The state of email authentication: SPF, DKIM and DMARC across 500 well-known domains (November 2026)
This study looks at email-authentication records visible in public DNS for the groups described below. It summarizes SPF, DKIM, DMARC, MTA-STS and TLS reporting without naming domains or publishing individual results. Because DNS changes and does not show delivery outcomes, these figures are only a snapshot of published records.
Data collected · Last reviewed
Headline numbers
Top-sites sample: the first 500 domains with MX records in the Tranco ranking, in rank order. Percentages use the domains for which the relevant lookup completed.
These describe well-known, mostly large domains. They do not describe small businesses.
Charts
Each chart has a text summary and the values are repeated in the table below. Charts and figures may be reused with a link to this page.
DMARC policy
Among the 500 top sites, 51.8% publish p=reject, 23.8% p=quarantine and 13.4% p=none; 11.0% publish no DMARC record.
- p=reject
- p=quarantine
- p=none
- No DMARC record
- Invalid or multiple records
How SPF records end
Share of domains that publish exactly one SPF record, by how it ends. In the top-sites sample 40.2% end in ~all and 52.4% in -all.
- -all (reject)
- ~all (soft fail)
- ?all or +all
- redirect= only
- No all mechanism
SPF problems that stop SPF working or leave it missing
3.1% of top-sites domains with one SPF record need more than 10 DNS lookups, the limit receivers apply; 8.0% of the top sites publish no SPF record. The lookup count is a minimum when an include could not be followed. Lookup and void shares are of domains with exactly one SPF record; the missing and multiple shares are of all domains.
DKIM at 23 common selectors
A key was found at one of the 23 selectors tried for 64.8% of the top sites. The rest are unknown, not failures: DKIM selectors cannot be listed from DNS, so a domain that signs with a custom selector shows as unknown.
- Key found at a common selector
- CNAME published, no key behind it
- Unknown: no key at the common selectors
MTA-STS and TLS-RPT records
5.8% of the top sites publish an MTA-STS record and 6.6% a TLS-RPT record. Only the DNS records are counted; the MTA-STS policy file and its mode were not fetched.
DMARC policy by mail provider family (top sites)
Grouped by the MX hosts the domain publishes. Only groups of at least 20 domains are shown, and the grouping describes where mail is received, not who sends it.
- p=reject
- p=quarantine
- p=none
- No DMARC record
All key results
| Measure | Top sites | Listed companies (India) | Universities (India) |
|---|---|---|---|
| Domains in the sample | 500 | 166 | 250 |
| DMARC p=reject | 51.8% | 39.2% | 6.8% |
| DMARC p=quarantine | 23.8% | 36.7% | 13.3% |
| DMARC p=none | 13.4% | 12.0% | 32.1% |
| No DMARC record | 11.0% | 12.0% | 45.4% |
| DMARC record with a report address (rua=) | 94.6% | 89.7% | 68.5% |
| SPF record published | 92.0% | 94.6% | 83.9% |
| SPF ends in -all | 52.4% | 53.5% | 20.5% |
| SPF ends in ~all | 40.2% | 41.9% | 76.0% |
| SPF over 10 DNS lookups | 3.1% | 9.0% | 3.0% |
| SPF over 2 void lookups | 0.2% | 0.0% | 0.0% |
| DKIM key at a common selector | 64.8% | 80.7% | 54.4% |
| DKIM: at least one key found is under 2048 bits (of domains with a key found) | 79.3% | 60.4% | 37.5% |
| MTA-STS record | 5.8% | 3.6% | 0.8% |
| TLS-RPT record | 6.6% | 3.6% | 0.4% |
| MX hosts mix more than one known provider | 0.2% | 5.4% | 0.8% |
| Median email domain health score (0 to 100) | 80 | 77.5 | 53 |
The same numbers, with counts and denominators, are in the aggregate data file (JSON).
Cite this
Cloudek. “The state of email authentication: SPF, DKIM and DMARC across 500 well-known domains (November 2026).” Cloudek Hosting, data collected 2026-11-04. https://www.cloudekhosting.com/email-authentication-report-2026.html
Charts and figures on this page may be reused if you link back to https://www.cloudekhosting.com/email-authentication-report-2026.html. Please say the figures are a 4 November 2026 snapshot of the sample described here.
Method
Date and tool. One scan pass on 4 November 2026, from one machine, using public DNS only (Cloudflare DNS over HTTPS). It uses the same code as the public email domain health score, so a domain gets the same result here as it would in the tool. Requests were limited to 5 at a time with a short gap between them, every answer was cached, failed lookups were recorded and not retried, and the scan was run once.
Domains.
- Tranco top sites. First 500 domains with MX records in the Tranco top-sites ranking (7462X), in rank order. Source: Tranco list 7462X, generated 2026-10-31.
- Indian listed companies. Websites of companies listed on the National Stock Exchange of India or the Bombay Stock Exchange that have an official website in Wikidata, all with MX records. Source: Wikidata (CC0), query run on the scan date.
- Indian universities. 250 Indian universities and colleges with MX records, chosen in a fixed pseudo-random order (SHA-256 of the domain) from the Wikidata institutions in India that have an official website. Source: Wikidata (CC0), query run on the scan date.
Which domains count. A domain is kept when it publishes at least one MX record. Domains without MX, with a Null MX (“this domain does not receive mail”), that do not exist in DNS, or whose MX lookup failed are excluded and counted below.
- Tranco top sites: 755 domains looked at, 500 kept. Excluded: 244 with no MX record, 7 with a Null MX, 2 not in DNS, 2 where the MX lookup failed.
- Indian listed companies: 195 domains looked at, 166 kept. Excluded: 27 with no MX record, 0 with a Null MX, 0 not in DNS, 2 where the MX lookup failed.
- Indian universities: 301 domains looked at, 250 kept. Excluded: 22 with no MX record, 1 with a Null MX, 26 not in DNS, 2 where the MX lookup failed.
Exact checks per domain.
- SPF: the TXT records at the domain; exactly one v=spf1 record is expected. The ending (-all, ~all, ?all, +all, redirect= or no all mechanism), the number of DNS lookups after following include and redirect (more than 10 makes SPF fail with permerror), void lookups (more than 2) and use of ptr.
- DMARC: the TXT record at _dmarc.<domain>: policy p=, pct=, whether rua= is present and sp=.
- DKIM: a TXT key at 23 common selectors (for example selector1, selector2, google, default, s1, s2, k1, mail, fm1, zoho). A domain with no key found is “unknown”, never “fail”, because only the sender knows its selector.
- MTA-STS and TLS-RPT: the TXT records at _mta-sts.<domain> and _smtp._tls.<domain>. The MTA-STS policy file is not fetched.
- MX: the MX hosts, matched by name to known mail providers. “Mixed” means the hosts belong to more than one known mailbox provider or filtering gateway, or to a gateway and a mailbox host. Provider groups are shown only when they have at least 20 domains.
DNS requests made: 34043 (3824 answered from the cache, 6 failed). The script that reproduces the aggregates from a domain list is scripts/email-auth-study.mjs in the Cloudek repository; the per-domain results are not published.
Limitations
- Snapshot. DNS changes daily. These figures describe 4 November 2026 only.
- Public DNS only. A record that is published is not proof of how mail is actually sent or how receivers treat it. Nothing here shows delivery, spoofing or abuse, and no cause is claimed for any difference between groups.
- DKIM is a floor. Only 23 common selectors were tried. Many domains sign with other selectors, so “unknown” does not mean “no DKIM”.
- Domains without MX are excluded. Many popular domains are not mail domains (content delivery, advertising, infrastructure); they are left out, but a ranking domain that has MX is not necessarily a domain people send business mail from.
- Not representative. The top-sites sample favours large, well-resourced organisations. It says little about small businesses. The Indian cuts are small and use lists that are incomplete: Wikidata coverage is uneven and the listed-company and university cuts are not a census.
- Registrable domains are approximated. The Indian cuts reduce each website address to its registrable domain with a short rule, without the full public suffix list.
- Lookup failures are left out of the denominator of the check they affect; the counts are in the data file.
Sources
Tranco is a research-oriented top-sites ranking: Victor Le Pochat, Tom Van Goethem, Samaneh Tajalizadehkhoob, Maciej Korczyński and Wouter Joosen, “Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation”, NDSS 2019, tranco-list.eu. List 7462X, generated 2026-10-31. Its page says the ranking combines lists from providers that are available under Creative Commons licences, including a non-commercial one; only aggregate counts are published here and the list is not redistributed. Wikidata data is available under CC0.
Standards: SPF (RFC 7208), DKIM (RFC 6376), DMARC (RFC 7489), SMTP MTA-STS (RFC 8461) and SMTP TLS Reporting (RFC 8460).
Check your own domain
The email domain health score runs these same checks for one domain in your browser. If your domain publishes DMARC at p=none, the DMARC rollout plan explains how to move toward enforcement in stages.