SPF lookups and retired DMARC tags in the Tranco top 100,000: October 2026

On 23 October 2026 we scanned the Tranco top 100,000 for SPF and DMARC. Of the 65,825 mail domains that publish one SPF record, per the aggregate dataset, 2,012 (3.1%) need more than 10 DNS lookups, and another 5,225 (7.9%) sit at 9 or 10. Over the limit, RFC 7208↗ (opens in a new tab) requires SPF to return permerror. On the DMARC side, 19,556 of the 54,958 mail domains with a DMARC policy (35.6%) still carry pct, rf or ri, tags that RFC 9989↗ (opens in a new tab) lists as historic.

Key numbers#

The numbers come from the aggregate dataset, and the dataset README holds the definitions. The lookup columns are shares of the mail domains with one SPF record. The SPF error column is a share of all mail domains. The DMARC column is a share of the mail domains with a DMARC policy.

SPF over the 10-lookup limit#

SPF caps the DNS work a receiver does for one check. RFC 7208↗ (opens in a new tab) names the terms that cause DNS queries (include, a, mx, ptr, exists and the redirect modifier) and limits their total to 10 during evaluation. Past 10, the implementation must return permerror. A permerror result↗ (opens in a new tab) means the domain's records could not be correctly interpreted, and fixing it takes a change in DNS.

As the SPF record generator puts it, every include costs a lookup, and so does every include nested inside it. The median record in the dataset needs 3 lookups. 2,012 records need more than 10, and 351 of those need more than 15.

The share over the limit is 3.3% in the top 1,000, 2.9% between ranks 1,001 and 10,000, and 3.1% below that. The share at 9 or 10 lookups is higher at the top: 10.7% in the top 1,000 against 7.9% across all 100,000.

The lookup limit is not the only way SPF errors out:

• 768 mail domains publish two or more SPF records. With more than one record↗ (opens in a new tab), check_host() returns permerror.
• 810 records name an include or redirect target that publishes no SPF record, or more than one. An include whose target has no record↗ (opens in a new tab) returns permerror.
• 342 records have a syntax error anywhere in their tree, 117 have an include loop that leads back to a domain already on the path, and 40 hit more than two void lookups, as the dataset README defines them.

Counting every cause we measure, SPF returns permerror for 3,882 of the 72,856 mail domains (5.3%).

One limit of this count: SPF evaluates mechanisms left to right↗ (opens in a new tab) and stops at the first match. We count the whole tree, which is what a receiver walks when nothing matches early. Mail from a server listed early in the record can still pass.

Related guides: SPF too many DNS lookups and SPF permerror.

Which includes use up the budget#

The most common includes are cheap. Per the includes dataset, _spf.google.com appears in 17,919 records and spf.protection.outlook.com in 16,259, and each costs 1 lookup. amazonses.com (7,331 records) costs 1, sendgrid.net and _spf.salesforce.com cost 2 each, and mailgun.org costs 5.

Some includes take most of the budget on their own. _netblocks.mimecast.com costs 9 lookups, and _spf.yandex.net and spf.mail.qq.com cost 8 each. Checked against live DNS, the spf.mail.qq.com record holds seven includes, so naming it costs 8:

spf.mail.qq.com  TXT  "v=spf1 include:qq-a.mail.qq.com include:qq-b.mail.qq.com include:qq-c.mail.qq.com include:biz-a.mail.qq.com include:biz-b.mail.qq.com include:biz-c.mail.qq.com include:biz-d.mail.qq.com -all"

_spf.yandex.net gets to 8 with a redirect to _spf.yandex.ru, which holds six includes:

_spf.yandex.net  TXT  "v=spf1 redirect=_spf.yandex.ru"
_spf.yandex.ru   TXT  "v=spf1 include:_spf-ipv6.yandex.ru include:_spf-ipv4-yc.yandex.ru include:_spf-ipv4-yc-a.yandex.ru include:_spf-ipv4-yc-b.yandex.ru include:_spf-ipv4-yc-d.yandex.ru include:_spf-ipv4-x.yandex.ru ~all"

The same pattern shows up by mail provider in the provider dataset. Among mail domains whose MX points at Yandex, 23.2% of SPF records are over the limit, and at Mimecast 8.7%. At Google it is 2.7% and at Microsoft 3.9%. As the dataset README notes, the provider is the one that receives the domain's mail, not necessarily the one that sends it.

DMARC tags RFC 9989 retired#

Three tags from RFC 7489 are gone in RFC 9989. In the IANA DMARC Tags registry, RFC 9989 lists pct, rf and ri as historic↗ (opens in a new tab), and its list of changes↗ (opens in a new tab) has them under tags removed. For pct, RFC 9989 explains↗ (opens in a new tab) that receivers usually did not apply it accurately unless the value was 0 or 100, and it adds a t tag whose values y and n are meant to work like pct=0 and pct=100.

Of the 54,958 mail domains with a DMARC policy in the dataset:

• 17,790 (32.4%) carry pct. 15,974 of them set pct=100, and 1,816 set another value (134 of them pct=0).
• 6,041 (11.0%) carry ri, and 3,319 (6.0%) carry rf.
• 392 (0.7%) add a maximum report size to a report address, which RFC 9989 also removed.

The top of the list carries the old tags most often: 43.3% of DMARC records in the top 1,000, against 35.2% below rank 10,000.

The tags RFC 9989 added↗ (opens in a new tab) are rare so far. 90 records carry t, 20 of them t=y. 96 carry np, the policy for non-existent subdomains, and 28 carry psd.

For context, 47.6% of the 72,856 mail domains have a policy of quarantine or reject in effect, 27.8% have none, and 24.6% have no DMARC policy in effect. Related: DMARC adoption in the Tranco top 10,000 and the RFC 9989 guide.

MTA-STS and BIMI#

Few mail domains publish either record, and the share is highest at the top of the list. Per the dataset and the definitions in its README, 2,015 mail domains (2.8%) publish an MTA-STS record, and 5.0% in the top 1,000 do. 4,938 (6.8%) publish a BIMI record, 23.1% in the top 1,000. 2,775 BIMI records carry an a= tag with a certificate URL.

We read only the DNS records. We did not fetch the MTA-STS policy file or the BIMI logo and certificate, so these counts show published records, not working setups.

Related guides: MTA-STS and BIMI records.

Method#

The input is the first 100,000 domains of Tranco list 56Z8N↗ (opens in a new tab). Tranco combined the rankings of Crux, Farsight, Majestic, Radar and Umbrella from 23 September to 22 October 2026, kept only pay-level domains, and generated the list on 22 October 2026.

The dataset README sets out the definitions. In short:

• We scanned every domain on 23 October 2026 through the public resolvers 1.1.1.1 and 1.0.0.1. The scan read public DNS only. It sent no email, read no DMARC reports and used no customer data.
• A mail domain publishes at least one MX record other than a null MX↗ (opens in a new tab), the single . record a domain uses to say it accepts no email. 393 domains publish only a null MX and 26,384 publish no MX record. Both groups are left out of every percentage.
• 367 domains whose MX, TXT or _dmarc lookup still returned a DNS error after a retry and a second pass are excluded. 73 mail domains with a DNS error deeper in their SPF tree stay in the counts as spf_temperror, and are in neither the one-record nor the SPF error figures.
• The lookup count follows include and redirect terms and counts the terms RFC 7208 limits. A term whose domain uses a macro counts as one lookup and is not followed. Terms after all are ignored↗ (opens in a new tab), and a redirect counts only when the record has no all.
• DKIM is not measured. DKIM keys sit under selector names that public DNS does not list, so a DNS scan cannot show that a domain has no DKIM.
• The files hold aggregates only. No domain is named, and every published segment holds at least 50 domains.

Download the data#

• Aggregate counts by rank bucket (CSV)
• SPF includes and their lookup cost (CSV)
• Mail domains by MX provider (CSV)
• README with the definitions

Check your own domain#

The free DemiSignal check counts your SPF lookups and flags a record that is close to or over the limit of 10. To rebuild a record, the SPF record generator estimates the lookup count of the services you pick. No account needed.

Sources#

• DemiSignal: SPF and DMARC dataset, October 2026 (CSV)
• DemiSignal: SPF includes dataset (CSV)
• DemiSignal: MX provider dataset (CSV)
• DemiSignal: dataset README and definitions
• Tranco list 56Z8N↗ (opens in a new tab)
• RFC 7208, Section 4.6.4: DNS lookup limits↗ (opens in a new tab)
• RFC 7208, Section 2.6.7: permerror↗ (opens in a new tab)
• RFC 7208, Section 4.5: selecting records↗ (opens in a new tab)
• RFC 7208, Section 5.2: include↗ (opens in a new tab)
• RFC 7208, Section 4.6.2: mechanisms↗ (opens in a new tab)
• RFC 7208, Section 5.1: all↗ (opens in a new tab)
• RFC 9989, Section 9.3: DMARC Tags registry↗ (opens in a new tab)
• RFC 9989, Appendix C: changes from RFC 7489↗ (opens in a new tab)
• RFC 9989, Appendix A.6: the pct tag↗ (opens in a new tab)
• RFC 9989, Section 4.7: DMARC policy record tags↗ (opens in a new tab)
• RFC 7505, Section 3: null MX↗ (opens in a new tab)