The State of Email Authentication 2026
Email deliverability statistics from an original DNS scan of the top 10,000 domains — DMARC, SPF, MX, MTA-STS, TLS-RPT and BIMI adoption, with a top 1,000 vs rest breakdown.
We scanned the top 10,000 domains (Tranco, 2026-06-22): 33.4% have no DMARC record, and of those that do, only 46.5% enforce it. 91.1% have no BIMI record and 97.8% no MTA-STS policy.
Key findings
Download the data: CSV or JSON. Free to reuse under CC BY 4.0 with attribution to Relaymetry. Every figure on this page derives from this single dataset; see the methodology below.
Top 1,000 vs the rest of the top 10,000
The most-visited domains are better configured than the long tail — but the gap is smaller than you might expect, and even the top 1,000 leave real headroom.
| Control | Top 1,000 | Rest of top 10k |
|---|---|---|
| No DMARC record | 28.4% | 34% |
| DMARC enforced (p=reject, of adopters) | 60.2% | 44.9% |
| Has a BIMI record | 15.7% | 8.2% |
| No MTA-STS policy | 96.9% | 97.9% |
DMARC policy — of 6,619 adopters
Only 6,619 of 9,999 domains publish a DMARC record. Of those, the policy breakdown is:
Methodology
Population: Tranco top-10,000 (daily-2026-06-22). N: 9,999 domains. Date: 2026-06-22. Resolvers: Cloudflare (1.1.1.1) and Google (8.8.8.8). 68 domains excluded due to resolver errors.
Each domain was queried for MX, SPF (TXT), DMARC (_dmarc.), MTA-STS (_mta-sts.), TLS-RPT (_smtp._tls.) and BIMI (default._bimi.) records. A domain is counted as “missing” a control when the relevant record is absent or unparseable. DKIM and blacklist presence are out of scope (DKIM requires a per-domain selector; blacklist adds per-IP noise beyond DNS-record presence). DNSSEC is planned for a future update. Refreshed monthly; the figures above reflect the 2026-06-22 scan.
Cite this report
Free to reuse under CC BY 4.0 with attribution. Copy the citation:
Relaymetry. "The State of Email Authentication 2026." Original DNS scan of the top 10,000 domains (Tranco), 2026-06-22. https://relaymetry.com/email-deliverability-statisticsFrequently asked
What percentage of domains have no DMARC record?
33.4% of the top 10,000 domains (Tranco, scanned 2026-06-22) publish no DMARC record. It is lower among the top 1,000 (28.4%) than across the rest of the top 10,000 (34%).
How many domains enforce DMARC with p=reject?
Of the 6,619 domains that publish DMARC, 46.5% use p=reject (full enforcement), 27% use p=quarantine, and 26% sit at p=none (monitoring only, no enforcement).
What share of domains use MTA-STS?
Only 2.2% — 97.8% of the top 10,000 domains publish no MTA-STS policy. Of the few that do, 59% are in enforce mode and 40.5% in testing mode.
How many domains have a BIMI record?
8.9% — 91.1% have no BIMI record. Adoption is roughly twice as high among the top 1,000 domains (15.7%) as across the rest (8.2%).
Do DMARC adopters collect aggregate (rua) reports?
86% of domains that publish DMARC include a rua= address to receive aggregate reports — the rest get no visibility into who is sending as their domain.
Learn more
- How SPF, DKIM, and DMARC work — the canonical guide to email authentication on DNS.
- No DMARC record? Here’s what it means — the 33.4% of domains above, explained.
- Moving DMARC from p=none to p=reject — how to join the 46.5% that enforce.
- Check your domain’s DMARC record — free, no signup required.
- Read your DMARC aggregate (rua) reports — paste a real report and see who sends as your domain.