39% of the web's top sites don't ask Gmail to stop email forged in their name.

DMARC tells Gmail, Outlook and Yahoo what to do with mail that claims to come from your domain but fails SPF and DKIM. A policy of p=none only asks for reports and tells providers to take no action on failing mail. Only quarantine and reject ask them to keep forged mail away from readers.

87% of DMARC records ask for aggregate reports (a rua address), the first step towards enforcing. Among sites that do enforce, 2.8% apply the policy to only part of their failing mail (pct below 100).

The top 100 and the top 1,000 sites enforce DMARC at about the same rate. Below that, enforcement falls: across the full top 10,000, 39% of sites that receive email don't enforce it.

93.3% of sites that receive email publish SPF, the list of servers allowed to send for them. How the record ends decides what happens to everything else: -all says fail it, ~all says treat it as suspicious, and ?all says nothing at all.

2,711 of the 10,000 domains publish no MX record. They can still be spoofed unless they say they never send it: an SPF record of v=spf1 -all and a DMARC policy of p=reject. Only 16.3% of them do both.

BIMI, which shows a verified brand logo next to your mail in Gmail, Apple Mail and Yahoo, appears on 13.3% of sites that receive email. MTA-STS, which forces encrypted delivery to your own mail servers, appears on 4%.

We took the top 10,000 domains of the Tranco list 94P72, a research ranking that averages several popularity lists. On November 8, 2026 we looked up each domain's MX records and the TXT records for SPF (the domain itself), DMARC (_dmarc), BIMI (default._bimi) and MTA-STS (_mta-sts) through Cloudflare, Google and Quad9 public resolvers, retrying failed lookups twice. Domains with any failed lookup were then scanned again, more slowly, the same day.

A domain “receives email” if it has at least one MX record that isn't a null MX. Lookups that still failed (120 domains had at least one) are left out of that check rather than counted as missing. A domain with two DMARC records is counted as invalid, as mailbox providers ignore both. We didn't check DKIM, because its selectors can't be discovered from DNS alone, and we read only public DNS: no mail was sent.

The aggregate numbers are available as JSON under CC BY 4.0. Please cite and link this page if you use them.