DMARC Census
Every month we look up the DMARC and SPF records of the Tranco top million and a set of US federal domains. For each domain, we check whether receivers act on its policy and whether anyone can receive its DMARC reports. This page always links to the newest edition.
35,050
domains name an outside report address with no authorization
27.5%
of valid DMARC records have no authorized report address
47.1%
of measured domains publish a valid DMARC record
20.7%
of measured domains enforce without a weakening tag
Check your own domain
The check puts your domain in a tier with the same rules the scan uses. It reads live DNS and stores nothing.
Editions
- DMARC Census, October 2026: 1,000,766 domains scanned on 1 Oct 2026. 8,103 domains moved to a stronger policy since September 2026 and 2,129 to a weaker one. We wrote up its lead finding in DMARC report addresses without authorization.
- DMARC Census, September 2026: 1,000,767 domains scanned on 1 Sep 2026. 3,004 domains moved to a stronger policy since August 2026 and 1,059 to a weaker one.
- DMARC Census, August 2026: 1,000,766 domains scanned between 20 Aug 2026 and 21 Aug 2026. This is the first edition.
Citing and reusing the data
We publish the aggregate data under CC BY 4.0. Reuse it, including commercially, with attribution. Suggested citation:
DomainCanary. DMARC Census, 2026-10. https://domaincanary.com/research/dmarc-census. Data licensed CC BY 4.0.
Archived editions are on Zenodo at doi:10.5281/zenodo.22849900, which resolves to the newest one.