DMARC adoption rate: how many business domains actually enforce it
88.4% of the 499 business domains measured on 2026-09-05 publish a DMARC policy that does something: 70.3% at p=reject and the rest at p=quarantine. 1.2% publish no DMARC record at all. That is 0.4 percentage points up over the last 9 measurements, from 88% on 2026-08-10.
What this number is, and what it is not
On each measurement, Emailchaser resolves the DNS records of a fixed panel of 499 real business domains and reads what each one publishes: the DMARC policy at _dmarc, the SPF record at the apex, the MX hosts, and whether MTA-STS is present. On 2026-09-05, 499 of them resolved. There have been 10 measurements since 2026-08-10.
This measures recipients, not senders. It is the share of company domains that have told the world what to do with mail that fails authentication in their name. It is not a measure of how much mail gets delivered, and it is not Emailchaser customer sending data.
Read it as a floor on how much authentication matters. 88.4% of these domains will act on a DMARC failure. The other 11.6% publish nothing enforceable, which is not the same as being safe to spoof.
Enforcement is not the same as having a record
A DMARC record with p=none asks for reports and changes nothing about delivery. On 2026-09-05, 10.4% of measured domains sit at p=none, which is why "has DMARC" and "enforces DMARC" are different questions and why the headline number here only counts quarantine and reject.
SPF tells a similar story. 43.1% of measured domains end their SPF record in -all, a hard fail. 1% publish no SPF record at all.
What a sender should do about it
None of this changes because you are sending cold email rather than marketing email. Publish SPF, sign with DKIM, publish DMARC on your sending domain, and make sure both SPF and DKIM align with the domain in your From address. That is the entire authentication requirement Gmail, Yahoo and Microsoft ask bulk senders for.
The reason to watch the recipient side is that it tells you how normal enforcement has become. 88.4% of the domains you email have done this work on their own name, which is a fair signal of how many of them run email security actively. It is not a measure of what they do to your mail: that is judged against your records, not theirs.
Inbox Rules Index
Measured Saturday, 5 September 2026 across 499 real business domains, 10 measurements since 2026-08-10. On each measurement we look up the published email settings of the same 499 real companies, the kind you send cold email to. This is what they have set up, not a score on your own sending. It does not predict where your mail lands: that is judged against your own domain's records.
Other rules we measure
MTA-STS: 32 of 499 (6.4%) publish a policy, which asks sending servers to use valid TLS to reach them. SPF: 215 domains end their record in -all, 246 in ~all, 31 in ?all or no all term, and 5 publish no SPF record. DMARC: 351 at p=reject, 90 at p=quarantine, 52 at p=none, 6 with no record.
Whose spam filter your email meets
| Proofpoint | 33.9% | |
| Microsoft 365 | 26.1% | |
| Google Workspace | 18.8% | |
| Their own servers, or unknown | 9.6% | |
| Mimecast | 4% | |
| Cisco Secure Email | 3.8% |
Proofpoint screens about one in every 3 of these companies, more than any other filter. This is the software that reads your email before a person does. It says nothing about how any one of them treats your mail.
Which industries guard their name hardest (companies checked)
| Software (126) | 97.6% | |
| Finance (54) | 94.4% | |
| Services (28) | 92.9% | |
| Healthcare (47) | 89.4% | |
| Logistics (17) | 88.2% | |
| Retail (50) | 88% | |
| Travel (25) | 88% | |
| Energy (24) | 87.5% | |
| Media (26) | 84.6% | |
| Telecoms (30) | 80% | |
| Industrial (44) | 79.5% | |
| Schools and universities (28) | 57.1% |
Software guards its name hardest: 97.6% block mail faking their address. Schools and universities least, at 57.1%, a gap of 40.5 points. A high number means that industry runs email security tightly, so expect your own setup to be looked at more closely there.
The last 10 measurements
| Date | DMARC enforced | At p=reject | No DMARC | Strict SPF | Domains measured |
|---|---|---|---|---|---|
| 2026-09-05 | 88.4% | 70.3% | 1.2% | 43.1% | 499 |
| 2026-09-04 | 88.4% | 70.3% | 1.2% | 42.7% | 499 |
| 2026-09-03 | 88.4% | 70.3% | 1.2% | 42.7% | 499 |
| 2026-09-02 | 88.4% | 70.3% | 1.2% | 42.9% | 499 |
| 2026-09-01 | 88.4% | 70.3% | 1.2% | 42.9% | 499 |
| 2026-08-31 | 88.4% | 70.3% | 1.2% | 42.9% | 499 |
| 2026-08-28 | 88.4% | 70.3% | 1.2% | 42.7% | 499 |
| 2026-08-26 | 88.4% | 70.3% | 1.2% | 42.7% | 499 |
| 2026-08-15 | 88.1% | 70% | 1.2% | 42.9% | 497 |
| 2026-08-10 | 88% | 70.3% | 1.2% | 43.2% | 498 |
Measured by Emailchaser over public DNS, 10 measurements since 2026-08-10, on a fixed panel of 499 business domains. This measures the domains a sender emails. It is not Emailchaser customer sending data.
Download all measurements (JSON)Related questions
How many domains publish MTA-STS?
32 of the 499 business domains measured on 2026-09-05 (6.4%) publish an MTA-STS policy, which asks sending servers to deliver to them over valid TLS only. 351 of the same domains are at DMARC p=reject and 90 at p=quarantine.
What percentage of domains have a DMARC record?
98.8% of the 499 business domains measured on 2026-09-05 publish some DMARC record. Only 88.4% publish one set to quarantine or reject, which is the part that changes what happens to failing mail.
Is DMARC required for cold email?
Gmail, Yahoo and Microsoft all require bulk senders to publish DMARC and to align SPF or DKIM with the From domain. Publishing DMARC on your own sending domain is a requirement of sending, not a reaction to what recipients do. On 2026-09-05, 88.4% of measured recipient domains also enforced their own.
How often is this measured?
There have been 10 measurements since 2026-08-10, each one over public DNS on the same fixed panel of 499 domains. The measurements are not evenly spaced. Fixing the panel is what makes a comparison between two measurements mean something: a panel that changed composition would show movement that came from the list rather than from the internet.
Get each briefing in your inbox the morning it publishes
One email per briefing: what changed in mailbox provider rules, and the latest measurement from the Inbox Rules Index. Free, and one click to stop.
We use your address to send this briefing and nothing else. Unsubscribe from any email.