50.7% of DMARC records ask receivers to take no action
The majority position among domains that have published a record at all is p=none; 49.3% ask for quarantine or rejection. A published record is not the same as a defended domain.
DMARC policy, where a record exists
Share of DMARC-publishing domains by policy tag.
of mail-operating domains that publish DMARC set it to p=none
44,257,369 of 70,772,069 mail-operating domains publishing DMARC
Source: Datazag · as of 2026-11-05
Domains that send mail are worse at enforcement than domains that do not
62.5% of mail-operating publishers sit at p=none, against 11.3% of publishers with no mail. Enforcement only costs anything when there is live mail to break, so operators with mail stall at p=none and operators without it go straight to enforcement.
SPF, DMARC and enforcement, by whether a domain operates mail
| Population | Domains | SPF | DMARC | Enforcing | p=none of publishers |
|---|---|---|---|---|---|
| Operates mail (publishes MX) | 191,971,347 | 80.51% | 36.87% | 13.79% | 62.54% |
| No mail (no MX) | 174,179,463 | 7.84% | 12.25% | 10.87% | 11.27% |
The corpus-wide “half of all DMARC is p=none” figure blends these two populations and describes neither.
The enforcement figures
Free to quote with attribution. Open the notes on a card before you do.
Domains publishing a DMARC record
92,112,897 of 366.2M resolving domains
Source: Datazag · as of 2026-11-05
DMARC records at enforcement (p=quarantine or p=reject)
45,394,057 of 92.1M domains publishing DMARC
Source: Datazag · as of 2026-11-05
DMARC records set to p=none
46,662,221 of 92.1M domains publishing DMARC
Source: Datazag · as of 2026-11-05
DMARC records with an invalid policy value
56,619 of 92.1M domains publishing DMARC
Source: Datazag · as of 2026-11-05
DMARC records that neither enforce nor report
37,610,916 of 92.1M domains publishing DMARC
Source: Datazag · as of 2026-11-05
Domains publishing MTA-STS
330,078 of 366.2M resolving domains
Source: Datazag · as of 2026-11-05
MTA-STS domains with a policy mode on record
234,936 of 330,078 domains publishing MTA-STS
Source: Datazag · as of 2026-11-05
MTA-STS domains whose policy is set to enforce
151,636 of 330,078 domains publishing MTA-STS
Source: Datazag · as of 2026-11-05
Research using this data
Microsoft and Google run the mailboxes for 24% of corporate domains, eleven times the share behind a security gateway
The gateway market is concentrated but small; the mailbox layer behind it is eleven times larger. National markets turn global shares inside out: one vendor holds almost all of Sweden's.
Read on datazag.com1 in 4 domains publish DMARC, and about half of those enforce it
A census of resolving, unparked domains: about half of DMARC publishers only report spoofing. Among domains that run mail, report-only outnumbers enforcement two to one.
Read on datazag.comWho Really Runs Business Email? Microsoft leads Google 9 : 1 at the largest companies, and is level with it across corporate mail
The keyhole effect: enterprise studies see the largest companies. Across all corporate mail domains, hosting companies and registrars run more mail than Microsoft and Google together.
Read on datazag.comQuery these statistics directly
Every figure on this page is served as Parquet. Same format as the corpus itself.
SELECT * FROM read_parquet('https://observatory.datazag.com/observatory_statistics.parquet');