Mailient Research · Q3 2026
We checked the public DNS records of the top 50,000 sites on 5 September 2026. Of the 36,548 that actually receive email, 17,494 (47.9%) publish no DMARC policy that would stop a forged message being delivered — either no record at all, or one set to monitor only.
Measured 5 September 2026 · sample from Tranco V367N · raw data (CSV)
MX and _dmarc TXT, both public records anyone can queryThe single average hides the finding. The most-visited few hundred domains belong to companies with security teams, and they are mostly fine. The further down the ranking you go, the faster that stops being true.
| Rank band | Receives mail | Can be forged | At reject |
|---|---|---|---|
| 1 – 1,000 | 686 | 25.9% | 51% |
| 1,001 – 10,000 | 6,532 | 41.1% | 33.6% |
| 10,001 – 50,000 | 29,330 | 49.9% | 26.9% |
“Can be forged” means no DMARC record, or one set to p=none. “At reject” means p=reject, the only setting that actually refuses a forgery rather than filing it.
| DMARC policy | Domains | Share | What it does to a forgery |
|---|---|---|---|
| No record | 8,094 | 22.1% | Nothing. The receiving server has no instruction and usually delivers it. |
p=none | 9,400 | 25.7% | Notices, reports, and delivers it anyway. Monitoring, not protection. |
p=quarantine | 8,618 | 23.6% | Sends it to spam. A spam folder is still a folder someone opens. |
p=reject | 10,436 | 28.6% | Refuses it at the door. The only setting that actually stops the mail. |
DMARC is the record that decides this. SPF and DKIM only tell a receiving server whether a message passed a check; DMARC is what tells it to do something about a failure. A domain can publish a perfect SPF record and still be forgeable, because without a policy the usual answer to a failed check is to deliver the message anyway.
SPF, and we are not going to publish a figure for it.We collected it and then found we could not trust it. Resolving a domain's apex TXT record is much harder than resolving _dmarc: the answer is often large enough to need a second, slower query, and at the volume this sample requires those are the first lookups to be dropped.
We caught it by re-checking a random sample of domains our own run had recorded as having no SPF. Fourteen out of fourteen did have one. That is not a figure with a margin of error, it is a broken measurement, so there is no SPF number on this page and no SPF column in the CSV. A correct one needs a separate, slower pass and will appear in a future edition or not at all.
The same check run against DMARC found nothing wrong: zero of fourteen misreported, and zero of ten on an earlier run. That asymmetry is what makes the headline safe to quote and the SPF number not.
We also do not measure DKIM, for a different and permanent reason: a DKIM key lives at a selector chosen by the mail provider, selectors cannot be enumerated, and an adoption figure built from guessing selector names is a guess wearing a percentage sign.
Mailient (2026). "Email authentication of the top 50,000 domains, Q3 2026." Measured 5 September 2026 against Tranco list V367N. https://mailient.xyz/research/email-authentication-2026-q3
Each edition keeps its own URL permanently and is never edited after publication, so this citation will still resolve to these numbers after the next run.
Every figure here comes from public DNS, so all of it is independently verifiable. The per-domain results are published as a CSV: rank, domain, whether it receives mail, its SPF record and its DMARC policy.
The aggregate — the same counts and percentages shown above, plus the method fields — is also served as JSON at /research/email-authentication-2026-q3/data.json, so anything quoting a figure can take the method with it.
The same check, on one domain, in about two seconds. It shows what a forged email from your address would look like in a customer's inbox, and the exact DNS records that stop it.
Check your domain free