SPF lookups and retired DMARC tags in the Tranco top 100,000: October 2026
DemiSignal, https://demisignal.com/research/spf-dmarc-top-100k-2026-10

Data files:
spf-dmarc-top-100k-2026-10.csv: aggregate counts by Tranco rank bucket (1-1000, 1001-10000, 10001-100000, all), one row per bucket and metric: rank_bucket, metric, count, base (the metric the share is taken of), base_count, share_pct (count as a percentage of base_count, one decimal; blank when base_count is below 50).
spf-dmarc-top-100k-2026-10-spf-includes.csv: include targets that 50 or more mail domains name directly in their SPF record, with what each costs in DNS lookups.
spf-dmarc-top-100k-2026-10-mx-providers.csv: mail domains by MX provider, for every provider with 50 or more mail domains.

Input: the first 100,000 domains of Tranco list 56Z8N (https://tranco-list.eu/list/56Z8N), generated on 22 October 2026 from the Crux, Farsight, Majestic, Radar and Umbrella rankings of 23 September to 22 October 2026, pay-level domains only. Tranco: Victor Le Pochat, Tom Van Goethem, Samaneh Tajalizadehkhoob, Maciej Korczynski and Wouter Joosen, "Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation", NDSS 2019, https://doi.org/10.14722/ndss.2019.23386.

Scan: every domain was scanned on 23 October 2026 (UTC) through the public resolvers 1.1.1.1 and 1.0.0.1. The scanner started at most 150 lookups per second in total; the resolver library resends a lookup that times out and retries a large answer over TCP, so packets on the wire can exceed that. For each domain we read the MX record, the TXT records at the domain itself (SPF), at _dmarc (DMARC), at _mta-sts (MTA-STS) and at default._bimi (BIMI), plus the TXT record of every include and redirect target the SPF record leads to. The scan read public DNS only. It sent no email, read no DMARC reports, and used no customer data.

DKIM is not measured. DKIM keys sit under selector names that public DNS does not list, so a DNS scan cannot show that a domain has no DKIM.

DNS errors: a domain is excluded and counted in dns_errors_excluded when its MX, domain TXT or _dmarc lookup still returned a DNS error (timeout, SERVFAIL, refused) after a retry and a second pass over every domain with an error. A DNS error deeper in the SPF tree (an include or redirect target) keeps the domain in every count and makes its SPF state spf_temperror.

Mail domains (mx_domains): a domain counts as a mail domain when it publishes at least one MX record other than a null MX (RFC 7505). Domains that publish only a null MX (null_mx) or no MX record (no_mx) are left out of every percentage.

Bases: every share in the files is a share of one of these.
Share of mx_domains: spf_none, spf_multiple, spf_single, spf_temperror, spf_permerror_total, dmarc_no_record, dmarc_invalid_or_multiple, dmarc_no_policy_in_effect, p_none, p_quarantine, p_reject, enforced, domains_with_policy, mta_sts_record, bimi_record, bimi_with_certificate.
Share of spf_single: every spf_lookups_* metric except the median, spf_void_over_2, spf_include_target_missing, spf_syntax_error, spf_single_permerror, spf_valid, spf_ptr and every spf_all_* metric. spf_include_loop, spf_macro and spf_lookups_median carry no share.
Share of domains_with_policy: every dmarc_*_tag metric, dmarc_t_y, dmarc_pct_100, dmarc_pct_not_100 and dmarc_report_size_suffix. dmarc_pct_0 carries no share.
Share of enforced: enforced_pct_not_100.

SPF, from the TXT records at the domain itself:
spf_none: no TXT record starting with v=spf1.
spf_multiple: two or more such records. check_host() returns permerror (RFC 7208 section 4.5).
spf_single: exactly one record whose whole tree resolved. Only these records are counted below.
spf_temperror: exactly one record, but an include or redirect target in its tree still returned a DNS error after the second pass. These are in neither spf_single nor spf_permerror_total.

SPF lookup count (spf_lookups_*): the number of terms that cost a DNS lookup under RFC 7208 section 4.6.4 (include, a, mx, ptr, exists and redirect), across the record and every record its include and redirect terms lead to. Terms after a record's first all mechanism are ignored (RFC 7208 section 5.1). A redirect is counted only when the record has no all mechanism, because RFC 7208 ignores it otherwise (section 6.1). The count is the one an evaluation reaches when it walks the whole tree, which happens when no earlier mechanism matches the sending server. Mail from a server listed early in the record can still pass. A term whose domain uses a macro (%{...}) counts as one lookup and is not expanded further. Expansion stops after 60 lookups.
spf_lookups_0_5, spf_lookups_6_8, spf_lookups_9_10: records within the limit of 10.
spf_lookups_over_10: records over the limit. RFC 7208 says the implementation MUST return permerror. spf_lookups_over_15 is a subset.
spf_void_over_2: more than two include or redirect targets in the tree answered NXDOMAIN or an empty answer (void lookups, RFC 7208 section 4.6.4). Void answers to a, mx and exists terms are not measured.
spf_include_target_missing: an include or redirect target publishes no SPF record, or more than one (RFC 7208 section 5.2).
spf_syntax_error: a term that is not a valid SPF mechanism or modifier, an ip4 value that is not four dotted numbers, an include, exists, ip4 or ip6 with no value, an include or redirect value the resolver refuses as a domain name, or a duplicate redirect or exp modifier, anywhere in the tree. Not checked: ip4 octets above 255, CIDR lengths, and a or mx values that are IP addresses.
spf_include_loop: an include or redirect leads back to a domain already on its own path (for example a record that includes its own domain), so evaluation repeats until it passes the limit of 10.
spf_single_permerror: spf_single records with at least one of: over 10 lookups, void lookups over 2, include target missing, syntax error, include loop (spf_include_loop).
spf_valid: spf_single minus spf_single_permerror.
spf_permerror_total: spf_multiple plus spf_single_permerror, as a share of mx_domains.
spf_all_*: the qualifier on the record's own all mechanism: fail (-all), softfail (~all), neutral (?all), pass (+all), redirect (no all mechanism but a redirect), missing (neither).
spf_macro: records whose tree uses a macro. spf_ptr: records whose tree uses the ptr mechanism.
spf_lookups_median: the median lookup count of spf_single records.

SPF includes file: an include target is listed when 50 or more spf_single mail domains name it directly in their own record (not nested), those domains belong to 50 or more distinct organisations, and no organisation holds more than 20% of them, so no row describes one organisation's own setup. Organisation means the domain minus its suffix (example in example.com and example.co.uk). Only includes that resolved to exactly one SPF record are listed. mail_domains_including counts the domains, share_of_spf_single_pct is that count as a share of all spf_single mail domains in the scan, and lookups_cost is what the include costs: one for the include itself plus every lookup inside the target's tree. lookups_cost_observations says how many of those domains saw that cost (a target can answer differently during the scan).

DMARC, from the record at _dmarc.example.com for each scanned domain example.com. Only the record at that exact name is read; no organizational-domain lookup is made.
A DMARC record is a TXT record that starts with the tag v=DMARC1 (the value is case sensitive, RFC 9989 section 4.7), followed by a semicolon or the end of the record. Other TXT records at _dmarc are ignored.
dmarc_no_record: no DMARC record.
dmarc_invalid_or_multiple: two or more DMARC records (receivers discard all of them, RFC 9989 section 4.10), or a record whose p=, sp= or np= tag holds a value other than none, quarantine or reject and that has no valid mailto: report address.
dmarc_no_policy_in_effect: dmarc_no_record plus dmarc_invalid_or_multiple.
p_none, p_quarantine, p_reject: the policy receivers apply. A record with no p= tag counts as p_none (RFC 9989 section 4.7). A record with an invalid p=, sp= or np= tag but a valid rua report address counts as p_none (RFC 9989 section 4.10.1). A record with t=y counts one level below its p= tag (reject as quarantine, quarantine as none), because that is the policy RFC 9989 section 4.7 says applies.
enforced: p_quarantine plus p_reject.
domains_with_policy: p_none plus p_quarantine plus p_reject.

Retired and new DMARC tags, for domains_with_policy. Tag names are read case-insensitively; the first occurrence of a tag counts.
dmarc_pct_tag, dmarc_rf_tag, dmarc_ri_tag: records that carry pct, rf or ri. RFC 9989 removed these tags and lists them as historic in the IANA DMARC Tags registry (RFC 9989 section 9.3 and Appendix C.5.2).
dmarc_any_historic_tag: records that carry at least one of pct, rf and ri.
dmarc_pct_100: records with pct=100, the RFC 7489 default. dmarc_pct_not_100: records with any other pct value. dmarc_pct_0: records with pct=0. enforced_pct_not_100: enforced records with a pct value other than 100.
dmarc_report_size_suffix: records whose rua or ruf address carries a maximum report size (for example mailto:reports@example.com!10m), which RFC 9989 removed (Appendix C).
dmarc_t_tag, dmarc_np_tag, dmarc_psd_tag: records that carry the t, np or psd tag that RFC 9989 added (Appendix C.5.1). dmarc_t_y: records with t=y.

MX provider (mx-providers file): the provider of the MX hosts with the lowest preference value (Mixed when those hosts belong to different providers), matched on the host name's suffix (for example *.mail.protection.outlook.com is Microsoft, *.google.com and *.googlemail.com are Google, *.pphosted.com is Proofpoint). Every other host is "Other or self-hosted". A provider is listed only with 50 or more mail domains from 50 or more distinct organisations and no organisation above 20% of them; any other provider is counted in "Other or self-hosted". The provider is the one that receives mail for the domain, not necessarily the one that sends it.
In that file, spf_lookups_over_10_pct is a share of the provider's spf_single domains (blank below 50), spf_permerror_total_pct and enforced_pct are shares of its mx_domains.

MTA-STS and BIMI, for mx_domains:
mta_sts_record: exactly one TXT record starting with v=STSv1 at _mta-sts. The policy file over HTTPS was not fetched, so this counts published TXT records, not working MTA-STS.
bimi_record: exactly one TXT record starting with v=BIMI1 at default._bimi. bimi_with_certificate: such a record with an a= tag that holds an https:// URL. The logo and certificate were not fetched or validated.

Aggregates only. No domain is named in any file, and every published segment holds at least 50 domains.