainsBelarus (.by): 1,279 measured, 48.3% valid DMARC, 26.3% at enforcementBelize: under 200 measured domainsCanada (.ca): 6,236 measured, 60.9% valid DMARC, 32.4% at enforcementDem. Rep. Congo: under 200 measured domainsCentral African Rep.: under 200 measured domainsCongo: under 200 measured domainsSwitzerland (.ch): 3,785 measured, 65.0% valid DMARC, 37.6% at enforcementCôte d'Ivoire: under 200 measured domainsChile (.cl): 2,588 measured, 65.1% valid DMARC, 34.1% at enforcementCameroon: under 200 measured domainsChina (.cn): 10,881 measured, 15.1% valid DMARC, 8.2% at enforcementColombia: .co is registered worldwide, so it is measured in the table but not shaded as a countryCosta Rica (.cr): 222 measured, 62.6% valid DMARC, 44.6% at enforcementCuba: under 200 measured domainsCyprus: under 200 measured domainsCzechia (.cz): 4,920 measured, 63.0% valid DMARC, 26.6% at enforcementGermany (.de): 27,159 measured, 59.7% valid DMARC, 30.6% at enforcementDjibouti: under 200 measured domainsDenmark (.dk): 2,288 measured, 74.6% valid DMARC, 52.8% at enforcementDominican Republic (.do): 275 measured, 60.0% valid DMARC, 33.1% at enforcementAlgeria (.dz): 217 measured, 66.8% valid DMARC, 46.1% at enforcementEcuador (.ec): 551 measured, 66.4% valid DMARC, 45.2% at enforcementEstonia (.ee): 732 measured, 72.4% valid DMARC, 43.9% at enforcementEgypt (.eg): 324 measured, 54.3% valid DMARC, 34.3% at enforcementW. Sahara: under 200 measured domainsEritrea: under 200 measured domainsSpain (.es): 5,409 measured, 64.7% valid DMARC, 34.5% at enforcementEthiopia: under 200 measured domainsFinland (.fi): 2,221 measured, 65.5% valid DMARC, 28.9% at enforcementFiji: under 200 measured domainsFalkland Is.: under 200 measured domainsFrance (.fr): 10,705 measured, 63.5% valid DMARC, 29.4% at enforcementGabon: under 200 measured domainsUnited Kingdom (.uk): 27,738 measured, 42.4% valid DMARC, 22.8% at enforcementGeorgia (.ge): 446 measured, 48.7% valid DMARC, 23.5% at enforcementGhana: under 200 measured domainsGreenland: under 200 measured domainsGambia: under 200 measured domainsGuinea: under 200 measured domainsEq. Guinea: under 200 measured domainsGreece (.gr): 3,518 measured, 66.5% valid DMARC, 26.3% at enforcementGuatemala (.gt): 233 measured, 62.2% valid DMARC, 39.5% at enforcementGuinea-Bissau: under 200 measured domainsGuyana: under 200 measured domainsHonduras: under 200 measured domainsCroatia (.hr): 1,098 measured, 69.9% valid DMARC, 29.1% at enforcementHaiti: under 200 measured domainsHungary (.hu): 2,976 measured, 61.1% valid DMARC, 21.8% at enforcementIndonesia (.id): 4,761 measured, 54.5% valid DMARC, 25.8% at enforcementIreland (.ie): 1,464 measured, 70.8% valid DMARC, 36.6% at enforcementIsrael (.il): 1,671 measured, 66.8% valid DMARC, 22.6% at enforcementIndia (.in): 12,070 measured, 48.6% valid DMARC, 25.2% at enforcementIraq: under 200 measured domainsIran (.ir): 3,223 measured, 37.2% valid DMARC, 20.6% at enforcementIceland (.is): 448 measured, 54.7% valid DMARC, 28.8% at enforcementItaly (.it): 10,344 measured, 63.9% valid DMARC, 23.2% at enforcementJamaica: under 200 measured domainsJordan: under 200 measured domainsJapan (.jp): 16,967 measured, 56.4% valid DMARC, 12.7% at enforcementKenya (.ke): 523 measured, 56.2% valid DMARC, 27.2% at enforcementKyrgyzstan (.kg): 262 measured, 48.1% valid DMARC, 31.7% at enforcementCambodia: under 200 measured domainsNorth Korea: under 200 measured domainsSouth Korea (.kr): 4,616 measured, 23.3% valid DMARC, 4.7% at enforcementKuwait: under 200 measured domainsKazakhstan (.kz): 1,506 measured, 37.8% valid DMARC, 21.0% at enforcementLaos (.la): 201 measured, 28.4% valid DMARC, 15.4% at enforcementLebanon: under 200 measured domainsSri Lanka (.lk): 507 measured, 44.0% valid DMARC, 18.1% at enforcementLiberia: under 200 measured domainsLesotho: under 200 measured domainsLithuania (.lt): 1,059 measured, 67.6% valid DMARC, 31.4% at enforcementLuxembourg (.lu): 261 measured, 70.5% valid DMARC, 48.7% at enforcementLatvia (.lv): 846 measured, 61.9% valid DMARC, 39.7% at enforcementLibya: under 200 measured domainsMorocco (.ma): 547 measured, 50.1% valid DMARC, 23.6% at enforcementMoldova (.md): 400 measured, 62.7% valid DMARC, 33.0% at enforcementMontenegro: .me is registered worldwide, so it is measured in the table but not shaded as a countryMadagascar: under 200 measured domainsNorth Macedonia (.mk): 283 measured, 57.2% valid DMARC, 27.6% at enforcementMali: under 200 measured domainsMyanmar: under 200 measured domainsMongolia: under 200 measured domainsMauritania: under 200 measured domainsMalawi: under 200 measured domainsMexico (.mx): 3,358 measured, 55.3% valid DMARC, 29.6% at enforcementMalaysia (.my): 1,629 measured, 57.0% valid DMARC, 36.2% at enforcementMozambique: under 200 measured domainsNamibia: under 200 measured domainsNew Caledonia: under 200 measured domainsNiger: under 200 measured domainsNigeria (.ng): 670 measured, 51.9% valid DMARC, 17.5% at enforcementNicaragua: under 200 measured domainsNetherlands (.nl): 18,896 measured, 36.6% valid DMARC, 20.0% at enforcementNorway (.no): 1,790 measured, 78.4% valid DMARC, 49.7% at enforcementNepal (.np): 260 measured, 43.8% valid DMARC, 25.8% at enforcementNew Zealand (.nz): 1,727 measured, 70.1% valid DMARC, 37.8% at enforcementOman: under 200 measured domainsPanama: under 200 measured domainsPeru (.pe): 1,201 measured, 59.0% valid DMARC, 32.7% at enforcementPapua New Guinea: under 200 measured domainsPhilippines (.ph): 1,359 measured, 51.9% valid DMARC, 27.8% at enforcementPakistan (.pk): 1,660 measured, 49.7% valid DMARC, 17.5% at enforcementPoland (.pl): 9,006 measured, 65.6% valid DMARC, 33.4% at enforcementPuerto Rico: under 200 measured domainsPalestine: under 200 measured domainsPortugal (.pt): 2,023 measured, 68.3% valid DMARC, 37.9% at enforcementParaguay (.py): 307 measured, 68.1% valid DMARC, 43.6% at enforcementQatar: under 200 measured domainsRomania (.ro): 3,984 measured, 69.6% valid DMARC, 29.6% at enforcementSerbia (.rs): 1,039 measured, 57.5% valid DMARC, 22.5% at enforcementRussia (.ru): 37,713 measured, 38.7% valid DMARC, 20.3% at enforcementRwanda: under 200 measured domainsSaudi Arabia (.sa): 554 measured, 72.9% valid DMARC, 55.6% at enforcementSolomon Is.: under 200 measured domainsSudan: under 200 measured domainsSweden (.se): 3,484 measured, 66.1% valid DMARC, 36.5% at enforcementSlovenia (.si): 763 measured, 70.5% valid DMARC, 33.7% at enforcementSlovakia (.sk): 1,820 measured, 66.6% valid DMARC, 30.1% at enforcementSierra Leone: under 200 measured domainsSenegal: under 200 measured domainsSomalia: under 200 measured domainsSuriname: under 200 measured domainsS. Sudan: under 200 measured domainsEl Salvador: under 200 measured domainsSyria: under 200 measured domainseSwatini: under 200 measured domainsChad: under 200 measured domainsFr. S. Antarctic Lands: under 200 measured domainsTogo: under 200 measured domainsThailand (.th): 981 measured, 53.3% valid DMARC, 28.1% at enforcementTajikistan: under 200 measured domainsTimor-Leste: under 200 measured domainsTurkmenistan: under 200 measured domainsTunisia (.tn): 309 measured, 38.2% valid DMARC, 17.2% at enforcementTurkey (.tr): 3,083 measured, 61.5% valid DMARC, 36.0% at enforcementTrinidad and Tobago: under 200 measured domainsTaiwan (.tw): 2,784 measured, 43.7% valid DMARC, 20.1% at enforcementTanzania (.tz): 216 measured, 69.9% valid DMARC, 42.1% at enforcementUkraine (.ua): 4,768 measured, 46.1% valid DMARC, 20.4% at enforcementUganda: under 200 measured domainsUnited States (.us): 4,114 measured, 30.7% valid DMARC, 19.7% at enforcementUruguay (.uy): 487 measured, 68.2% valid DMARC, 34.7% at enforcementUzbekistan (.uz): 646 measured, 47.5% valid DMARC, 27.6% at enforcementVenezuela (.ve): 245 measured, 61.6% valid DMARC, 42.0% at enforcementVietnam (.vn): 2,731 measured, 34.3% valid DMARC, 17.4% at enforcementVanuatu: under 200 measured domainsYemen: under 200 measured domainsSouth Africa (.za): 2,804 measured, 64.2% valid DMARC, 34.8% at enforcementZambia: under 200 measured domainsZimbabwe: under 200 measured domains Hong Kong (.hk): 883 measured, 57.9% valid DMARC, 35.3% at enforcementSingapore (.sg): 891 measured, 68.4% valid DMARC, 45.8% at enforcement domaincanary.com/research/state-of-dmarc
  • under 30%
  • 30 to 39%
  • 40 to 49%
  • 50 to 59%
  • 60% and up
  • under 200 domains
CountryccTLDMeasuredValid DMARC At enforcement
Norway .no 1,790 78.4% 49.7%
Denmark .dk 2,288 74.6% 52.8%
Saudi Arabia .sa 554 72.9% 55.6%
Anguilla .ai 3,564 72.6% 40.5%
Australia .au 8,418 72.4% 40.8%
Estonia .ee 732 72.4% 43.9%
Ireland .ie 1,464 70.8% 36.6%
Slovenia .si 763 70.5% 33.7%
Luxembourg .lu 261 70.5% 48.7%
New Zealand .nz 1,727 70.1% 37.8%
Bolivia .bo 200 70.0% 51.5%
Croatia .hr 1,098 69.9% 29.1%
Tanzania .tz 216 69.9% 42.1%
Romania .ro 3,984 69.6% 29.6%
Belgium .be 3,301 68.8% 39.0%
Singapore .sg 891 68.4% 45.8%
Portugal .pt 2,023 68.3% 37.9%
Uruguay .uy 487 68.2% 34.7%
Paraguay .py 307 68.1% 43.6%
Lithuania .lt 1,059 67.6% 31.4%
Argentina .ar 3,230 67.0% 25.5%
Israel .il 1,671 66.8% 22.6%
Algeria .dz 217 66.8% 46.1%
Slovakia .sk 1,820 66.6% 30.1%
Greece .gr 3,518 66.5% 26.3%
Ecuador .ec 551 66.4% 45.2%
United Arab Emirates .ae 728 66.3% 40.5%
Sweden .se 3,484 66.1% 36.5%
Poland .pl 9,006 65.6% 33.4%
Finland .fi 2,221 65.5% 28.9%
Chile .cl 2,588 65.1% 34.1%
Switzerland .ch 3,785 65.0% 37.6%
Bulgaria .bg 1,191 64.7% 30.9%
Spain .es 5,409 64.7% 34.5%
Bosnia and Herzegovina .ba 314 64.3% 37.3%
South Africa .za 2,804 64.2% 34.8%
Italy .it 10,344 63.9% 23.2%
France .fr 10,705 63.5% 29.4%
Czechia .cz 4,920 63.0% 26.6%
Austria .at 2,985 62.9% 31.7%
Moldova .md 400 62.7% 33.0%
Costa Rica .cr 222 62.6% 44.6%
Guatemala .gt 233 62.2% 39.5%
Latvia .lv 846 61.9% 39.7%
Brazil .br 16,992 61.7% 26.9%
Venezuela .ve 245 61.6% 42.0%
Turkey .tr 3,083 61.5% 36.0%
Hungary .hu 2,976 61.1% 21.8%
Canada .ca 6,236 60.9% 32.4%
Dominican Republic .do 275 60.0% 33.1%
Germany .de 27,159 59.7% 30.6%
Peru .pe 1,201 59.0% 32.7%
Bangladesh .bd 659 58.9% 38.1%
Hong Kong .hk 883 57.9% 35.3%
Serbia .rs 1,039 57.5% 22.5%
North Macedonia .mk 283 57.2% 27.6%
Malaysia .my 1,629 57.0% 36.2%
Japan .jp 16,967 56.4% 12.7%
Kenya .ke 523 56.2% 27.2%
Armenia .am 352 55.7% 38.1%
Mexico .mx 3,358 55.3% 29.6%
Iceland .is 448 54.7% 28.8%
Indonesia .id 4,761 54.5% 25.8%
Egypt .eg 324 54.3% 34.3%
Thailand .th 981 53.3% 28.1%
European Union .eu 5,897 53.2% 27.6%
Niue .nu 280 52.9% 25.4%
British Indian Ocean Territory .io 10,113 52.4% 30.7%
Philippines .ph 1,359 51.9% 27.8%
Micronesia .fm 335 51.9% 21.8%
Nigeria .ng 670 51.9% 17.5%
Colombia .co 7,113 51.5% 27.7%
Morocco .ma 547 50.1% 23.6%
Pakistan .pk 1,660 49.7% 17.5%
Guernsey .gg 766 48.8% 24.2%
Georgia .ge 446 48.7% 23.5%
India .in 12,070 48.6% 25.2%
Belarus .by 1,279 48.3% 26.3%
Kyrgyzstan .kg 262 48.1% 31.7%
Uzbekistan .uz 646 47.5% 27.6%
Ukraine .ua 4,768 46.1% 20.4%
Sri Lanka .lk 507 44.0% 18.1%
Nepal .np 260 43.8% 25.8%
Taiwan .tw 2,784 43.7% 20.1%
United Kingdom .uk 27,738 42.4% 22.8%
Azerbaijan .az 544 41.9% 28.3%
Saint Helena .sh 274 40.5% 25.5%
Russia .ru 37,713 38.7% 20.3%
Tunisia .tn 309 38.2% 17.2%
Kazakhstan .kz 1,506 37.8% 21.0%
Iran .ir 3,223 37.2% 20.6%
Netherlands .nl 18,896 36.6% 20.0%
Tuvalu .tv 2,715 35.8% 17.1%
Vietnam .vn 2,731 34.3% 17.4%
Isle of Man .im 266 33.8% 20.7%
Montenegro .me 2,911 33.3% 17.2%
Soviet Union .su 1,035 30.8% 15.2%
United States .us 4,114 30.7% 19.7%
Samoa .ws 374 29.4% 19.5%
Laos .la 201 28.4% 15.4%
Tonga .to 856 26.2% 12.5%
South Korea .kr 4,616 23.3% 4.7%
Sao Tome and Principe .st 251 21.5% 13.5%
Palau .pw 302 18.5% 9.6%
China .cn 10,881 15.1% 8.2%
Cocos Islands .cc 4,630 15.0% 9.0%

106 countries have at least 200 measured domains under their ccTLD in this snapshot, and 89 of them are shaded on the map. Norway leads: 78.4% of measured .no domains publish a valid DMARC record, against 15.1% for .cn at the other end.

A domain counts toward a country by its TLD alone: every .de domain is Germany, wherever it is hosted or owned. Domains on gTLDs like .com carry no country signal and sit outside the map, which is what the TLD table below is for. ccTLDs registered mostly from outside their country, .io, .ai, .co, .tv and .me among them, are measured and tabled but never shaded, rather than coloring the wrong place. Countries with fewer than 200 measured domains stay uncolored. A few too small to draw at this size, Singapore and Hong Kong among them, are marked with a dot in the same colors.

Adoption by TLD

The same measurement with the country question dropped, so the generic TLDs the map cannot show are here too. Every TLD with at least 1,000 measured domains, biggest first.

TLD Measured Valid DMARC At enforcement
.com 428,071 47.6% 23.7%
.net 48,955 35.9% 18.6%
.org 38,845 54.7% 26.7%
.ru 37,220 39.0% 20.5%
.uk 27,738 42.4% 22.8%
.de 27,159 59.7% 30.6%
.nl 18,896 36.6% 20.0%
.br 16,992 61.7% 26.9%
.jp 16,967 56.4% 12.7%
.in 12,070 48.6% 25.2%
.cn 10,881 15.1% 8.2%
.fr 10,705 63.5% 29.4%
.it 10,344 63.9% 23.2%
.io 10,113 52.4% 30.7%
.pl 9,006 65.6% 33.4%
.au 8,418 72.4% 40.8%
.co 7,113 51.5% 27.7%
.xyz 6,827 10.8% 5.1%
.ca 6,236 60.9% 32.4%
.eu 5,897 53.2% 27.6%
.info 5,419 30.8% 15.0%
.es 5,409 64.7% 34.5%
.top 5,173 5.5% 2.9%
.cz 4,920 63.0% 26.6%
.shop 4,869 38.4% 3.7%

.com is the largest registry in the snapshot at 428,071 measured domains, 47.6% of them publishing a valid DMARC record. 61 further TLDs clear the 1,000-domain bar and are not listed here; the full set is in the published aggregates.

A domain counts under the last label of its name, so a .co.uk domain is counted under .uk. Shares divide by measured domains, the rows whose DMARC lookup answered, which is the same denominator the rest of this report uses.

Monitoring theater

The rua tag on a DMARC record names the addresses where receivers send aggregate reports. A record with a rua on it looks like monitoring. Whether anything can arrive depends on a second record, published by the destination.

128,980
p=none with no reachable rua
34,506
unauthorized external rua
29,782
every rua destination dead
161,990
authorized external rua

128,980 domains publish a p=none DMARC record whose reporting address is missing, dead, or never authorized. That is 12.9% of measured domains and 27.5% of every valid record in the scan. This report calls it monitoring theater. The record passes a presence scan as adoption, and no report it requests ever arrives.

The only line the scan can draw from DNS is whether a destination can receive the report at all. Whether anyone reads what arrives is not measurable from the outside, so the monitoring tier means reports can arrive, and nothing stronger.

When a rua address sits on another organization's domain, RFC 7489 requires an authorization TXT record at <domain>._report._dmarc.<rua-host>. A receiver that finds no DMARC version tag there must not send the report, and it raises no error to the domain that named the address. 34,506 domains in this scan name at least one external address that never authorized them, so the reports they requested never arrive.

29,782 domains name only destinations that are provably dead. That subset overlaps the unauthorized-external group, and a domain can appear in both. Neither subset covers the whole dead tier, since a p=none record with no rua tag also counts as dead by naming no destination at all.

192,507 domains name at least one external reporting address. 143 of those could not be resolved to a verdict and are counted as neither authorized nor dead. The categories are per destination and are not exclusive. At least 4,132 domains name more than one kind, which is why the counts sum past the total.

SPF

DMARC passes on SPF or DKIM alignment, so an SPF record that receivers refuse to evaluate takes half the alignment surface with it.

64.0%
of measured domains publish SPF
5.7%
of published SPF records permerror

639,891 of the 1,000,296 measured domains publish an SPF record. 36,736 of those records (5.7%) return permerror, the state where receivers refuse to evaluate the record at all: 16,592 exceed the ten-lookup limit and 10,474 publish more than one record, and the two causes overlap.

Terminal qualifier

EndingDomainsShare
-all (fail) 236,588 39.2%
~all (softfail) 332,225 55.1%
?all (neutral) 15,856 2.6%
+all (pass everything) 427 0.1%
no all mechanism 18,059 3.0%

Shares are of the 603,155 domains with a usable SPF record. Records that already permerror are left out, because receivers never reach their final mechanism.

US federal civilian domains

CISA Binding Operational Directive 18-01 required these domains to reach p=reject.

TierDomainsShare
No record 198 15.0%
Broken 6 0.5%
Dead reporting 25 1.9%
Monitoring 20 1.5%
Partial enforcement 9 0.7%
Enforced 1,063 80.5%

The enforced count, 1,063, sits above the reject count, 1,046, because 26 quarantine domains join the tier and 9 weakened domains leave it.

The federal reject share, 79.2% (1,046 domains), dwarfs the general rate: across the whole scan, 118,165 domains (11.8%) publish p=reject, and that baseline already contains this cohort. The directive also has holdouts: 198 federal domains (15.0%) publish no DMARC record even though the p=reject deadline passed in October 2018, and 25 publish a dead record.

1,321 domains in the cohort. 79.2% publish p=reject and 81.2% publish quarantine or reject.

Who receives the reports

The rua tag is the one part of a DMARC record that names a collector, so counting those names measures which platforms are named to receive reports. The largest named collector is Cloudflare, on 27,809 domains, followed by Brevo at 15,817 and Valimail at 14,379.

Free collectors matter here because a working rua is exactly what moves a record from dead to monitoring, and a free one removes the contract that stands between an operator and a first report. Cloudflare, the largest collector in the scan, includes collection with the domain, and Postmark's free DMARC Digests sits in the top six.

Each bar counts the domains whose rua list names a destination belonging to that platform, once per domain. A domain naming two platforms counts for both.

Domains reporting to each DMARC platform (top 12 of 26 named) Cloudflare 27,809, Brevo 15,817, Valimail 14,379, Proofpoint 12,762, dmarcian 10,392, Postmark 10,201, Mimecast 6,717, GoDaddy 5,925, Red Sift 5,429, EasyDMARC 5,315, MxToolbox 4,882, DMARC Advisor 3,068. Cloudflare: 27,809 domains Cloudflare 27,809 Brevo: 15,817 domains Brevo 15,817 Valimail: 14,379 domains Valimail 14,379 Proofpoint: 12,762 domains Proofpoint 12,762 dmarcian: 10,392 domains dmarcian 10,392 Postmark: 10,201 domains Postmark 10,201 Mimecast: 6,717 domains Mimecast 6,717 GoDaddy: 5,925 domains GoDaddy 5,925 Red Sift: 5,429 domains Red Sift 5,429 EasyDMARC: 5,315 domains EasyDMARC 5,315 MxToolbox: 4,882 domains MxToolbox 4,882 DMARC Advisor: 3,068 domains DMARC Advisor 3,068

140,904 matches across 26 platforms. The largest destination that matches no platform in the list is axa.com, named by 3,904 domains; a destination like this is usually a company collecting reports for its own portfolio of domains rather than a vendor.

MTA-STS, TLS-RPT and BIMI

These three records tend to follow DMARC, and each one sits far behind it.

9,520
MTA-STS policy record
11,442
TLS-RPT record
17,339
BIMI record

As shares of the 1,000,296 measured domains: 1.0% MTA-STS, 1.1% TLS-RPT and 1.7% BIMI.

Methodology

Population Tranco list JZ8PY, 1,000,000 domains, plus the cohort frames below. 1,000,766 rows were scanned in total.
Frames tranco: 1,000,000 domains from https://tranco-list.eu/list/JZ8PY
cohort:us-federal-gov: 1,321 domains from research/cohorts/us-federal-gov.csv
555 cohort domains also rank in the Tranco million and were scanned once, which is why the frames sum to more than the row count.
Collection window 2026-08-20T07:24:24.037Z to 2026-08-21T08:47:10.620Z. Aggregated 2026-08-23T21:05:32.632Z.
Resolver Queries went to unbound:5353, with retries against 1.1.1.1, 8.8.8.8.
Error rate 470 DMARC lookups failed after retries, which is 0.05% of the scanned rows. Those rows are excluded from every share on this page.
Public Suffix List Whether a reporting address is external is decided by comparing organizational domains against the Public Suffix List fetched 2026-08-19T18:23:44.687Z, sha256 780c7961bd74b9ee. The list is pinned per snapshot so a re-run classifies destinations the same way.
Multiple records More than one v=DMARC1 record at _dmarc is invalid per RFC 7489. This scan scores those 4,477 domains as broken.
Vendor classification Each rua destination is classified by the host that receives the mail, so a platform reselling another platform's collection counts under the receiving host. Hosts the map does not recognize stay unmatched rather than guessed.
Absence versus failure NXDOMAIN or an empty TXT answer is absence. A timeout or SERVFAIL after retries is unknown. Failures are never counted as absence.
Independent comparison The adoption tracker at dmarcdkim.com/dmarc-adoption (retrieved August 2026), which updates daily over a different population of 1.35 million accumulated domains, reports 11.4% at full reject where this scan finds 11.8% (118,165 domains) at p=reject. This scan's count includes 1,858 rejects weakened by pct and 7,758 with a weaker sp, which the tier framework scores as partial. The two measurements agree closely on policy rates. Their adoption headlines are not directly comparable: the tracker measures its own accumulated set of domains, this scan measures a pinned Tranco snapshot, and we have not compared the two populations.
Scanner Version a551ef2-dirty.

Limitations

The scan reads what domains publish in DNS, so nothing in it reports a delivered-mail pass rate or an actual rejection.

A domain that publishes a reporting address that the scan could not resolve to a verdict is counted as neither authorized nor dead, which holds the headline figures down rather than up.

  • This edition covers one scan window, so it reports a level, not a trend.
  • DNS at a million names still fails. 470 lookups ended in error after retries and are excluded rather than scored as no DMARC. The remaining flakiness is a bound on every rate.
  • rua authorization was checked at scan time only. A destination that authorized the next day, or revoked the next day, is not in this snapshot.
  • The named cohort is one list so far: 1,321 US federal domains. Other planned cohorts are not in this edition.
  • Vendor classification of rua hosts is incomplete; unmatched destinations will move into named platforms in later revisions.

The data

Using this

The aggregate data is published under CC BY 4.0: reuse it, including commercially, with attribution. Suggested citation:

DomainCanary. State of DMARC, 2026-08. https://staging.domaincanary.com/research/state-of-dmarc. Data licensed CC BY 4.0.