How common is DMARC? A measurement of the 10,000 most visited domains
How many of the most popular domains on the web have SPF, DMARC, MTA-STS and BIMI set up, and how strict is their DMARC? We measured it on 1 November 2026 for the 10,000 most visited domains. Here are the numbers, the method and where the measurement reaches its limits.
The results
Of the 10,000 measured domains, 7,189 (71.9%) accept email, that is, they have an MX record. All percentages below refer to these 7,189 domains.
| Feature | Share |
|---|---|
| SPF record | 92.7% |
| DMARC record | 82.4% |
DMARC with enforcement (quarantine or reject) | 60.7% |
DMARC with reject | 34.9% |
| BIMI record | 13.2% |
| TLS-RPT record | 4.5% |
| MTA-STS record | 4.0% |
Striking: SPF and DMARC are almost standard for popular domains. MTA-STS and TLS-RPT, which secure encrypted delivery, are set up by only about one in 25 domains.
DMARC in detail
Of the 7,189 domains with email, 5,926 have a DMARC record. Their policy (p=):
| Policy | Domains | Share of all domains with email |
|---|---|---|
reject | 2,509 | 34.9% |
quarantine | 1,855 | 25.8% |
none | 1,560 | 21.7% |
| no DMARC | 1,263 | 17.6% |
Of the domains with DMARC, 87.2% have entered a report address (rua=). Of the SPF records, 47.8% end in ~all, 46.4% in -all and 2.1% in ?all. A single record allows anyone to send with +all.
So more than one in five domains is at p=none, the starting value that only observes forgeries and does not reject them. Two records had an invalid policy.
By popularity
The more popular the domain, the more often DMARC is set strictly:
| Rank | Domains with email | DMARC | with enforcement | reject |
|---|---|---|---|---|
| 1 to 1,000 | 684 | 89.3% | 74.9% | 50.6% |
| 1,001 to 3,000 | 1,391 | 83.5% | 64.1% | 36.8% |
| from 3,001 | 5,114 | 81.2% | 57.9% | 32.3% |
Method
- Domain list: the first 10,000 entries of the Tranco ranking (file
top-1m.csv.zip, last modified on 31 October 2026). - Measured on: 1 November 2026, from a server in Germany.
- What was measured: public DNS records only (MX, TXT at the domain,
_dmarc,_mta-sts,_smtp._tlsanddefault._bimi). No mail server was contacted. - Email domain: a domain counts as “accepts email” if it has an MX record that does not point to a “null MX”.
- Reporting: we name no individual domains, only totals. The numbers are also available as a JSON file. No lookup failed.
Limits of the measurement
- Not representative for small domains. The list contains the most popular sites. For domains of small companies, clubs and the self-employed, DMARC is likely much rarer. We did not measure that here.
- An MX record does not mean the domain sends email. Some only accept email or do so for show.
- A record is not the same as effect. We see what is published, not whether all senders really pass or whether recipients enforce the policy.
- Subdomains and other selectors were not examined. We did not measure DKIM because the selector is not known from outside.
- The list is a ranking of popularity based on several sources and changes daily.
What this means for your domain
If most large domains already have DMARC, it is more of a duty than an option for your domain too, especially if you send a lot of email (requirements of Gmail, Yahoo and Outlook). The way is always the same: start with p=none, collect reports, then move to quarantine and later reject.
- Check your domain in the domain check or the bulk sender check.
- Create a record with the DMARC generator.
- With a free account Postwacht analyzes your DMARC reports and tells you step by step when the next step is safe (analyzing DMARC reports).
You may use the numbers with attribution (Postwacht, measurement of 1 November 2026). Please report mistakes via support.