01Key findings
DMARCis now the norm: 82.9% of the domains that receive mail publish a record, and 60.9% ask receivers to quarantine or reject failing mail. 21.8% stay at p=none.- 93.2% publish
SPF. Softfail (~all) and fail (-all) endings are close to even, at 44.2% and 43.2%. - We found a
DKIMkey at a common selector for 65.0%. 46.0% have all three: oneSPFrecord, aDKIMkey, andDMARCat enforcement. - Transport security is rare. 4.0% publish MTA-STS and 4.5% TLS-RPT. BIMI, the brand logo record, is at 13.2%.
- Google Workspace receives mail for 34.2% of these domains and Microsoft 365 for 15.7%, going by their MX records.
02Adoption by record
The first column counts only domains that receive mail, where the records matter most. The second counts every domain we measured.
| Record | Domains that receive mail (7,252) | All domains (9,999) |
|---|---|---|
SPF One or more v=spf1 TXT records at the domain | 93.2% 6,760 domains | 75.4% 7,535 domains |
DMARC A v=DMARC1 record at _dmarc | 82.9% 6,013 domains | 67.4% 6,743 domains |
DMARC at enforcement p=reject, or p=quarantine outside t=y test mode | 60.9% 4,417 domains | 50.4% 5,041 domains |
DKIM A non-empty key at one of 13 common selectors (an empty p= is a revoked key) | 65.0% 4,715 domains | 47.9% 4,785 domains |
SPF, DKIM and enforced DMARC One SPF record, a DKIM key found, and DMARC at enforcement | 46.0% 3,338 domains | 33.7% 3,365 domains |
BIMI A v=BIMI1 record at default._bimi | 13.2% 958 domains | 9.7% 973 domains |
TLS-RPT A v=TLSRPTv1 record at _smtp._tls | 4.5% 324 domains | 3.3% 325 domains |
MTA-STS A v=STSv1 record at _mta-sts | 4.0% 287 domains | 2.9% 289 domains |
03DMARC policies
The p= tag says what receivers should do with mail that fails DMARC.
| DMARC record | Domains that receive mail (7,252) | All domains (9,999) |
|---|---|---|
p=reject Receivers are asked to refuse failing mail | 35.1% 2,546 domains | 31.2% 3,122 domains |
p=quarantine Receivers are asked to treat failing mail as suspicious | 25.8% 1,873 domains | 19.2% 1,921 domains |
p=none Monitoring only, no action asked. A record without p= counts here | 21.8% 1,578 domains | 16.8% 1,683 domains |
Invalid Several DMARC records, or a p= value that is not a policy | 0.2% 16 domains | 0.2% 17 domains |
No DMARC record Nothing at _dmarc | 17.1% 1,239 domains | 32.6% 3,256 domains |
Asks for aggregate reports A rua= address in the record | 72.2% 5,233 domains | 58.1% 5,808 domains |
Legacy pct= below 100 An enforced record that still sets pct=, which RFC 9989 removed. Receivers may ignore it | 1.7% 126 domains | 1.4% 135 domains |
Test mode t=y with quarantine or reject: receivers apply one step lower, so quarantine in test mode is not counted as enforced | 0.0% 2 domains | 0.0% 2 domains |
04How SPF records end
The last term of an SPF record decides what happens to mail from a server it does not list. Only domains with exactly one SPF record are counted.
| Ending | Domains that receive mail (7,252) | All domains (9,999) |
|---|---|---|
-all (fail) Mail from servers not listed should be rejected | 43.2% 3,131 domains | 37.6% 3,762 domains |
~all (softfail) Mail from servers not listed is suspicious | 44.2% 3,205 domains | 33.2% 3,320 domains |
?all (neutral) No statement about other servers | 2.0% 144 domains | 1.6% 158 domains |
+all or all (pass) Any server may send for the domain | 0.0% 3 domains | 0.0% 3 domains |
No all term Often a redirect= to another record | 3.1% 228 domains | 2.4% 238 domains |
Several SPF records SPF returns a permanent error | 0.7% 49 domains | 0.5% 54 domains |
05Who hosts the mail
Among the domains that receive mail, by the host their MX records name.
| Mail host, from the MX records | Share (7,252 domains) | MX hosts per |
|---|---|---|
Google Workspace | 34.2% 2,477 domains | Google Workspace docs |
Microsoft 365 | 15.7% 1,138 domains | Microsoft 365 docs |
Mimecast Filtering gateway; the mailbox host is behind it | 1.9% 140 domains | Mimecast docs |
Cloudflare Email Routing Forwarding service; the inbox is elsewhere | 1.6% 113 domains | Cloudflare Email Routing docs |
Amazon WorkMail or SES | 1.4% 103 domains | Amazon WorkMail or SES docs |
Cisco Secure Email Filtering gateway; the mailbox host is behind it | 1.0% 69 domains | Cisco Secure Email docs |
Yandex 360 | 0.9% 67 domains | Yandex 360 docs |
Zoho Mail | 0.9% 63 domains | Zoho Mail docs |
Proton Mail | 0.5% 33 domains | Proton Mail docs |
GoDaddy Professional Email | 0.3% 25 domains | GoDaddy Professional Email docs |
Fastmail | 0.3% 23 domains | Fastmail docs |
Namecheap Private Email | 0.3% 20 domains | Namecheap Private Email docs |
Barracuda Email Gateway Defense Filtering gateway; the mailbox host is behind it | 0.2% 15 domains | Barracuda Email Gateway Defense docs |
Rackspace Email | 0.2% 15 domains | Rackspace Email docs |
OVHcloud | 0.1% 9 domains | OVHcloud docs |
Proofpoint Essentials Filtering gateway; the mailbox host is behind it | 0.1% 8 domains | Proofpoint Essentials docs |
Gandi | 0.1% 7 domains | Gandi docs |
ImprovMX Forwarding service; the inbox is elsewhere | 0.1% 6 domains | ImprovMX docs |
IONOS | 0.1% 5 domains | IONOS docs |
mailbox.org | 0.1% 4 domains | mailbox.org docs |
iCloud Mail | 0.0% 3 domains | iCloud Mail docs |
Infomaniak | 0.0% 2 domains | Infomaniak docs |
Migadu | 0.0% 2 domains | Migadu docs |
Hostinger Email | 0.0% 1 domains | Hostinger Email docs |
Servers named after the domain Run by the owner, or a provider behind a custom host name | 15.2% 1,099 domains | |
Not identified A host we could not match to a provider's own documentation | 24.9% 1,805 domains |
06Domains without mail
Of every domain measured. A null MX states that the domain takes no mail.
| MX records | Domains |
|---|---|
| Publish MX records | 72.5% 7,252 domains |
| Publish a null MX (accept no mail) | 0.8% 76 domains |
| Publish no MX record | 26.6% 2,659 domains |
| MX lookup failed | 0.1% 12 domains |
07DKIM selectors we found
A domain often publishes several. Shares are of the domains that receive mail.
| Selector | Domains with a key |
|---|---|
28.9% 2,097 domains | |
| s1 | 27.9% 2,023 domains |
| s2 | 27.0% 1,960 domains |
| selector1 | 18.8% 1,361 domains |
| k1 | 11.3% 820 domains |
| k2 | 11.2% 811 domains |
| selector2 | 10.6% 772 domains |
10.2% 737 domains | |
| default | 8.9% 645 domains |
| dkim | 3.5% 254 domains |
| fm1 | 0.6% 40 domains |
| protonmail | 0.4% 29 domains |
| sig1 | 0.1% 4 domains |
08Method
We took the top 10,000 domains of Tranco list 7462X, created on October 31, 2026. It averages several popularity rankings from 2026-10-02 to 2026-10-31 and keeps only pay-level domains. 1 entry was not a valid host name and left out, which leaves 9,999 domains.
On November 1, 2026, over about 4 minutes, we asked public DNS-over-HTTPS resolvers (Google Public DNS, Cloudflare 1.1.1.1, AdGuard DNS (unfiltered)) for each domain's MX and TXT records, and for TXT records at _dmarc, _mta-sts, _smtp._tls, default._bimi, and 13 DKIM selectors: google, selector1, selector2, k1, k2, s1, s2, default, dkim, mail, sig1, protonmail, fm1. Each query had 5 seconds and up to 3 attempts, each on the next resolver.
"Domains that receive mail" (7,252) publish at least one MX record that is not a null MX. We name the mail host from the MX records with the table behind our email provider lookup, where each provider is matched only on host names its own documentation gives.
The script is scripts/email-auth-adoption-study.ts in the Shipmail repository. It keeps the per-domain answers outside the repository and writes only the totals, which you can download as JSON above. Run it with --list-id 7462X to repeat the measurement; DNS answers change, so a new run will differ slightly.
09Limits
- DKIM is a lower bound. A domain can sign with any selector name, and we only tried 13 common ones.
- We read DNS only. A record that exists may still be wrong in ways DNS does not show, and we did not fetch MTA-STS policy files or BIMI logos, or send any mail.
- Popular domains are not typical domains. Many top sites are large companies, and some are content networks or API hosts that never send mail.
- The MX host names the server that receives mail. When a filtering gateway sits in front of the mailbox, we count the gateway, not the mailbox host behind it. We name a host only when its provider's own documentation lists it, so some large services, such as gateways whose host names we could not confirm, count as not identified.
- Some lookups failed after every attempt: MX for 12 domains, DMARC for 17, and at least one DKIM selector for 47. A failed lookup counts as no record, except MX: those domains are left out of the domains that receive mail. 10 domains did not exist in DNS at all.