Original research.
Independent DNS scans of the public internet's email-authentication posture — methodology published, aggregates only, re-run annually. No customer data, ever.
Latest edition — 2026
n=8,907 · Tranco JZ2VYBeyond DMARC: The State of the Modern Email Security Stack (2026)
SPF and DMARC are going mainstream. MTA-STS, TLS-RPT, and BIMI are not — and almost nobody runs the complete stack. An original DNS scan of the Tranco top 10,000.
Read the full report →SPF + DMARC enforced + MTA-STS + TLS-RPT + BIMI, together — across all 8,907 resolved domains.
Up from a bare majority a few years ago — but adoption isn't the same as protection.
25% of domains with a DMARC record are monitor-only — visibility without enforcement.
The transport-security layer almost nobody has heard of, let alone deployed.
Brand logos in the inbox remain a small-minority feature, even among enforced domains.
Managed mailbox providers hit 87.5–95.5% adoption; self-managed mail servers sit at 28.7%.
The stack cliff — adoption by layer
Each layer is rarer than the last. SPF is near-universal; the full modern stack is all but nonexistent — 68.2% publish DMARC, yet 25% of adopters never leave monitor-only p=none.
What we measured
| DMARC | _dmarc.<domain> TXTPresence, policy (p=), pct=, sp=, rua=/ruf= presence |
|---|---|
| SPF | Root domain TXTPresence, all-qualifier (-/~/?/+), multiple-record detection |
| MTA-STS | _mta-sts.<domain> TXT, then HTTPS policy fetchDNS presence for all domains; policy mode fetched only for record-having domains |
| TLS-RPT | _smtp._tls.<domain> TXTPresence |
| BIMI | default._bimi.<domain> TXTRecord presence only (no VMC/SVG validation in this edition) |
| MX / mailbox provider | MX recordsBucketed into Microsoft, Google, Proofpoint, Mimecast, self-managed/other |
| DKIM (caveated) | Common selector probeLower-bound only — see limits. Excluded from headline stats. |
Get the data
The full aggregate dataset behind the 2026-07-01 snapshot is public. Cite it, chart it, or reproduce our numbers — attribution to DDMARC is all we ask.
Population: Tranco top 10,000
Resolved: 8,907 / 10,000 (89.1%)
Snapshot: Tranco JZ2VY · 2026-07-01
One edition so far — this scan re-runs annually. Future editions will list here, interlinked, so the year-over-year trend becomes its own story.