DMARC adoption & enforcement 2026

According to Live Direct Marketing's daily Tranco top-1M scan (September 24, 2026), 476,253 domains publish a DMARC record — but only 47.04% of them actually enforce it with p=quarantine or p=reject. The rest publish p=none, which monitors but blocks nothing.

DMARC is the policy layer that ties SPF and DKIM together and tells receiving servers what to do when a message fails authentication. It is the single most important defense against exact-domain spoofing — and across the top 1M, its adoption tells a frustrating story: publishing is common, but enforcement is not.

The gap is the headline. A large share of domains publish a DMARC record, yet many of those records say p=none — monitor only, take no action. A record at p=none produces reports but blocks nothing, so the domain remains fully spoofable. Real protection begins only at p=quarantine and p=reject.

Policy split

DMARC by country (top 15)

DMARC by TLD (top 15)

From p=none to enforcement, safely

The reason so many domains stall at p=none is fear of blocking legitimate mail — and that fear is rational if you have not first inventoried your senders. The correct path is: publish p=none, read the aggregate reports until every legitimate source is SPF-aligned and DKIM-signed, then raise the policy to quarantine and finally reject. The country and TLD breakdowns below show where enforcement is ahead and where whole regions still leave their domains exposed.

Why enforcement, not publication, is the metric that matters

Counting domains that publish DMARC overstates real-world protection, because a monitoring record offers none. The honest metric is the enforcement rate — the share of DMARC domains at quarantine or reject — which is why it is the number we lead with and track over time.

Frequently asked questions