48.4% of 13,511 company domains enforce DMARC, and 27.0% publish no DMARC record at all.

27.8% of company domains tell receivers to reject forged mail, and 24.4% publish a policy that does nothing.

A DMARC record tells the world what to do with mail that fails authentication in a company's name. Only quarantine and reject change anything: 2,782 domains (20.6%) ask receivers to send failing mail to spam, and 3,754 (27.8%) ask them to refuse it.

3,303 domains (24.4%) publish p=none. That setting asks for reports and leaves delivery alone, which is why "has DMARC" and "enforces DMARC" are different questions: 73.0% of domains have a record, and 48.4% act on it.

3,645 domains (27.0%) publish nothing at _dmarc, and 27 publish a record that receivers cannot read, such as two DMARC records on one name. 8,141 of the 9,839 readable records (82.7%) name an address for reports.

Where does your own domain sit? The free DMARC checker reads your record and shows what it does to your mail, and the DKIM checker finds the key that backs it.

Google Workspace domains enforce DMARC at 44.6%, Microsoft 365 domains at 57.9%, and domains on other mail hosts at 32.3%.

We bucket each domain by the first mail server in its MX records. Microsoft 365 has 4,421 domains here and enforces DMARC 13.3 points more often than Google Workspace, which has 1,302.

2,526 domains (18.7%) send their mail through a security gateway first, and 74.0% of them enforce DMARC. A gateway sits in front of the mailbox, so the domain behind it can be on either Google or Microsoft.

1,154 domains have no MX record at all. Only 17.2% of those enforce DMARC, which pulls the overall figure down. Among the 12,357 domains that do list a mail server, 51.3% enforce it.

The free MX lookup shows who handles the mail of any domain, in the same groups.

Banking, insurance and investing leads on DMARC enforcement at 66.4%, and media and entertainment trails at 42.8%.

The gap between the first and last industry is 23.6 points. The industry comes from the company's record on Wikidata, and 3,825 domains have no usable industry, so they appear in the totals and in no industry bar.

The industries with the most domains are banking, insurance and investing (1,451), manufacturing and industry (1,312), software and technology (1,157).

Companies in the United States and Canada enforce DMARC most often at 69.0%, and companies in Asia and Pacific least often at 29.8%.

2,924 of the domains (21.6%) belong to US companies, and 70.4% of those enforce DMARC, with 46.5% at p=reject and 11.7% with no record. The US figure is the closest match for a sender whose prospects are American.

The list follows where companies list their shares. The three countries with the most domains are United States (2,924), Japan (2,189) and People's Republic of China (1,170), and together they hold 46.5% of the list. The country bars show every country with at least 150 domains.

Companies with 10,000 or more employees enforce DMARC at 71.5%, against 53.7% for companies with under 1,000.

Wikidata records a headcount for 1,924 of the domains, so the size bars describe those and not the whole list. The gap is 17.8 points between the largest and the smallest group.

47.3% of company domains end their SPF record in -all, and 3.1% of SPF records need more than 10 DNS lookups.

SPF lists the servers allowed to send for a domain, and its last term says what to do with the rest. 6,391 domains (47.3%) end in -all, a hard fail. 5,487 (40.6%) end in ~all, a soft fail. 353 (2.6%) end in ?all or +all, redirect somewhere else, or have no all term. 1,205 (8.9%) publish no SPF record.

Receivers stop reading an SPF record after 10 DNS lookups and treat it as an error. We counted the lookups in each record, following every include, and 376 of the 12,231 records go over.

654 domains (4.8%) publish a BIMI record, the setting that shows a brand logo beside mail in some inboxes, and 287 (2.1%) publish an MTA-STS record, which asks senders to deliver over valid TLS only. 2,206 domains (16.3%) pair p=reject with an SPF record ending in -all.

The free SPF checker shows how your own record ends and how many of the 10 DNS lookups it uses.

The 498 domains we measured in September 2026 enforce DMARC at 88.2% today, against 88.4% then, and the other 13,013 domains sit at 46.9%.

Our earlier study read a fixed panel of well-known business domains on 5 September 2026. This edition measures the same 498 domains again as part of the larger list. On those domains DMARC enforcement is down 0.2 points: 3 tightened their policy, 2 loosened it and 493 did not change it.

The panel is made of large, well-known companies, and it enforces DMARC 41.3 points more often than the rest of the list. A study of famous domains alone would overstate how common enforcement is among companies in general.

These free tools check your own domain against the same records.