{
  "title": "Beyond DMARC: The State of the Modern Email Security Stack (2026)",
  "description": "An original DNS scan of the Tranco top 10,000 domains: 68.2% publish DMARC, but just 0.7% run the full email security stack. Data + methodology inside.",
  "url": "https://ddmarc.com/research/state-of-email-security-2026",
  "source": "Tranco top-10,000, snapshot JZ2VY, 2026-07-01",
  "publishedAt": "2026-07-04",
  "updatedAt": "2026-07-04",
  "license": "CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) — free to reuse, republish, and adapt with attribution to DDMARC and a link back to the source report.",
  "citation": "Source: DDMARC — https://ddmarc.com/research/state-of-email-security-2026",
  "methodology": {
    "population": "Tranco top 10,000",
    "snapshotId": "JZ2VY",
    "snapshotDate": "2026-07-01",
    "domainsResolved": 8907,
    "domainsAttempted": 10000,
    "coveragePct": 89.1,
    "dkimSelectorsProbed": [
      "default",
      "google",
      "selector1",
      "selector2",
      "k1",
      "s1"
    ],
    "dkimLowerBoundPct": 51
  },
  "overallStats": {
    "fullStackPct": 0.7,
    "dmarcAdoptionPct": 68.2,
    "dmarcAdopterPNoneSharePct": 25,
    "dmarcAdopterEnforcedSharePct": 73,
    "dmarcRuaConfiguredPct": 85.6,
    "dmarcSubdomainPolicyPct": 23.9,
    "spfPresentPct": 76,
    "spfHardFailSharePct": 50.1,
    "spfSoftFailSharePct": 44.5,
    "spfMultipleRecordsPct": 0.7,
    "mtaStsPresentPct": 2.6,
    "mtaStsEnforceModeSharePct": 53,
    "tlsRptPresentPct": 3,
    "bimiPresentPct": 9.5,
    "providerDmarcGapMultiple": 3.3
  },
  "dmarcPolicyDistribution": [
    {
      "key": "none-record",
      "label": "No DMARC record",
      "pct": 31.8
    },
    {
      "key": "p-none",
      "label": "p=none (monitor only)",
      "pct": 17.4
    },
    {
      "key": "p-quarantine",
      "label": "p=quarantine",
      "pct": 18.3
    },
    {
      "key": "p-reject",
      "label": "p=reject",
      "pct": 31.6
    },
    {
      "key": "malformed",
      "label": "Malformed / typo'd policy",
      "pct": 0.9
    }
  ],
  "stackFunnel": [
    {
      "key": "spf",
      "label": "SPF present",
      "pct": 76,
      "note": "Basic sender authorization"
    },
    {
      "key": "dmarc",
      "label": "DMARC adopted",
      "pct": 68.2,
      "note": "Any policy, including p=none"
    },
    {
      "key": "enforced",
      "label": "DMARC enforced",
      "pct": 49.9,
      "note": "p=quarantine or p=reject"
    },
    {
      "key": "mta-sts",
      "label": "MTA-STS present",
      "pct": 2.6,
      "note": "Transport-layer TLS enforcement"
    },
    {
      "key": "full-stack",
      "label": "Full modern stack",
      "pct": 0.7,
      "note": "SPF + enforced DMARC + MTA-STS + TLS-RPT + BIMI"
    }
  ],
  "byRankBand": [
    {
      "band": "1–1,000",
      "dmarcPct": 74,
      "spfPct": 76.9,
      "mtaStsPct": 3.2,
      "tlsRptPct": 4.2,
      "bimiPct": 16.9,
      "fullStackPct": 0.6
    },
    {
      "band": "1,000–5,000",
      "dmarcPct": 68.2,
      "spfPct": 75.5,
      "mtaStsPct": 2.7,
      "tlsRptPct": 3.3,
      "bimiPct": 10.3,
      "fullStackPct": 0.9
    },
    {
      "band": "5,000–10,000",
      "dmarcPct": 67.1,
      "spfPct": 76.2,
      "mtaStsPct": 2.4,
      "tlsRptPct": 2.6,
      "bimiPct": 7.4,
      "fullStackPct": 0.7
    }
  ],
  "byProvider": [
    {
      "provider": "Microsoft 365",
      "dmarcPct": 92.4,
      "spfPct": 99.2
    },
    {
      "provider": "Google Workspace",
      "dmarcPct": 87.5,
      "spfPct": 92.9
    },
    {
      "provider": "Proofpoint",
      "dmarcPct": 95.5,
      "spfPct": 97.1
    },
    {
      "provider": "Mimecast",
      "dmarcPct": 95.1,
      "spfPct": 97.5
    },
    {
      "provider": "Self-managed / no MX",
      "dmarcPct": 28.7,
      "spfPct": 29.9
    }
  ]
}