DMARC adoption in the Tranco top 10,000: October 2026
DemiSignal, https://demisignal.com/research/dmarc-adoption-2026-10

Data file: dmarc-adoption-2026-10.csv (aggregate counts and percentages by Tranco rank bucket).

Input: the first 10,000 domains of Tranco list N26LW (https://tranco-list.eu/list/N26LW), generated on 13 October 2026.

Scan: every domain was scanned on 14 October 2026 with DemiSignal's DNS checker, the same DMARC, SPF and MX checks the free check at https://demisignal.com/check runs. The scan read public DNS only. It sent no email and read no DMARC reports.

DKIM is not measured. DKIM keys sit under selector names that public DNS does not list, so a DNS scan cannot show that a domain has no DKIM.

DNS errors: a domain whose MX or DMARC lookup still returned a DNS error after at least one retry is excluded and counted in dns_errors_excluded.

MX domains: a domain counts as an MX domain when it publishes at least one MX record other than a null MX. Domains that publish only a null MX (null_mx) or no MX record (no_mx) are left out of every percentage, because they declare that they receive no email or name no mail server.

Percentages: every *_pct column for DMARC states is a share of mx_domains. Every rua_* and reports_* percentage is a share of domains_with_policy. p_none_reports_cannot_arrive_pct is a share of p_none.

DMARC states, from the record at _dmarc.example.com for each scanned domain example.com:
no_dmarc_record: no TXT record starting with v=DMARC1.
invalid_dmarc: two or more DMARC records, or a record with no valid p= tag and no report address, so no policy applies.
p_none, p_quarantine, p_reject: the policy receivers apply. A record with an invalid p= tag but a valid report address counts as p_none.
no_policy_in_effect: no_dmarc_record plus invalid_dmarc.
enforced: p_quarantine plus p_reject. enforced_with_pct_below_100 counts enforced records that also set pct below 100; they stay in enforced.
enforced_with_pct_0: enforced records that set pct=0; they are part of enforced_with_pct_below_100 and stay in enforced.
enforced_with_sp_none: enforced records that also set sp=none, which leaves subdomains at none; they stay in enforced.
domains_with_policy: p_none plus p_quarantine plus p_reject.

Report addresses (rua), for domains_with_policy:
rua_missing: the record has no rua tag.
rua_no_valid_mailto: the rua tag holds no valid mailto: address.
rua_external_unauthorized: every rua address is at another organization's domain, and that domain publishes no TXT record such as example.com._report._dmarc.reports.example.net (or the wildcard *._report._dmarc.reports.example.net) authorizing reports for this domain.
rua_authorization_lookup_failed: the authorization lookup returned a DNS error and no address was authorized; not counted as cannot arrive.
rua_reachable: at least one rua address is in the domain's own organization or is authorized.
reports_cannot_arrive: rua_missing plus rua_no_valid_mailto plus rua_external_unauthorized.

Organizational domains follow the Public Suffix List bundled with DemiSignal's checker.