Launched on Launchit

Mailient Research · Q3 2026

47.9% of mail-receiving domains can be impersonated by anyone

We checked the public DNS records of the top 50,000 sites on 5 September 2026. Of the 36,548 that actually receive email, 17,494 (47.9%) publish no DMARC policy that would stop a forged message being delivered — either no record at all, or one set to monitor only.

Method

Sample
Top 50,000 domains of the Tranco V367N list, a research ranking that averages several providers over a 30-day window.
Measured on
5 September 2026
Answered
50,000 domains returned DNS within the timeout
What we read
MX and _dmarc TXT, both public records anyone can query
Not published
SPF and DKIM. Neither is a footnote — see what we could not measure below for exactly why, and how we found out.
Denominator
domains with at least one MX record. A domain with no mail servers is not meaningfully unprotected, so counting it would only inflate the headline.

Protection collapses outside the top of the list

The single average hides the finding. The most-visited few hundred domains belong to companies with security teams, and they are mostly fine. The further down the ranking you go, the faster that stops being true.

Rank bandReceives mailCan be forgedAt reject
1 – 1,00068625.9%51%
1,001 – 10,0006,53241.1%33.6%
10,001 – 50,00029,33049.9%26.9%

“Can be forged” means no DMARC record, or one set to p=none. “At reject” means p=reject, the only setting that actually refuses a forgery rather than filing it.

What the 36,548 mail-receiving domains publish

DMARC policyDomainsShareWhat it does to a forgery
No record8,09422.1%Nothing. The receiving server has no instruction and usually delivers it.
p=none9,40025.7%Notices, reports, and delivers it anyway. Monitoring, not protection.
p=quarantine8,61823.6%Sends it to spam. A spam folder is still a folder someone opens.
p=reject10,43628.6%Refuses it at the door. The only setting that actually stops the mail.

DMARC is the record that decides this. SPF and DKIM only tell a receiving server whether a message passed a check; DMARC is what tells it to do something about a failure. A domain can publish a perfect SPF record and still be forgeable, because without a policy the usual answer to a failed check is to deliver the message anyway.

What we could not measure

SPF, and we are not going to publish a figure for it.We collected it and then found we could not trust it. Resolving a domain's apex TXT record is much harder than resolving _dmarc: the answer is often large enough to need a second, slower query, and at the volume this sample requires those are the first lookups to be dropped.

We caught it by re-checking a random sample of domains our own run had recorded as having no SPF. Fourteen out of fourteen did have one. That is not a figure with a margin of error, it is a broken measurement, so there is no SPF number on this page and no SPF column in the CSV. A correct one needs a separate, slower pass and will appear in a future edition or not at all.

The same check run against DMARC found nothing wrong: zero of fourteen misreported, and zero of ten on an earlier run. That asymmetry is what makes the headline safe to quote and the SPF number not.

We also do not measure DKIM, for a different and permanent reason: a DKIM key lives at a selector chosen by the mail provider, selectors cannot be enumerated, and an adoption figure built from guessing selector names is a guess wearing a percentage sign.

Cite this

Mailient (2026). "Email authentication of the top 50,000 domains, Q3 2026." Measured 5 September 2026 against Tranco list V367N. https://mailient.xyz/research/email-authentication-2026-q3

Each edition keeps its own URL permanently and is never edited after publication, so this citation will still resolve to these numbers after the next run.

Check it yourself

Every figure here comes from public DNS, so all of it is independently verifiable. The per-domain results are published as a CSV: rank, domain, whether it receives mail, its SPF record and its DMARC policy.

Download the raw data (CSV)

The aggregate — the same counts and percentages shown above, plus the method fields — is also served as JSON at /research/email-authentication-2026-q3/data.json, so anything quoting a figure can take the method with it.

Is your own domain in the 47.9%?

The same check, on one domain, in about two seconds. It shows what a forged email from your address would look like in a customer's inbox, and the exact DNS records that stop it.

Check your domain free