DMARC research
DMARCdrift researches how domains adopt and enforce email authentication. Our data is available under CC BY 4.0. Our monthly scan samples domains across curated industries, government, and popular websites; see the methodology and sample for how we measure adoption.
DMARC adoption across the web
2,241 domains scanned; 85.4% have DMARC and 70.5% enforce p=reject.
Scanned November 1, 2026.
See month-over-month changesMonthly updates
- DMARC Adoption, September 2026: The Library of Congress Locks Down 18 Domains
Our September scan of 2,240 domains: 83.3% publish DMARC and 68.5% enforce p=reject. Most of the movement came from one agency locking down non-sending domains.
By segment and topic
- DMARCbis Readiness: How Many Domains Still Publish pct, rf, and ri?
We checked 1,786 DMARC records for tags RFC 9989 removed. 46.4% still carry pct, rf, or ri, mostly harmlessly. Only 7 domains have a risky setup.
- DMARC Adoption Statistics 2026: Scanning 2,241 Domains
Our November scan of 2,241 domains shows 85.4% publish DMARC and 70.5% use p=reject. Explore differences across sectors for email domain owners.
- 20% of Cybersecurity Companies Do Not Use DMARC Reject
Our November scan finds 80% of 40 cybersecurity company domains at p=reject. Compare security vendors with banks, hospitals and federal domains.
- B2B SaaS DMARC Enforcement in 2026: 75% at p=reject
All 100 SaaS domains in our November scan publish DMARC, but 75% use p=reject. See the current enforcement gap and how it compares with May.
- 9 of 30 News Media Domains Do Not Publish a Reject DMARC Policy
Nine of 30 news media domains checked lack a reject DMARC policy. See which domains publish quarantine or monitoring policies and which has no record.
- Healthcare DMARC: High Coverage, Mid-Pack Enforcement, and a HIPAA Angle
All 25 health system domains in our November scan publish DMARC, and 80% use p=reject. Explore the enforcement gap and the change since May.
- 100% of Top Universities Have DMARC. 34% Enforce It.
All 50 university domains in our November scan publish DMARC, but 34% use p=reject. Explore the enforcement gap and the change since May.
- State Governments Are 51 Points Behind Federal on DMARC Enforcement
Our November scan finds 30% of state portal domains and 81% of federal domains at p=reject. Compare the figures with the May scan.
- Banks Lead DMARC Enforcement at 92%: Why Financial Services Got Ahead
Our November scan finds 92% of the top 25 US bank domains at p=reject. Compare bank DMARC enforcement with universities and state governments.
- Fortune 100 DMARC in 2026: 79% at p=reject, 1% Without a Record
Our November scan finds 79% of Fortune 100 domains at p=reject and 99% publishing DMARC. See the current figures and the change since May.