DMARC adoption and enforcement

Methodology

Source: Majestic Million (top 10,000), licensed CC BY 3.0, list dated 2026-09-24.

DNS lookups used a 10 s timeout with 2 tries, against the public resolvers 1.1.1.1 and 8.8.8.8.

Sample: 10,000 requested domains, scanned 2026-09-24. At least one record lookup succeeded for 9,975 domains. A domain counts as failed only when every record lookup failed; this occurred for 25 domains. Each record type's figures use the domains whose lookup for that record type succeeded as their denominator. DMARC policy, pct, and rua figures use the valid DMARC record subset. SPF lookups failed for 479 of 10,000 requested domains. DMARC lookups failed for 33 of 10,000 requested domains. MTA-STS lookups failed for 40 of 10,000 requested domains. TLS-RPT lookups failed for 44 of 10,000 requested domains. BIMI lookups failed for 40 of 10,000 requested domains. MX lookups failed for 60 of 10,000 requested domains.

SPF and DMARC use the same record classifiers as the free DNS checker. For this report, SPF “ok” means a published, syntactically valid SPF record under the local checks: one exact v=spf1 record with an all mechanism. Include and redirect targets were not resolved, so nested lookups and the ten lookup limit were not evaluated. The live checker separately warns when the root record alone exceeds ten lookup mechanisms. DMARC “ok” requires a recognized policy; enforcement means quarantine or reject. A published pct value describes the requested application percentage; an omitted pct is counted separately.

MTA-STS counts a valid policy identifier TXT record, not HTTPS policy retrieval or enforcement. TLS-RPT counts a reporting address TXT record. BIMI counts a default-selector HTTPS logo reference, not logo or certificate validation. MX provider labels follow hostname patterns; “mixed” has hosts in more than one bucket, “other” is unmatched, and “none” has no MX answer. The scan describes DNS publication at one point in time and does not establish mail delivery or sending volume.