How much published DMARC is actually enforced?

50.3% of DMARC records ask receivers to take no action

The majority position among domains that have published a record at all is p=none; 49.6% ask for quarantine or rejection. A published record is not the same as a defended domain.

DMARC policy, where a record exists

Share of DMARC-publishing domains by policy tag.

Source: Datazag corpusas of 2026-09-2488.2M domains publishing DMARC
62.57%

of mail-operating domains that publish DMARC set it to p=none

41,759,698 of 66,743,931 mail-operating domains publishing DMARC

Source: Datazag · as of 2026-09-24

What is email authentication?

Domains that send mail are worse at enforcement than domains that do not

62.6% of mail-operating publishers sit at p=none, against 12.2% of publishers with no mail. Enforcement only costs anything when there is live mail to break, so operators with mail stall at p=none and operators without it go straight to enforcement.

SPF, DMARC and enforcement, by whether a domain operates mail

PopulationDomainsSPFDMARCEnforcingp=none of publishers
Operates mail (publishes MX)187,913,55279.79%35.52%13.27%62.57%
No mail (no MX)175,652,3627.64%12.23%10.73%12.20%
Source: Datazagas of 2026-09-24363,565,914 resolving domains, split by MX presence

The corpus-wide “half of all DMARC is p=none” figure blends these two populations and describes neither.

The enforcement figures

Free to quote with attribution. Open the notes on a card before you do.

24.26%
no prior period

Domains publishing a DMARC record

88,217,792 of 363.6M resolving domains

Source: Datazag · as of 2026-09-24

What is email authentication?
49.63%
no prior period

DMARC records at enforcement (p=quarantine or p=reject)

43,781,239 of 88.2M domains publishing DMARC

Source: Datazag · as of 2026-09-24

What is email authentication?
50.31%
no prior period

DMARC records set to p=none

44,379,368 of 88.2M domains publishing DMARC

Source: Datazag · as of 2026-09-24

What is email authentication?
0.06%
no prior period

DMARC records with an invalid policy value

57,185 of 88.2M domains publishing DMARC

Source: Datazag · as of 2026-09-24

What is email authentication?
40.59%
no prior period

DMARC records that neither enforce nor report

35,809,473 of 88.2M domains publishing DMARC

Source: Datazag · as of 2026-09-24

0.09%
no prior period

Domains publishing MTA-STS

319,063 of 363.6M resolving domains

Source: Datazag · as of 2026-09-24

What is MTA-STS?
72.76%
no prior period

MTA-STS domains with a policy mode on record

232,140 of 319,063 domains publishing MTA-STS

Source: Datazag · as of 2026-09-24

What is MTA-STS?
47.94%
no prior period

MTA-STS domains whose policy is set to enforce

152,958 of 319,063 domains publishing MTA-STS

Source: Datazag · as of 2026-09-24

What is MTA-STS?

Query these statistics directly

Every figure on this page is served as Parquet. Same format as the corpus itself.

SELECT * FROM read_parquet('https://observatory.datazag.com/observatory_statistics.parquet');