Anyone can put any domain in the From line of an email. Three DNS records decide whether the receiving server believes it. On October 10, 2026, an independent audit published on the DEV Community looked up the email DNS of the 1,000 most popular websites on the Tranco list and recorded what they actually published: their SPF, DMARC, BIMI and MTA-STS records, plus the mail hosts behind their MX entries. The result is a rare, verifiable snapshot of how the world’s most recognizable domains handle authentication, and the gap between publishing a record and actually enforcing it.
The headline numbers
Across the 1,000 domains, 84.5% publish a DMARC record, but only 69.4% enforce it with quarantine or reject applied to all mail, and 47.4% reject spoofed mail outright. The policy split was 474 domains at reject, 235 at quarantine and 136 at none. Another 155 domains had no DMARC record at all. Few hedged their rollouts: only 15 of the 845 records, or 1.8%, applied their policy to less than 100% of mail.
SPF is close to universal at 89.6% of domains, and of those 53.8% end with a hard fail of -all while 40.4% use the soft fail ~all. None of the 1,000 used +all, the setting that would let any server send as the domain.
Popularity correlates with protection, but not by much
Rank matters a little. Of the top 100 domains, 62% reject spoofed mail, against 45.8% of domains ranked 101 through 1,000. Enforcement rates were 76.0% for the top 100 and 68.7% for the rest. In other words, even among the internet’s most visited properties, more than one domain in four has either no DMARC policy or a monitor-only record that does nothing to stop spoofing.
Some very large names still sit at p=none, including samsung.com and yandex.ru, along with Microsoft’s consumer mail domains outlook.com, live.com and msn.com. For consumer mailbox domains, a monitor-only policy is often deliberate, because mailing lists and forwarding break authentication and a strict policy would bounce real mail. A company domain does not have that excuse.
The blind spot: domains that send no mail
The weakest point the audit found was the domains that accept no mail at all. Of the 875 domains with an MX record, most of the story is about protection. But 125 of the 1,000 have no MX record, meaning they never receive mail, and those are the easiest to forget. A domain that never sends mail can still be forged, and attackers like such domains precisely because nobody watches them.
The standard lockdown is two records: an SPF of v=spf1 -all, meaning no server may send, plus a DMARC policy of reject. Only 31 of the 125 non-mail domains, or 24.8%, have both. Meanwhile 76 of them, or 60.8%, have either no DMARC record or p=none. If you hold parked or non-sending domains, this is the cheapest security fix available to you today.
BIMI has taken off, MTA-STS has not
The audit found 21.3% of the 1,000 domains publish a BIMI record, the logo-in-the-inbox standard that requires an enforced DMARC policy, against only 4.5% for MTA-STS, the standard that forces encrypted delivery between mail servers. Brands are clearly moving first toward what subscribers can see, while the transport-layer protection that defenders cannot see lags far behind.
Who hosts the mail and who enforces
Of the 875 domains that accept mail, 37.3% use Google Workspace and 17.4% use Microsoft 365. Google-hosted domains enforce DMARC more often than Microsoft-hosted ones, at 82.2% versus 72.4%, while domains behind a security gateway such as Proofpoint, which filters 9.0% of all inbound mail in the sample, enforce it most often at 86.4%. The audit itself notes this is a correlation, not a cause: a company that buys a gateway and sets p=reject is likely to have a dedicated email security team either way.
Who actually reads the reports
DMARC aggregate reports are where enforcement begins, and 91.5% of the DMARC records audited ask for them, with 63.6% sending them to an outside analysis service. Counting each domain once per vendor, Valimail receives reports from 74 domains, Proofpoint from 71, dmarcian from 55, and a long tail of others including Cloudflare, Red Sift and Postmark. Thirteen domains send their reports to dhs.gov, the collection point used by US federal civilian agencies, and eleven of them are agencies such as nasa.gov and whitehouse.gov.
What this means for your domain
The biggest brands on the internet publish authentication at high rates, yet nearly a third still do not enforce it and roughly one in five has no DMARC record at all. That gap is exactly where spoofing lives. If your domain is still at p=none, you are in the same position as a consumer mailbox provider with none of the excuses. Review your aggregate reports, identify every legitimate sending service, and move your policy to quarantine and then reject. And if you hold domains that never send mail, lock them down with the two-record fix the audit found so few have applied.
The gap between publishing DMARC and enforcing it is where attackers do their best work. Excello Mail turns your DMARC, SPF and DKIM reports into a clear picture of everything sending as your domains, so you can move from monitoring to enforcement with confidence. Sign up for free to Excello Mail and close your authentication gap.