DMARC adoption rate: how many business domains actually enforce it
88% of the 498 business domains measured on 2026-08-10 publish a DMARC policy that does something: 70.3% at p=reject and the rest at p=quarantine. 1.2% publish no DMARC record at all. This is the first day of the series, so there is no trend to report yet.
What this number is, and what it is not
Every day, Emailchaser resolves the DNS records of a fixed panel of 499 real business domains and reads what each one publishes: the DMARC policy at _dmarc, the SPF record at the apex, the MX hosts, and whether MTA-STS is present. On 2026-08-10, 498 of them resolved.
This measures recipients, not senders. It is the share of company domains that have told the world what to do with mail that fails authentication in their name. It is not a measure of how much mail gets delivered, and it is not Emailchaser customer sending data.
Read it as a floor on how much authentication matters. 88% of these domains will act on a DMARC failure. The other 12% publish nothing enforceable, which is not the same as being safe to spoof.
Enforcement is not the same as having a record
A DMARC record with p=none asks for reports and changes nothing about delivery. On 2026-08-10, 10.8% of measured domains sit at p=none, which is why "has DMARC" and "enforces DMARC" are different questions and why the headline number here only counts quarantine and reject.
SPF tells a similar story. 43.2% of measured domains end their SPF record in -all, a hard fail. 1% publish no SPF record at all.
What a sender should do about it
None of this changes because you are sending cold email rather than marketing email. Publish SPF, sign with DKIM, publish DMARC on your sending domain, and make sure both SPF and DKIM align with the domain in your From address. That is the entire authentication requirement Gmail, Yahoo and Microsoft ask bulk senders for.
The reason to watch the recipient side is that it tells you how much slack there is. When 88% of the domains you email enforce a policy, an unauthenticated send is not a slow leak, it is a wall.
Related questions
What percentage of domains have a DMARC record?
98.8% of the 498 business domains measured on 2026-08-10 publish some DMARC record. Only 88% publish one set to quarantine or reject, which is the part that changes what happens to failing mail.
Is DMARC required for cold email?
Gmail, Yahoo and Microsoft all require bulk senders to publish DMARC and to align SPF or DKIM with the From domain. Publishing DMARC on your own sending domain is a requirement of sending, not a reaction to what recipients do. Today 88% of measured recipient domains also enforce their own.
How often is this measured?
Once a day, over public DNS, on the same fixed panel of 499 domains. Fixing the panel is what makes the day-over-day comparison mean something: a panel that changed composition would show movement that came from the list rather than from the internet.
Get this in your inbox every morning
One email a day: what changed in mailbox provider rules overnight, and the day's DMARC measurement. Free, and one click to stop.
We use your address to send this briefing and nothing else. Unsubscribe from any email.