Market share

Email security barometer

How many popular websites protect their domain against email spoofing?

63%

of the top 100K websites publish a DMARC policy

40%

actually enforce it (quarantine or reject)

37%

have no DMARC record at all

DMARC policy — top 100K websites

RejectQuarantineMonitoring only (p=none)No DMARC

All

40% enforcedof 89,977

DMARC by popularity

RejectQuarantineMonitoring only (p=none)No DMARC

Top 1K

70% enforcedof 816

1K – 10K

52% enforcedof 7,857

10K – 100K

39% enforcedof 81,304

DMARC by email provider

RejectQuarantineMonitoring only (p=none)No DMARC

Google

52% enforcedof 19,991

Microsoft 365

61% enforcedof 12,834

78% enforcedof 2,996

69% enforcedof 1,462

21% enforcedof 1,149

30% enforcedof 990

25% enforcedof 863

11% enforcedof 655

1.1% enforcedof 635

51% enforcedof 606

69% enforcedof 466

16% enforcedof 423

39% enforcedof 12,054

DMARC by domain extension

RejectQuarantineMonitoring only (p=none)No DMARC

.com

42% enforcedof 40,876

.net

25% enforcedof 4,806

.org

41% enforcedof 4,327

.ru

42% enforcedof 3,260

.de

44% enforcedof 2,008

.jp

24% enforcedof 1,809

.io

42% enforcedof 1,477

.br

47% enforcedof 1,445

.uk

62% enforcedof 1,259

.in

46% enforcedof 1,239

.cn

11% enforcedof 1,199

.fr

44% enforcedof 980

.it

42% enforcedof 870

.edu

59% enforcedof 833

.co

44% enforcedof 755

SPF policy — top 100K websites

Hard fail (-all)Soft fail (~all)Neutral / open (?all, +all, none)No SPF

All

33% hard failof 89,977

Top 1K

48% hard failof 816

1K – 10K

38% hard failof 7,857

10K – 100K

32% hard failof 81,304

How this is measured

DMARC tells receiving mail servers what to do with a message that claims to come from a domain but fails authentication: nothing (p=none, monitoring only), send it to spam (quarantine) or refuse it (reject). Without an enforced policy, anyone can send email that looks like it comes from the domain. SPF lists the servers allowed to send mail for the domain; -all tells receivers to fail everything else, ~all to only mark it.

Base: every domain of the Tranco top 100K that resolves, whether it handles email or not — a domain that never sends mail should still publish p=reject. The provider view counts domains by the provider of their main MX record. Records resolved weekly; a policy applied to a percentage of messages only (pct) counts as its policy.