Skip to content
The DDMARC Research Desk
Original, public-data studies

Original research.

Independent DNS scans of the public internet's email-authentication posture — methodology published, aggregates only, re-run annually. No customer data, ever.

Latest edition — 2026

n=8,907 · Tranco JZ2VY

Beyond DMARC: The State of the Modern Email Security Stack (2026)

SPF and DMARC are going mainstream. MTA-STS, TLS-RPT, and BIMI are not — and almost nobody runs the complete stack. An original DNS scan of the Tranco top 10,000.

Read the full report →
0.7%
run the full stack
0.7%
Run the full modern stack

SPF + DMARC enforced + MTA-STS + TLS-RPT + BIMI, together — across all 8,907 resolved domains.

68.2%
Publish a DMARC record

Up from a bare majority a few years ago — but adoption isn't the same as protection.

1 in 4
DMARC adopters still at p=none

25% of domains with a DMARC record are monitor-only — visibility without enforcement.

2.6%
Publish an MTA-STS record

The transport-security layer almost nobody has heard of, let alone deployed.

9.5%
Publish a BIMI record

Brand logos in the inbox remain a small-minority feature, even among enforced domains.

3.3x
DMARC-adoption gap by host

Managed mailbox providers hit 87.5–95.5% adoption; self-managed mail servers sit at 28.7%.

The stack cliff — adoption by layer

Each layer is rarer than the last. SPF is near-universal; the full modern stack is all but nonexistent — 68.2% publish DMARC, yet 25% of adopters never leave monitor-only p=none.

SPF present
Basic sender authorization
76%
DMARC adopted
Any policy, including p=none
68.2%
DMARC enforced
p=quarantine or p=reject
49.9%
MTA-STS present
Transport-layer TLS enforcement
2.6%
Full modern stack
SPF + enforced DMARC + MTA-STS + TLS-RPT + BIMI
0.7%

What we measured

DMARC_dmarc.<domain> TXTPresence, policy (p=), pct=, sp=, rua=/ruf= presence
SPFRoot domain TXTPresence, all-qualifier (-/~/?/+), multiple-record detection
MTA-STS_mta-sts.<domain> TXT, then HTTPS policy fetchDNS presence for all domains; policy mode fetched only for record-having domains
TLS-RPT_smtp._tls.<domain> TXTPresence
BIMIdefault._bimi.<domain> TXTRecord presence only (no VMC/SVG validation in this edition)
MX / mailbox providerMX recordsBucketed into Microsoft, Google, Proofpoint, Mimecast, self-managed/other
DKIM (caveated)Common selector probeLower-bound only — see limits. Excluded from headline stats.

Get the data

The full aggregate dataset behind the 2026-07-01 snapshot is public. Cite it, chart it, or reproduce our numbers — attribution to DDMARC is all we ask.

Population: Tranco top 10,000
Resolved: 8,907 / 10,000 (89.1%)
Snapshot: Tranco JZ2VY · 2026-07-01

One edition so far — this scan re-runs annually. Future editions will list here, interlinked, so the year-over-year trend becomes its own story.