Source: EasyDMARC announcement, 4 November 2026.
Email authentication company EasyDMARC has released its Beyond DMARC: DNS Health & Resilience Report 2026, and the headline finding is uncomfortable reading for anyone who thinks their DMARC work is done. The company analyzed 30,000 domains, split between 15,000 domains managed by Managed Service Providers and 15,000 randomly selected domains from the broader internet, and found that DNS quality varies dramatically depending on who is looking after the records.
More than 40% of the randomly selected domains have at least one critical DNS issue. Among MSP managed domains the figure is below 15%. Over 95% of MSP managed domains keep clean, valid core DNS configurations, compared with roughly 70 to 75% of independently managed domains.
The report also shows how easily errors creep in. Around 30% of general domains contain syntax or structural problems such as duplicate TXT records or invalid entries, while fewer than 10% of MSP managed domains show the same issues. Redundancy is inconsistent too. Effective MX redundancy is implemented by approximately 81.1% of general domains and 86.62% of MSP managed domains, and only a smaller subset achieve genuinely independent, geographically distributed failover. Fewer than 65% of general domains meet baseline health and redundancy standards, versus more than 85 to 90% of MSP managed domains.
One finding cuts the other way. DNSSEC adoption stands at 6.99% among MSP managed domains, compared with 14.69% among general domains, which the company frames as a trade-off between operational stability and advanced DNS security.
Why This Matters for Email Authentication
Every protocol that protects your email lives in DNS. SPF is a TXT record. DKIM public keys are TXT records. DMARC is a TXT record. If those records are duplicated, malformed or unreachable, your authentication stops working, silently. Email that should pass SPF or DMARC starts failing, deliverability drops, and spoofed messages from your domain face fewer obstacles.
EasyDMARC CEO Gerasim Hovhannisyan put it plainly in the announcement: “Organizations have made significant progress in email authentication, but trust in email cannot be built on DMARC alone. DNS needs to be treated as an actively managed security and resilience layer, not a one-time configuration.”
The timing is deliberate. The full report becomes available for download on 9 November, and EasyDMARC will be at Web Summit 2026 in Lisbon from 9 to 12 November at stand #0303-44. Hovhannisyan will also speak on the panel “The Perimeter Is Dead. So What Happens to Trust?” on 12 November at Stage 8. The company, which says it protects more than 230,000 domains across 130 countries, recommends regular DNS audits, eliminating configuration errors, true redundancy and continuous monitoring.
The Takeaway for Senders
The lesson for any organization that sends email is simple. Setting up SPF, DKIM and DMARC once is not a finish line. Duplicate TXT records, broken nameservers or missing MX redundancy can undo your authentication posture while your dashboards still show green. Treat DNS as something you monitor, audit and maintain continuously, exactly as you treat your sending reputation.
If your DMARC enforcement is not delivering the protection you expected, the DNS layer beneath it is a good place to start digging. Sign up for free to Excello Mail and get your authentication, DNS and deliverability working as one system. (https://excello.email)