Datazag research · Published 16 October 2026
25.3% of domains publish DMARC. Only 13.1% enforce it.
DMARC is how a domain tells the world’s mail servers what to do with mail that pretends to come from it. Publishing a DMARC record is easy. Telling receivers to block the fakes is the step that protects anyone. We checked every resolving, unparked domain: about half of the domains that publish DMARC stop at the first step.
- Population
- 327,769,422 resolving, unparked domains
- Method
- census, not a sample
- Census taken
- 1 October 2026
- Grain
- domain, not organization
Adoption is not protection
A DMARC record carries a policy. p=none asks receivers to send reports about mail that fails the checks, and to deliver it anyway. p=quarantine and p=reject ask them to put that mail in spam or refuse it. Only the last two stop someone sending mail as your domain.
327.7 million resolving, unparked domains
Across this population, 51.9% of the domains that publish DMARC enforce it. The rest are watching, not blocking. p=none is a sensible first step while an organization finds all the services that send its mail. It is not meant to be where a domain stays.
For domains that run mail, the gap is wider
The population above includes many domains that send no mail at all. A domain like that often publishes p=reject on purpose, so no one can send as it, or because its registrar set it by default. That lifts the enforcement figure without protecting anyone’s real mail.
So we also measured the 114,088,692 domains that actually run mail: they resolve, are not parked, have an address record (A), a working mail server and an SPF record. Among them, 45.4% publish DMARC, but only 14.9% enforce it. That is 32.9% of publishers. Report-only policies outnumber enforcing ones by about two to one (30.4% against 14.9%).
Our report Who Really Runs Business Email? puts enforcement at 14.2%. It counts a different group: mail domains run by a named provider, in the Observatory snapshot of 8 October 2026. The 14.9% here covers every domain that runs mail, measured on 1 October 2026. The two figures are close, but they are different measurements.
Why the two populations disagree
In Germany, 18.1% of resolving, unparked domains publish p=reject, but only 5.9% of the domains that run mail do. Much of the high figure is defensive: domains that send nothing, closed to spoofing. Each figure on this page names its population, and the two are never mixed in one claim.
| Record | Resolving, unparked | Domains that run mail |
|---|---|---|
| SPF published | 42.69% | 100% (by definition) |
| SPF ends in -all | 14.32% | 26.02% |
| DMARC published | 25.31% | 45.37% |
| DMARC enforcing (quarantine or reject) | 13.13% | 14.92% |
| of which p=reject | 6.18% | 6.29% |
| of which p=quarantine | 6.95% | 8.62% |
| DMARC p=none (reports only) | 12.17% | 30.44% |
| DMARC reporting address (rua) | 10.65% | 14.57% |
| MTA-STS enforcing | 0.044% | 0.106% |
| DNSSEC signed | 8.83% | 10.60% |
| BIMI published | 0.053% | 0.136% |
Where enforcement is high, and where it is not
The share of domains that enforce DMARC varies more than tenfold between countries. Market is the last part of the domain name, so .co.uk counts as the United Kingdom. Rankings include markets of at least 200,000 domains.
| Market | Enforcing |
|---|---|
| Netherlands | 33.3% |
| Switzerland | 32.0% |
| India | 29.2% |
| Poland | 27.1% |
| Norway | 24.9% |
| Germany | 21.6% |
| Brazil | 21.2% |
| Market | Enforcing |
|---|---|
| South Korea | 2.1% |
| Russia | 3.6% |
| Iran | 4.0% |
| Vietnam | 4.0% |
| Ukraine | 4.8% |
| Italy | 5.8% |
| Indonesia | 6.1% |
| Market | Publish DMARC | Enforce it |
|---|---|---|
| Germany | 46.5% | 21.6% |
| Italy | 45.6% | 5.8% |
| France | 37.2% | 13.7% |
| United Kingdom | 33.3% | 14.4% |
| Australia | 30.8% | 16.0% |
| United States (.us) | 22.1% | 13.3% |
Italy shows the gap most clearly. Nearly half of Italian domains publish DMARC, and fewer than one in seventeen enforce it. Among Italian domains that run mail, 60.9% publish; 55.6% are p=none, and 5.3% enforce.
| Market | Enforcing |
|---|---|
| Denmark | 36.2% |
| Switzerland | 35.2% |
| Poland | 33.7% |
| Norway | 32.9% |
| Netherlands | 28.0% |
| India | 25.7% |
| Slovakia | 24.3% |
| Market | Enforcing | Note |
|---|---|---|
| Italy | 5.3% | 60.9% publish; 55.6% are p=none |
| Japan | 5.6% | |
| Russia | 6.7% | |
| Iran | 7.2% | |
| Hungary | 8.4% | |
| Argentina | 9.0% | 67.2% publish |
For domains that run mail in the largest markets: the United Kingdom publishes at 52.7% and enforces at 14.5%; Germany at 54.1% and 10.9%; .com at 42.6% and 15.1%.
The rest of the stack is thinner still
DMARC rests on SPF and DKIM, and newer standards build on top of it. Their adoption falls away quickly.
Resolving, unparked domains
SPF ending in -all tells receivers to reject mail from any server not on the list. A third of the domains that publish SPF go that far. MTA-STS, which forces encrypted delivery to the domain, and BIMI, which puts a brand logo beside authenticated mail, are each below one domain in a thousand.
DNSSEC follows the registry
DNSSEC is high where the registry makes it cheap or automatic: Denmark 71.1%, Czechia 69.0%, Sweden 63.8%, the Netherlands 63.3%. It is low in the United Kingdom (4.6%), Germany (3.7%) and Australia (2.3%).
These figures describe each territory’s estate and its registry’s policy and pricing, more than any organization’s choice.
How this was measured, and what it does not show
Every figure comes from records the domains themselves publish in DNS. Nothing is surveyed or self-reported.
This is a census, not a sample: every domain in the Datazag corpus that meets the population definition, read on 1 October 2026. Each value is that domain’s latest observation. The corpus is re-resolved on a rolling cycle of roughly 30 to 45 days, so the census was taken on one day, but not every domain was checked that day.
- Resolving, unparked domains: registrable domains that resolved at their latest observation and are not detected as parked. Some parked domains held for sale are missed by that detection and remain in; the effect on these rates is not measured.
- Domains that run mail: the same, plus an address record (A), a working mail server (a null MX does not count) and an SPF record.
- Enforcing means p=quarantine or p=reject, read from the DMARC record’s policy tag.
- Domains, not organizations. One organization may hold many domains, each with its own records.
- Markets use the last label of the registrable domain. Country-code domains sold for generic use (.co, .io, .ai, .me, .tv) are left out of rankings, because they say nothing about a territory.
- Three more are left out, each for a stated reason. .cc and .sh are country codes, but they are used the way generic domains are: only 7.6% and 5.2% of their resolving, unparked domains publish SPF, against 42.7% across all resolving, unparked domains. .cn is a real territory, but most of its resolving domains send no mail (5.5% publish SPF), so its DMARC rates would mostly describe domains that do not send mail, rather than how Chinese organizations protect their mail.
- No trend. This is one census. Movement over time is not claimed here.
The Datazag Observatory tracks the main rates daily: DMARC published, DMARC enforced, p=none and SPF published. Its daily figures use their own measurement window and can differ slightly from this census.
Check the domains you care about
The same records, per domain: which of your domains, your customers’ or your clients’ publish DMARC, which enforce it, and which only report. Each finding shows the record it was read from.
Census taken 1 October 2026 from the Datazag DNS corpus. Resolving, unparked domains: 327,769,422. Domains that run mail: 114,088,692. Each value is the domain’s latest observation. Shares describe numbers of domains; they are not statements about how much mail any domain sends or receives.