DMARC Census, September 2026

Key findings

• In the September 2026 scan of the Tranco top million and a US federal cohort, 131,008 domains publish p=none and name no reporting address that can receive a report. That's 27.7% of the 472,655 valid DMARC records in the scan.
• 47.2% of the 1,000,424 domains we could measure in September 2026 publish a DMARC record receivers can act on. 47.8% publish something at the _dmarc name. 52.2% publish nothing.
• 20.8% of the domains measured in September 2026, 208,354 of them, publish quarantine or reject with no pct or sp tag weakening it. 11.8% publish p=reject.
• 34,749 domains in the September 2026 scan name an outside reporting address, and the address's owner hadn't published an authorization record for them when we scanned. Receivers that check for that record won't send reports there. 30,036 of these domains in the September 2026 scan name only outside addresses without authorization.
• Of the top 1,000 domains in the September 2026 scan, 72.3% publish a valid DMARC record and 56.1% are in the enforced tier. Across ranks 100,000 to 1,000,000, those shares are 46.0% and 19.4%.
• 402 of the domains with a usable SPF record in the September 2026 scan end it with +all. That lets any host on the internet send as them.
• Of 1,321 registered US federal .gov domains, 81.0% publish p=reject in the September 2026 scan and 174 publish no DMARC record. That list is wider than the mail-sending executive-branch set that Binding Operational Directive 18-01 has held to p=reject since October 2018, so the gap isn't a count of agencies breaking the directive.
• Between the August 2026 and September 2026 scans, 3,004 domains moved to a stronger policy, 1,302 of them by publishing a first p=none record, and 1,059 moved to a weaker one. 99.6% of the 926,567 domains we measured in both months kept the same policy.

What changed since August 2026

We compare the policy of every domain that was on the list in both months and whose lookup got an answer both times. From weakest to strongest, the policies are no usable record, p=none, p=quarantine and p=reject. A broken record counts as no usable record. If DNS failed in either month, we leave the domain out and don't count it as a change.

926,567 domains were on both lists and got an answer both times. 922,504 of them kept the same policy from August 2026 to September 2026. 3,004 moved to a stronger policy and 1,059 to a weaker one. The stronger count includes 1,302 domains that published their first p=none record. 1,435 reached quarantine or reject from p=none or no usable record, and 831 of those had been at p=none. The most common change was no usable record to p=none, on 1,302 domains.

The headline shares, month against month

The Tranco list changes from month to month. 73,642 domains in the September 2026 scan weren't on the August 2026 list, so part of every change in this table comes from that turnover. The changes below count only domains that were on both lists, so start with those.

Every policy change, largest first

73,642 domains in the September 2026 scan weren't on the August 2026 list, so there's nothing earlier to compare them with. 558 pairs were on both lists but failed to resolve in one month or the other. They're left out of every count here.

One month of movement is one data point. We'll draw trend lines once three editions exist, and not before.

The quality tiers

We put each domain in one tier, based on whether receivers act on its policy and whether anyone can receive its DMARC reports.

• No record 522,642 domains (52.2%) No DMARC record at the _dmarc name.
• Broken 5,127 domains (0.5%) A record exists and receivers ignore it: more than one record, a bad v= tag, or no usable p=.
• Dead reporting 131,008 domains (13.1%) p=none, and no rua destination that can receive a report.
• Monitoring 106,056 domains (10.6%) p=none, with at least one rua destination that can receive a report, or one the scan could not rule out.
• Partial enforcement 27,237 domains (2.7%) quarantine or reject, weakened by pct below 100 or a softer sp=.
• Enforced 208,354 domains (20.8%) quarantine or reject, with no pct or sp tag weakening it.

Two tags weaken a policy without changing it. pct= applies the policy to only that share of failing mail, and sp= sets a separate, often softer, policy for subdomains.

5,127 domains publish a broken record that receivers can't use, including 4,478 with more than one DMARC record. RFC 7489 tells receivers to treat that as no record at all, so we don't count broken records as valid.

Of the 472,655 valid records, 50.2% set p=none, 24.8% set p=quarantine and 25.1% set p=reject.

47.8% of measured domains publish something at the _dmarc name, but that count mixes every tier, broken records included. 208,354 domains (20.8%) reach the enforced tier. 522,642 (52.2%) publish no record. Most of the rest publish p=none, with 131,008 in the dead tier and 106,056 in monitoring.

Among domains at quarantine or reject, 10,279 apply the policy to only part of their failing mail with pct below 100, and 18,546 leave subdomains weaker than the organizational domain. Some domains do both, so the two figures add up to more than the 27,237 domains in the partial-enforcement tier.

Percentages are out of the 1,000,424 domains whose DMARC lookup got an answer. We left out the 343 domains whose lookup failed after retries, because a failed lookup can't show whether a record exists.

Run the same tier rules against your own domain.

Valid records and enforcement by rank

The top 1,000 domains publish and enforce at far higher rates than the rest of the million, so don't quote their percentages for the whole list. Both bars are percentages of the domains in that rank range whose DMARC lookup got an answer.

Fewer domains publish a record the further down the list you go, and the enforced share falls faster than the valid-record share.

The rank ranges cover the Tranco million only. The 767 federal domains outside the million count toward the overall percentages but not toward any rank range.

Adoption by country

The map shades each country by the percentage of measured domains under its ccTLD that publish a valid DMARC record. Hover over a country to see its numbers.

• under 30%
• 30 to 39%
• 40 to 49%
• 50 to 59%
• 60% and up
• under 200 domains

106 countries have at least 200 measured domains under their ccTLD in this snapshot, and 89 of them are shaded on the map. Norway is highest, with 78.2% of measured .no domains publishing a valid DMARC record. .cn is lowest, at 15.9%.

A domain counts toward a country by its TLD alone. Every .de domain counts as Germany, wherever it's hosted or owned. Domains on gTLDs like .com have no country in their name, so they're left off the map. The TLD table below covers them. ccTLDs registered mostly from outside their country, .io, .ai, .co, .tv and .me among them, are measured and listed in the table but not shaded, because shading them would color the wrong country. Countries with fewer than 200 measured domains stay uncolored. A few too small to draw at this size, Singapore and Hong Kong among them, are marked with a dot in the same colors.

Adoption by TLD

The same measurement grouped by TLD, so it includes generic TLDs like .com that the map can't show. Every TLD with at least 1,000 measured domains, biggest first.

.com is the largest registry in the snapshot at 426,315 measured domains, 48.2% of them publishing a valid DMARC record. 61 further TLDs clear the 1,000-domain bar and aren't listed here. The full set is in the published aggregates.

Domains are grouped by the last label of their name, so .co.uk is grouped under .uk. All percentages are based on the domains whose DMARC lookup got an answer, which matches the rest of this report.

Reports that go nowhere

The rua tag on a DMARC record holds the addresses receivers send aggregate reports to. A record with a rua on it looks like monitoring. Whether anything can arrive depends on a second record, and the destination has to publish that one.

131,008 domains publish a p=none DMARC record whose reporting address is missing, dead, or not authorized by its owner. That's 13.1% of measured domains and 27.7% of every valid record in the scan. We call it monitoring theater. The record passes a presence scan as adoption, but receivers that follow the standard send the domain no reports.

The scan reads DNS, so it can see whether a destination can receive a report. It can't see whether anyone reads one. The monitoring tier means a report can arrive. It doesn't mean anyone reads it.

When a rua address sits on another organization's domain, RFC 7489 requires an authorization TXT record at <domain>._report._dmarc.<rua-host>. A receiver that finds no DMARC version tag there must not send the report, and it raises no error to the domain that named the address. 34,749 domains in this scan name at least one outside address whose owner hadn't authorized them when we scanned. Receivers that run this check send nothing to that address. Some of those domains also name another address, on their own domain or with authorization, and receivers can still send reports there.

30,036 domains name only outside addresses without authorization. They're the domains in the unauthorized group with no other address to fall back on. Neither group covers the whole dead tier, because a p=none record with no rua tag is dead too. It gives receivers nowhere to send a report.

193,499 domains name at least one outside reporting address. 141 of them name at least one address the scan could not resolve to a verdict, which counts as neither authorized nor dead. A domain is counted once in each category it has an address in, so the categories overlap. At least 2,053 domains name more than one kind, which is why the counts sum past the total.

SPF

DMARC passes on SPF or DKIM alignment. When receivers can't evaluate a domain's SPF record, its mail can pass DMARC only on DKIM.

641,215 of the 1,000,424 measured domains publish an SPF record. 36,598 of those records (5.7%) return permerror, which means receivers refuse to evaluate the record at all. 16,482 exceed the ten-lookup limit and 10,448 publish more than one record. The scan also flags an include that points at a name with no SPF record, and an include or redirect loop. It doesn't check for other syntax errors, so the true permerror count can only be higher.

How the records end

Percentages are out of the 604,617 domains with a usable SPF record. Records that already permerror are left out, because receivers never reach their final mechanism.

US federal .gov domains

This is every registered federal .gov zone in CISA's public registry, across the executive, legislative and judicial branches. CISA's Binding Operational Directive 18-01 required executive-branch domains that send mail to reach p=reject by October 2018. This list is wider than that, and its parked and redirect names have no mail to protect, so its reject share is not a compliance rate.

The enforced count, 1,087, sits above the reject count, 1,070, because 26 quarantine domains join the tier and 9 weakened domains leave it.

The federal reject share is 81.0% (1,070 domains). Across the whole scan it's 11.8% (118,536 domains), and that figure already includes this cohort. 174 federal domains (13.2%) publish no DMARC record, and 25 publish a dead one. Some of those are parked names that send no mail. The registry doesn't say which.

1,321 domains in the cohort. 81.0% publish p=reject and 83.0% publish quarantine or reject.

Who is named to receive the reports

The rua tag lists where a domain wants its reports sent, so counting rua hosts shows which platforms domains pick to receive them. A rua entry doesn't prove a report arrives, and these counts aren't the platforms' customer numbers. The largest named collector is Cloudflare, on 28,095 domains, then Brevo at 16,177 and Valimail at 14,333.

A p=none domain moves from the dead tier to monitoring once it has a working rua address. With a free collector, an operator can get a first report without signing a contract. Cloudflare, the largest collector in the scan, includes collection with the domain. Postmark's free DMARC Digests is the sixth largest collector.

Each bar counts the domains whose rua list includes a destination on that platform, once per domain. A domain naming two platforms counts for both.

141,242 matches across 27 platforms. The largest destination matching no platform in the list is axa.com, named by 4,114 domains.

MTA-STS, TLS-RPT and BIMI

Far fewer domains publish these three records than publish DMARC.

Out of the 1,000,424 measured domains, 1.0% publish MTA-STS, 1.2% TLS-RPT and 1.7% BIMI.

Methodology

Limitations

The scan reads what domains publish in DNS. Nothing here is a delivered-mail pass rate or an actual rejection.

A domain whose reporting address couldn't be resolved to a verdict counts as neither authorized nor dead. At p=none that puts it in monitoring, so the true dead-reporting count can only be higher.

• With two editions there's one month of change to report. We'll draw trend lines once three editions exist.
• Some DNS lookups fail even after retries. 343 ended in error and are excluded rather than scored as no DMARC. If those lookups had succeeded, any count on this page could have moved by up to that many domains.
• We checked rua authorization at scan time only. If a destination's owner added or removed an authorization after the scan, this snapshot doesn't show it.
• So far the only named cohort is the 1,321 US federal domains. Other planned cohorts aren't in this edition.
• We haven't matched every rua host to a platform yet. As we add more, some unmatched destinations will move into named platforms.

The data

• aggregates.json: every count and percentage on this page, as published. Dates, list ids and the scanner version are in the manifest next to it.
• Data repository: the per-snapshot files.
• Hugging Face dataset: the same files for every edition, with the headline counts as one CSV.
• Zenodo archive of this edition: doi:10.5281/zenodo.22849901.

Citing and reusing the data

We publish the aggregate data under CC BY 4.0. Reuse it, including commercially, with attribution. Suggested citation: