- 55.4% of 2.33 million company domains publish DMARC, but only 19.7% enforce it with quarantine or reject.
- Almost two in three DMARC records (64.3%) are p=none: monitoring only.
- 7.7% of company domains publish neither SPF nor DMARC.
- The mail provider matters most: 55.5% of Mimecast domains enforce DMARC, against 26.9% on Microsoft 365 and 10.7% on Google Workspace.
- Hosts that publish DMARC by default inflate adoption: 93.6% of IONOS domains have DMARC, and 96.0% of those records are p=none.
- BIMI, MTA-STS and TLS-RPT are each on under 1% of domains.
Since Gmail, Yahoo and Outlook began requiring authentication from bulk senders, most measurements of SPF and DMARC have looked at the world's most visited websites. This study looks at the domains B2B email is actually sent to and from: company domains. We read the public DNS records of 2,330,020 company domains that receive email between September 26 and October 26, 2026, and report what they publish.
How many company domains authenticate
| Records published | Domains | Share |
|---|---|---|
| SPF and DMARC | 1,217,932 | 52.3% |
| SPF only | 859,530 | 36.9% |
| DMARC only | 73,530 | 3.2% |
| Neither | 179,028 | 7.7% |
SPF is close to universal at 89.2%. DMARC trails at 55.4%, and more than a third of domains stop at SPF. A domain with SPF and no DMARC tells receivers which servers may send for it, but gives them no instruction for mail that fails, and gets no reports about who is sending in its name.
DMARC policies: most records only watch
| DMARC policy | Domains | Share of all domains |
|---|---|---|
| No DMARC record | 1,039,768 | 44.6% |
| p=none (monitor only) | 830,193 | 35.6% |
| p=quarantine | 265,187 | 11.4% |
| p=reject | 194,241 | 8.3% |
Only 19.7% of company domains tell receivers to quarantine or reject mail that fails authentication, which is 35.6% of the domains that publish DMARC at all. The rest leave spoofed mail to the receiver's judgment.
A small but telling group gets the record wrong: 1,841 domains publish a DMARC record whose policy is not one of the three valid values, including misspellings such as "quarantaine", "quarentine" and "quaratine", and translations such as "keine" and "ninguno". Receivers treat an invalid policy as no policy.
The mail provider makes the biggest difference
We grouped domains by the provider their MX records point to. The differences are larger than any other split in the data.
| Mail provider | Domains | DMARC published | DMARC enforced | p=none, of DMARC records | SPF published |
|---|---|---|---|---|---|
| Microsoft 365 | 658,011 | 58.8% | 26.9% | 54.1% | 98.1% |
| Google Workspace | 591,985 | 49.2% | 10.7% | 78.1% | 76.6% |
| IONOS | 70,102 | 93.6% | 3.7% | 96.0% | 97.4% |
| Hostinger | 37,525 | 83.3% | 2.4% | 97.1% | 98.5% |
| Zoho | 21,741 | 48.4% | 13.1% | 91.1% | |
| Proofpoint | 16,345 | 71.4% | 44.5% | 37.5% | 98.6% |
| Mimecast | 14,819 | 87.9% | 55.5% | 36.8% | 99.2% |
| Barracuda | 14,516 | 83.8% | 46.0% | 44.9% | 99.4% |
| Other and self-hosted | 841,515 | 52.7% | 21.3% | 59.4% | 89.4% |
Three patterns stand out.
- Security gateways go furthest. Domains behind Mimecast, Barracuda and Proofpoint enforce DMARC two to five times as often as the average, which fits organisations that have bought email security and staff to run it.
- Google Workspace domains lag. Fewer than half publish DMARC, 78.1% of those that do sit at p=none, and nearly one in four has no SPF record. SPF and DMARC are published at the domain's DNS host, not inside Workspace, so a team that set up Workspace and never went back to its DNS settings has neither.
- Default records inflate adoption. IONOS and Hostinger domains publish DMARC at 84% to 94%, but almost every record is p=none. Counting DMARC records alone would rank these hosts ahead of Microsoft 365 for protection, when they enforce least.
By country domain
| Top-level domain | Domains | DMARC published | DMARC enforced | SPF published |
|---|---|---|---|---|
| .com | 957,477 | 52.1% | 17.3% | 87.6% |
| .de | 198,017 | 62.3% | 27.4% | 87.3% |
| .org | 146,029 | 64.1% | 20.5% | 87.1% |
| .uk | 105,107 | 57.6% | 18.4% | 90.7% |
| .nl | 59,018 | 74.2% | 30.8% | 94.0% |
| .au | 45,802 | 56.3% | 20.7% | 91.3% |
| .pl | 45,791 | 60.9% | 27.4% | 98.6% |
| .se | 44,342 | 41.1% | 14.2% | 82.7% |
| .cz | 42,671 | 44.7% | 14.6% | 78.4% |
| .fr | 42,374 | 58.2% | 15.2% | 96.5% |
| .ch | 41,551 | 53.7% | 29.6% | 96.4% |
| .net | 39,349 | 49.6% | 17.2% | 87.8% |
Dutch domains lead on both measures, with three in four publishing DMARC and nearly a third enforcing it. Swedish and Czech domains trail. German, Polish and Swiss domains enforce well above the .com average.
BIMI, MTA-STS and TLS-RPT
| Standard | What it does | Domains | Share |
|---|---|---|---|
| BIMI | Shows the brand's logo next to authenticated mail | 7,803 | 0.49% |
| MTA-STS | Requires encrypted delivery to the domain | 11,380 | 0.71% |
| TLS-RPT | Asks receivers to report delivery encryption failures | 13,458 | 0.84% |
Shares are of the 1,600,140 domains that had the extended reading. BIMI requires DMARC at quarantine or reject, yet even among domains that meet that bar only 2.2% publish it.
What companies verify their domains with
Many services ask a customer to prove they own a domain by publishing a TXT record. Those records show which tools a company has connected. Of the 1,600,140 domains with the extended reading, 51.7% carried at least one.
| Service | Domains with its verification record | Share |
|---|---|---|
| 565,247 | 35.3% | |
| Microsoft | 340,911 | 21.3% |
| Apple | 66,148 | 4.1% |
| Brevo | 51,815 | 3.2% |
| Facebook (Meta) | 36,661 | 2.3% |
| Atlassian | 24,175 | 1.5% |
| OpenAI | 17,014 | 1.1% |
| Adobe | 13,854 | 0.9% |
| DocuSign | 9,827 | 0.6% |
| KnowBe4 | 8,734 | 0.5% |
What this means if you send email
- Your own domain is probably the weak link, not theirs. If you send in bulk, Gmail and Yahoo require SPF, DKIM and a DMARC record, and Outlook.com rejects bulk mail without them. Most companies have not gone past p=none, so a sender at quarantine or reject already stands in the top fifth.
- p=none is a starting point. It earns reports, not protection. Read the reports for a few weeks, fix the sources that fail, then move to quarantine and reject.
- Check the record you have. One typo in the policy makes the whole record count for nothing.
- On Google Workspace, check your DNS host. SPF, DKIM and DMARC live there, and setting up Workspace does not prove they were added.
To see where your domain stands, run the free DMARC analyzer or the domain health check, and build a record with the DMARC generator.
Method
- Sample. Company domains in SpamCipher's B2B company database that receive email, meaning they publish at least one MX record: 2,330,020 domains. Of 2,371,251 domains read, 41,231 had no MX record and are excluded.
- Readings. Each domain's most recent reading, taken from public DNS between September 26 and October 26, 2026: the SPF record at the domain, the DMARC record at _dmarc, and the MX records.
- Policy. The p= tag of the DMARC record. "Enforced" means quarantine or reject. Records with a policy value other than none, quarantine or reject count as published but invalid.
- Provider. Inferred from the MX hostnames. "Google Workspace" covers any domain whose mail Google receives; a domain can receive mail at one provider and send through others.
- Extended reading. BIMI, MTA-STS, TLS-RPT and verification records were read for 1,600,140 of the domains; their shares use that number.
- Limits. The sample reflects the companies in our database, not every registered domain, so it leans towards active businesses. DKIM is not measured, because its records sit at selectors that cannot be listed from DNS. No company is named, and no figure in this study is about a single domain.
For SPF and DMARC across the world's most visited websites, with a decade of earlier measurements, see our paper Email Authentication at Scale.
Use and cite this data
You are welcome to use these figures with attribution. Please cite: SpamCipher (2026). Email Authentication in 2026: DMARC and SPF Across 2.33 Million Company Domains. https://spamcipher.com/blog/email-authentication-b2b-domains-2026. The aggregate tables are available as a CSV file.
About SpamCipher
SpamCipher is an AI-powered sales engagement platform, B2B lead intelligence database, and email deliverability and security suite in one product. Its DMARC monitoring reads the reports receivers send about your domain, and its domain health checks watch SPF, DKIM, DMARC, alignment, BIMI, MTA-STS and TLS-RPT for every sending domain. Start the 30-day free trial.
Frequently asked questions
Protect your complaint rate
Verify your list and monitor your domain's authentication and reputation, all from one place.
Start free trial
