DMARC Census, August 2026

Key findings

• In the August 2026 scan of the Tranco top million and a US federal cohort, 128,980 domains publish p=none and name no reporting address that can receive a report. That's 27.5% of the 469,415 valid DMARC records in the scan.
• 46.9% of the 1,000,296 domains we could measure in August 2026 publish a DMARC record receivers can act on. 47.4% publish something at the _dmarc name. 52.6% publish nothing.
• 20.8% of the domains measured in August 2026, 207,651 of them, publish quarantine or reject with no pct or sp tag weakening it. 11.8% publish p=reject.
• 34,506 domains in the August 2026 scan name an outside reporting address, and the address's owner hadn't published an authorization record for them when we scanned. Receivers that check for that record won't send reports there. 29,782 of these domains in the August 2026 scan name only outside addresses without authorization.
• Of the top 1,000 domains in the August 2026 scan, 72.1% publish a valid DMARC record and 55.8% are in the enforced tier. Across ranks 100,000 to 1,000,000, those shares are 45.7% and 19.4%.
• 427 of the domains with a usable SPF record in the August 2026 scan end it with +all. That lets any host on the internet send as them.
• Of 1,321 registered US federal .gov domains, 79.2% publish p=reject in the August 2026 scan and 198 publish no DMARC record. That list is wider than the mail-sending executive-branch set that Binding Operational Directive 18-01 has held to p=reject since October 2018, so the gap isn't a count of agencies breaking the directive.

The quality tiers

We put each domain in one tier, based on whether receivers act on its policy and whether anyone can receive its DMARC reports.

• No record 525,752 domains (52.6%) No DMARC record at the _dmarc name.
• Broken 5,129 domains (0.5%) A record exists and receivers ignore it: more than one record, a bad v= tag, or no usable p=.
• Dead reporting 128,980 domains (12.9%) p=none, and no rua destination that can receive a report.
• Monitoring 105,464 domains (10.5%) p=none, with at least one rua destination that can receive a report, or one the scan could not rule out.
• Partial enforcement 27,320 domains (2.7%) quarantine or reject, weakened by pct below 100 or a softer sp=.
• Enforced 207,651 domains (20.8%) quarantine or reject, with no pct or sp tag weakening it.

Two tags weaken a policy without changing it. pct= applies the policy to only that share of failing mail, and sp= sets a separate, often softer, policy for subdomains.

5,129 domains publish a broken record that receivers can't use, including 4,477 with more than one DMARC record. RFC 7489 tells receivers to treat that as no record at all, so we don't count broken records as valid.

Of the 469,415 valid records, 49.9% set p=none, 24.9% set p=quarantine and 25.2% set p=reject.

47.4% of measured domains publish something at the _dmarc name, but that count mixes every tier, broken records included. 207,651 domains (20.8%) reach the enforced tier. 525,752 (52.6%) publish no record. Most of the rest publish p=none, with 128,980 in the dead tier and 105,464 in monitoring.

Among domains at quarantine or reject, 10,318 apply the policy to only part of their failing mail with pct below 100, and 18,596 leave subdomains weaker than the organizational domain. Some domains do both, so the two figures add up to more than the 27,320 domains in the partial-enforcement tier.

Percentages are out of the 1,000,296 domains whose DMARC lookup got an answer. We left out the 470 domains whose lookup failed after retries, because a failed lookup can't show whether a record exists.

Run the same tier rules against your own domain.

Valid records and enforcement by rank

The top 1,000 domains publish and enforce at far higher rates than the rest of the million, so don't quote their percentages for the whole list. Both bars are percentages of the domains in that rank range whose DMARC lookup got an answer.

Fewer domains publish a record the further down the list you go, and the enforced share falls faster than the valid-record share.

The rank ranges cover the Tranco million only. The 766 federal domains outside the million count toward the overall percentages but not toward any rank range.

Adoption by country

The map shades each country by the percentage of measured domains under its ccTLD that publish a valid DMARC record. Hover over a country to see its numbers.

• under 30%
• 30 to 39%
• 40 to 49%
• 50 to 59%
• 60% and up
• under 200 domains

106 countries have at least 200 measured domains under their ccTLD in this snapshot, and 89 of them are shaded on the map. Norway is highest, with 78.4% of measured .no domains publishing a valid DMARC record. .cn is lowest, at 15.1%.

A domain counts toward a country by its TLD alone. Every .de domain counts as Germany, wherever it's hosted or owned. Domains on gTLDs like .com have no country in their name, so they're left off the map. The TLD table below covers them. ccTLDs registered mostly from outside their country, .io, .ai, .co, .tv and .me among them, are measured and listed in the table but not shaded, because shading them would color the wrong country. Countries with fewer than 200 measured domains stay uncolored. A few too small to draw at this size, Singapore and Hong Kong among them, are marked with a dot in the same colors.

Adoption by TLD

The same measurement grouped by TLD, so it includes generic TLDs like .com that the map can't show. Every TLD with at least 1,000 measured domains, biggest first.

.com is the largest registry in the snapshot at 428,071 measured domains, 47.6% of them publishing a valid DMARC record. 61 further TLDs clear the 1,000-domain bar and aren't listed here. The full set is in the published aggregates.

Domains are grouped by the last label of their name, so .co.uk is grouped under .uk. All percentages are based on the domains whose DMARC lookup got an answer, which matches the rest of this report.

Reports that go nowhere

The rua tag on a DMARC record holds the addresses receivers send aggregate reports to. A record with a rua on it looks like monitoring. Whether anything can arrive depends on a second record, and the destination has to publish that one.

128,980 domains publish a p=none DMARC record whose reporting address is missing, dead, or not authorized by its owner. That's 12.9% of measured domains and 27.5% of every valid record in the scan. We call it monitoring theater. The record passes a presence scan as adoption, but receivers that follow the standard send the domain no reports.

The scan reads DNS, so it can see whether a destination can receive a report. It can't see whether anyone reads one. The monitoring tier means a report can arrive. It doesn't mean anyone reads it.

When a rua address sits on another organization's domain, RFC 7489 requires an authorization TXT record at <domain>._report._dmarc.<rua-host>. A receiver that finds no DMARC version tag there must not send the report, and it raises no error to the domain that named the address. 34,506 domains in this scan name at least one outside address whose owner hadn't authorized them when we scanned. Receivers that run this check send nothing to that address. Some of those domains also name another address, on their own domain or with authorization, and receivers can still send reports there.

29,782 domains name only outside addresses without authorization. They're the domains in the unauthorized group with no other address to fall back on. Neither group covers the whole dead tier, because a p=none record with no rua tag is dead too. It gives receivers nowhere to send a report.

192,507 domains name at least one outside reporting address. 143 of them name at least one address the scan could not resolve to a verdict, which counts as neither authorized nor dead. A domain is counted once in each category it has an address in, so the categories overlap. At least 2,066 domains name more than one kind, which is why the counts sum past the total.

SPF

DMARC passes on SPF or DKIM alignment. When receivers can't evaluate a domain's SPF record, its mail can pass DMARC only on DKIM.

639,844 of the 1,000,296 measured domains publish an SPF record. 36,735 of those records (5.7%) return permerror, which means receivers refuse to evaluate the record at all. 16,591 exceed the ten-lookup limit and 10,474 publish more than one record. The scan also flags an include that points at a name with no SPF record, and an include or redirect loop. It doesn't check for other syntax errors, so the true permerror count can only be higher.

How the records end

Percentages are out of the 603,109 domains with a usable SPF record. Records that already permerror are left out, because receivers never reach their final mechanism.

US federal .gov domains

This is every registered federal .gov zone in CISA's public registry, across the executive, legislative and judicial branches. CISA's Binding Operational Directive 18-01 required executive-branch domains that send mail to reach p=reject by October 2018. This list is wider than that, and its parked and redirect names have no mail to protect, so its reject share is not a compliance rate.

The enforced count, 1,063, sits above the reject count, 1,046, because 26 quarantine domains join the tier and 9 weakened domains leave it.

The federal reject share is 79.2% (1,046 domains). Across the whole scan it's 11.8% (118,165 domains), and that figure already includes this cohort. 198 federal domains (15.0%) publish no DMARC record, and 25 publish a dead one. Some of those are parked names that send no mail. The registry doesn't say which.

1,321 domains in the cohort. 79.2% publish p=reject and 81.2% publish quarantine or reject.

Who is named to receive the reports

The rua tag lists where a domain wants its reports sent, so counting rua hosts shows which platforms domains pick to receive them. A rua entry doesn't prove a report arrives, and these counts aren't the platforms' customer numbers. The largest named collector is Cloudflare, on 27,809 domains, then Brevo at 15,817 and Valimail at 14,379.

A p=none domain moves from the dead tier to monitoring once it has a working rua address. With a free collector, an operator can get a first report without signing a contract. Cloudflare, the largest collector in the scan, includes collection with the domain. Postmark's free DMARC Digests is the sixth largest collector.

Each bar counts the domains whose rua list includes a destination on that platform, once per domain. A domain naming two platforms counts for both.

140,950 matches across 27 platforms. The largest destination matching no platform in the list is axa.com, named by 3,904 domains.

MTA-STS, TLS-RPT and BIMI

Far fewer domains publish these three records than publish DMARC.

Out of the 1,000,296 measured domains, 1.0% publish MTA-STS, 1.1% TLS-RPT and 1.7% BIMI.

Methodology

Limitations

The scan reads what domains publish in DNS. Nothing here is a delivered-mail pass rate or an actual rejection.

A domain whose reporting address couldn't be resolved to a verdict counts as neither authorized nor dead. At p=none that puts it in monitoring, so the true dead-reporting count can only be higher.

• This edition covers one scan window, so it reports a level and not a trend.
• Some DNS lookups fail even after retries. 470 ended in error and are excluded rather than scored as no DMARC. If those lookups had succeeded, any count on this page could have moved by up to that many domains.
• We checked rua authorization at scan time only. If a destination's owner added or removed an authorization after the scan, this snapshot doesn't show it.
• So far the only named cohort is the 1,321 US federal domains. Other planned cohorts aren't in this edition.
• We haven't matched every rua host to a platform yet. As we add more, some unmatched destinations will move into named platforms.

The data

• aggregates.json: every count and percentage on this page, as published. Dates, list ids and the scanner version are in the manifest next to it.
• Data repository: the per-snapshot files.
• Hugging Face dataset: the same files for every edition, with the headline counts as one CSV.

Citing and reusing the data

We publish the aggregate data under CC BY 4.0. Reuse it, including commercially, with attribution. Suggested citation: