During Cybersecurity Awareness Month, an independent project called Defaults Exposed published the October 2026 edition of its Domain Security Census. It scanned 632,901,201 domain names drawn from ICANN zone files, OpenINTEL and CommonCrawl on October 11 and 12, found 361,301,790 of them existing, and graded 332,492,319 on the email authentication, DNS and web security settings they publish. The aggregate data was released openly on Zenodo under a Creative Commons Attribution 4.0 licence, with tables also on Kaggle and Hugging Face. That openness matters. DMARC adoption figures usually arrive wrapped in a vendor’s marketing. This time every number can be recounted by anyone.
The headline numbers
The census found 83,466,694 domains publishing a DMARC record, which is 25.1 percent of all graded domains. Of those publishers, 39,758,587 enforce their policy with p=quarantine or p=reject, or 47.6 percent of domains with a record. The strictest setting, p=reject, is published by 18,601,119 domains. That is the setting that tells receiving mail servers to refuse email falsely claiming to come from the domain, and it covers well under six percent of the graded internet.
The supporting layers tell the same story. 157,065,571 domains publish an SPF record, but only 61,408,709 end it with the strict -all qualifier. Where the census could check for DKIM, 50.5 percent of domains publish a signing key. Only 32,980,787 domains ask for DMARC aggregate reports, which means most of the domains that do publish a record have no visibility into who is failing authentication as them.
The enforcement gap is the story
A DMARC record with p=none is a monitoring policy, not a defense. It tells receivers to deliver forged mail as normal and just send the owner a report. The census shows that this is the majority position even among organizations that bothered to publish a record at all. More than half of DMARC publishers have never moved past the observation phase.
For email marketers the gap is also a deliverability problem, not only a security one. Gmail has required SPF and DKIM from bulk senders since February 2024, and Outlook.com has required a passing DKIM signature from senders at volume since May 2025. A quarter of the graded web still publishes no DMARC record, and every one of those domains can be forged freely by anyone running a phishing campaign or invoice fraud attempt against its customers.
A baseline you can check yourself
Because the full aggregate data is public, these figures can serve as an honest baseline. Among top-level domains with at least 500,000 graded domains, .nl has the highest share scoring above F at 58.6 percent, followed by .ch at 58.2 percent. Of the 10,000 most visited domains, the 9,840 the census could grade average a score of 66, against 47 for all graded domains. Large, well-run sites do better, but even that average leaves enormous room for forged mail.
The practical takeaway for any sender is simple. Publishing the record is the first quarter of the job. Moving to quarantine, then reject, and reading your aggregate reports is the rest. Excello Mail shows you every source sending as your domains and guides you from p=none to p=reject without breaking legitimate mail. Sign up for free to Excello Mail and find out which side of the census your domains are on.