Research

DMARC adoption in the Tranco top 10,000: October 2026

We scanned the Tranco top 10,000 for DMARC: 60.4% of mail domains enforce, 22.0% sit at p=none, and 30.9% of p=none domains get no reports.

By Updated Last verified

On this page
  1. Key numbers
  2. How many enforce
  3. Reports compliant receivers won't send
  4. Method
  5. Check your own domain
  6. Sources

On 14 October 2026 we scanned the Tranco top 10,000 for DMARC. Of the 7,295 domains that publish a mail server (MX), per the aggregate dataset, 60.4% enforce DMARC with p=quarantine or p=reject, 22.0% sit at p=none, and 17.6% have no DMARC policy in effect. Enforcement falls with rank, from 74.8% in the top 1,000 to 55.2% between ranks 5,001 and 10,000. And 495 of the 1,604 p=none domains (30.9%) have no report address that aggregate reports can reach.

Key numbers

DMARC policy of the top 10,000 domains, by Tranco rank bucket

Every percentage is a share of the domains in that bucket that publish MX, as the dataset README defines it. The numbers come from the aggregate dataset.

Tranco rank Domains with MX No DMARC policy p=none p=quarantine p=reject Enforced
1-1,000 690 10.6% 14.6% 23.9% 50.9% 74.8%
1,001-5,000 2,849 16.8% 19.3% 25.6% 38.3% 63.8%
5,001-10,000 3,756 19.5% 25.3% 25.3% 29.9% 55.2%
All 10,000 7,295 17.6% 22.0% 25.3% 35.2% 60.4%

The no-policy column joins two counts: 1,267 domains publish no DMARC record and 16 publish a record that leaves no policy in effect.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account

How many enforce

DMARC lets a domain owner tell receivers what to do with mail that fails authentication. The three policy values (opens in a new tab) differ in what they ask for. With p=none the domain owner "offers no expression of preference". With p=quarantine the owner considers failing mail suspicious. With p=reject the owner treats a failure as a clear sign that the use of the domain is not valid.

RFC 9989 defines Enforcement (opens in a new tab) as a state where the policy for an organizational domain and all subdomains below it is not p=none. This page counts p=quarantine and p=reject as enforced: 4,408 of the 7,295 mail domains in the dataset, 1,843 at p=quarantine and 2,565 at p=reject. 316 of those records also set sp=none, which leaves subdomains at none, so their subdomains are not under Enforcement as RFC 9989 defines it. The sp tag sets the policy for subdomains.

The higher the rank, the larger the share that enforces. In the top 1,000, 50.9% of mail domains publish p=reject. Between ranks 5,001 and 10,000 that falls to 29.9%, and the share at p=none rises from 14.6% to 25.3%.

129 of the enforced records also set pct below 100, including 5 with pct=0. The pct tag (opens in a new tab) was meant to let owners move from none to quarantine, or from quarantine to reject, by asking for the stricter treatment on only a share of failing messages. The dataset README counts these records as enforced.

The 16 records that leave no policy in effect come in two kinds: a domain that publishes two or more DMARC records, or a record with no valid p= tag and no report address. When a lookup returns more than one DMARC record (opens in a new tab), receivers discard all of them.

Reports compliant receivers won't send

The rua tag (opens in a new tab) lists the addresses that should receive aggregate reports.

Of the 6,012 mail domains with a DMARC policy in effect, 1,067 (17.7%) have no report address that aggregate reports can reach, per the dataset and the definitions in its README:

  • 775 (12.9%) publish no rua tag.
  • 15 publish a rua tag with no valid mailto: address.
  • 277 (4.6%) send reports only to another organization's domain that has not authorized them.

The last group is easy to miss. When the rua address is at a different organization's domain, the receiver first looks for an authorization record at that domain, and if it cannot confirm the authorization (opens in a new tab), the receiver must ignore the address. A report destination can authorize one domain, or every domain at once with a wildcard record.

Two examples:

_dmarc.instagram.com                                  TXT  "v=DMARC1; p=reject; rua=mailto:a@dmarc.facebookmail.com; pct=100"
instagram.com._report._dmarc.dmarc.facebookmail.com   TXT  NXDOMAIN (no authorization)

_dmarc.espn.com                                       TXT  "v=DMARC1;p=none;fo=1;rua=mailto:Corp.Dmarc_RUA@disney.com;ruf=mailto:Corp.Dmarc_RUF@disney.com"
espn.com._report._dmarc.disney.com                    TXT  NXDOMAIN (no authorization)

Missing reports matter most at p=none. RFC 9989 defines "Monitoring Mode" (opens in a new tab) as p=none while the domain owner is receiving aggregate reports. In our scan, 495 of the 1,604 p=none domains (30.9%) have no report address that reports can reach. Between ranks 5,001 and 10,000 it is 34.1%.

Method

The input is the first 10,000 domains of Tranco list N26LW (opens in a new tab). Tranco combined the rankings of Crux, Farsight, Majestic, Radar and Umbrella from 14 September to 13 October 2026, kept only pay-level domains, and generated the list on 13 October 2026.

The dataset README sets out the definitions. In short:

  • We scanned every domain on 14 October 2026 with DemiSignal's DNS checker, the same DMARC, SPF and MX checks the free check runs. The scan read public DNS only. It sent no email and read no DMARC reports.
  • A domain counts as a mail domain when it publishes at least one MX record other than a null MX (opens in a new tab), the single . record a domain uses to say it accepts no email. Of the 10,000 domains, 77 publish only a null MX and 2,579 publish no MX record; both groups are left out of every percentage.
  • 49 domains whose MX or DMARC lookup still returned a DNS error after at least one retry are excluded.
  • A record with an invalid p= tag but a valid report address counts as p=none, which is how receivers treat it (opens in a new tab).
  • DKIM is not measured. DKIM keys sit under selector names that public DNS does not list, so a DNS scan cannot show that a domain has no DKIM.

The aggregate CSV holds the counts and percentages by rank bucket.

Check your own domain

The free DemiSignal check flags a missing DMARC record, a policy of none and a missing report address. No account needed.

Sources

Tools for this

Frequently asked questions

What share of top domains enforce DMARC?

60.4% of the 7,295 domains in the Tranco top 10,000 that publish MX had p=quarantine or p=reject when we scanned them on 14 October 2026.

Why is DKIM not in this study?

DKIM keys sit under selector names that public DNS does not list, so a DNS scan cannot show that a domain has no DKIM.

Why would DMARC reports not arrive?

The record has no rua tag, its rua tag holds no valid mailto address, or every address is at another organization's domain that publishes no authorization record for it.

Check your domain now

See the SPF, DKIM and DMARC records your domain publishes and what to fix first. Free, no account needed.

Create a free account