State of Email Authentication 2026

DMARC Adoption Rate and Enforcement

As defined in RFC 7489, DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on SPF and DKIM to verify sender identity and provide policy enforcement. Our scan found 62.5% DMARC adoption (6,255 domains), but a critical enforcement gap persists.

The enforcement rate — the percentage of domains using p=quarantine or p=reject policies — stands at 46.0%. This means nearly half of domains with DMARC actively protect against spoofing, while the remaining 16.5% remain at p=none (monitoring-only mode).

Comparing to industry data from Valimail's 2024 report, which showed 54% DMARC adoption in Fortune 1000 companies, our broader Tranco 10K sample (62.5%) suggests adoption is accelerating across all domain categories following Google and Yahoo's February 2024 bulk sender requirements.

Aggregate reporting (RUA) adoption stands at 54.3%, meaning 5,431 domains publish a `rua=` tag to receive daily authentication reports from major receivers. The remaining 824 DMARC-enabled domains lack visibility into their authentication failures.

Despite two years of enforcement pressure from major email providers, 37.5% of top domains still lack DMARC entirely. Of those with DMARC, 1 in 6 (16.5%) remain at monitoring-only policy (p=none), suggesting hesitation to move to enforcement due to legitimate sender configuration challenges.

For step-by-step guidance on moving from p=none to p=reject, see our DMARC policy migration guide.

SPF Adoption Rate and the 10-Lookup Limit Challenge

SPF (Sender Policy Framework, RFC 7208) shows the highest adoption rate at 67.6% (6,756 domains), exceeding both DMARC (62.5%) and DKIM (38.9%). SPF's relative simplicity — a single TXT record at the root domain — explains its widespread deployment.

However, 3.2% of SPF-enabled domains (322 domains) exceed RFC 7208's hard limit of 10 DNS lookups, triggering PermError failures. When SPF returns PermError, email authentication fails entirely, potentially causing DMARC failures if DKIM alignment is not present.

Additionally, 5.1% of domains have SPF but no DMARC (679 domains). SPF alone provides limited anti-spoofing protection because it only validates the envelope sender (Return-Path), not the From header visible to end users.

For solutions to SPF lookup limit violations, including subdomain splitting and IP address consolidation, read our guide on SPF 10-lookup limit fixes.

DKIM Adoption Rate

DKIM (DomainKeys Identified Mail, RFC 6376) shows the lowest adoption rate at 38.9% (3,886 domains) among the three core authentication protocols. DKIM adoption lags SPF (67.6%) by 28.7 percentage points and DMARC (62.5%) by 23.6 percentage points.

Why DKIM lags: DKIM requires cryptographic key pair generation, DNS publishing of the public key at `selector._domainkey.domain`, and mail server configuration to sign outbound messages with the private key. This multi-step process is significantly more complex than SPF's single TXT record.

Common selectors detected include google._domainkey (Google Workspace), selector1._domainkey (Microsoft 365), and k1._domainkey (Mailchimp). No domains in our sample deployed DKIM-only configurations (DKIM without SPF or DMARC) — DKIM is always paired with at least SPF.

Many domains rely solely on SPF alignment for DMARC pass, which is acceptable per RFC 7489 but provides less redundancy. If SPF fails due to email forwarding or IP changes, DKIM serves as the fallback authentication mechanism.

MTA-STS Adoption: Transport Layer Security for SMTP

MTA-STS (Mail Transfer Agent Strict Transport Security, RFC 8461) shows only 1.8% adoption (179 domains) — 34x lower than DMARC (62.5%). MTA-STS enforces TLS encryption on SMTP connections, preventing downgrade attacks where adversaries strip STARTTLS to intercept email in transit.

Mode distribution:

• enforce: 1.0% (99 domains) — active protection against downgrade attacks
• testing: 0.8% (79 domains) — monitoring mode, logs policy violations without blocking
• none: 0.0% — no domains publish mode=none

Why MTA-STS adoption is low: MTA-STS requires three components:

1. HTTPS hosting for the policy file at https://mta-sts.yourdomain.com/.well-known/mta-sts.txt
2. DNS TXT record at _mta-sts.yourdomain.com with policy ID
3. Valid TLS certificate for mta-sts.yourdomain.com

This infrastructure requirement is significantly more complex than DMARC, SPF, or DKIM (which only require DNS TXT records). Additionally, MTA-STS is backend-only security with no user-visible benefits, unlike BIMI (inbox logos), reducing organizational priority.

Major email providers led adoption: Google deployed MTA-STS in 2019, Yahoo in 2020. The Electronic Frontier Foundation's STARTTLS Everywhere initiative promotes MTA-STS adoption, but uptake remains minimal among smaller organizations.

For implementation guidance, see our MTA-STS setup guide.

BIMI Adoption: Brand Indicators for Message Identification

BIMI (Brand Indicators for Message Identification) shows 7.5% adoption (748 domains) — 4x higher than MTA-STS (1.8%) despite being less critical for security. BIMI displays the sender's logo in recipient inboxes (Gmail, Yahoo, Apple Mail support), providing visible brand differentiation.

Of the 748 domains with BIMI records, 6.8% have valid SVG logos (677 domains) successfully validated via HTTP fetch. The remaining 0.7% (71 domains) have broken BIMI records — either 404 errors on the SVG URL or invalid image formats.

BIMI prerequisites per the BIMI Group specification:

• DMARC enforcement: p=quarantine or p=reject (p=none insufficient)
• SVG logo: Tiny Portable/Secure (Tiny PS) profile, hosted at publicly accessible HTTPS URL
• VMC (Verified Mark Certificate): Required by Gmail for logo display; optional for Yahoo/Apple Mail

All 748 BIMI-enabled domains in our sample have DMARC at p=quarantine or p=reject — receivers enforce this prerequisite strictly.

Why BIMI adoption exceeds MTA-STS: BIMI provides user-visible brand differentiation in crowded inboxes, driving marketing and brand team investment. Fortune 500 companies (Apple, Microsoft, PayPal) widely deploy BIMI. Financial services (banks, fintech) adopt BIMI as an anti-phishing trust signal.

In contrast, MTA-STS is backend-only transport security with no inbox visibility, making it harder to justify to non-technical stakeholders despite superior security benefits.

For implementation guidance, see our BIMI setup guide.

DANE/TLSA Adoption: Zero Adoption for Email Security

DANE (DNS-based Authentication of Named Entities, RFC 7672) shows zero adoption — not a single domain in our 10,000-domain sample publishes TLSA records for email (SMTP).

What is DANE: DANE uses DNSSEC-signed TLSA records to cryptographically verify TLS certificates, eliminating reliance on Certificate Authorities. DANE represents the "ideal" email security standard — no CA trust required, direct cryptographic verification of MX host certificates.

Why zero adoption:

1. DNSSEC prerequisite: DANE requires DNSSEC. Our scan found only 890 of 10,000 domains (8.9%) have DNSSEC signatures. Even among DNSSEC-enabled domains, none publish TLSA records for email.
2. Complex setup: Requires TLSA record per MX host at _25._tcp.mx.domain, certificate hash rotation on renewal, DNSSEC key management.
3. Minimal receiver support: Only Postfix and Exim (with patches) verify DANE TLSA records for SMTP. Gmail, Microsoft 365, Yahoo do not support DANE for email.

DNSSEC adoption data from APNIC (2025) shows 13% global DNSSEC deployment, but our Tranco 10K sample (high-traffic domains) shows only 8.9% — suggesting DNSSEC adoption is even lower among smaller organizations.

For comparison, DANE for HTTPS (RFC 6698) also shows minimal adoption (~0.1% of Alexa 1M per research), but email DANE (RFC 7672) has even lower adoption due to the DNSSEC requirement plus lack of major receiver support.

DANE represents a theoretical security improvement but a practical failure for email. The complexity barrier (DNSSEC + TLSA record management + minimal receiver support) prevents real-world deployment.

Email Authentication Trends: Cross-Protocol Analysis

Analyzing protocol combinations reveals how domains layer authentication mechanisms for defense in depth.

DMARC Requires SPF or DKIM

Of the 6,255 domains with DMARC, the breakdown by authentication mechanisms:

• Both SPF and DKIM: 38.9% (2,433 domains) — strongest setup with redundant authentication
• SPF only (no DKIM): 61.1% (3,822 domains) — relies solely on SPF alignment for DMARC pass
• DKIM only (no SPF): 0.0% (0 domains) — not a valid configuration per RFC 7489

Most DMARC-enabled domains (61.1%) rely on SPF-only authentication, accepting the risk that email forwarding or IP changes will break authentication. DKIM provides redundancy but requires more complex configuration.

BIMI Enforcement Prerequisite

All 748 domains with BIMI records have DMARC at p=quarantine or p=reject. Receivers (Gmail, Yahoo) enforce this prerequisite strictly — BIMI will not display for domains at p=none.

Full Stack Adoption

Only 1.2% of domains (120 domains) deploy the complete email authentication stack: DMARC + SPF + DKIM + MTA-STS + BIMI (excluding DANE due to zero adoption).

32.4% of domains (3,244 domains) have NO email authentication whatsoever — no DMARC, SPF, DKIM, MTA-STS, or BIMI. These domains are fully vulnerable to spoofing, phishing, and BEC attacks.

The data reveals a baseline adoption pattern: most organizations adopt DMARC + SPF as a minimum viable authentication setup (38.2%), while advanced protocols (MTA-STS, BIMI) remain niche. Full-stack deployment (1.2%) is rare even among high-traffic domains.

Sector Preview: Government Email Security, Education, and Enterprise

Note: Full sector analysis requires additional data sources (CISA .gov list, .edu zone files, Fortune 500 lists). This section previews findings based on manual identification within the Tranco 10K dataset.

Government Domains (.gov)

Approximately 150 .gov domains were identified in the Tranco 10K sample:

• DMARC adoption: ~85% (higher than 62.5% overall)
• p=reject enforcement: ~60% (higher than 29.4% overall)
• Compliance driver: CISA BOD 18-01 mandate (October 2017) required federal agencies to implement DMARC with enforcement by October 2018

Government domains show significantly higher adoption and enforcement rates compared to the overall sample, driven by regulatory mandates and centralized IT governance.

Education Domains (.edu)

Approximately 80 .edu domains were identified in the Tranco 10K sample:

• DMARC adoption: ~55% (lower than 62.5% overall)
• p=reject enforcement: ~20% (lower than 29.4% overall)
• Key challenge: Alumni email forwarding breaks DMARC — a common reason universities remain at p=none rather than enforcing policies

Education domains lag overall adoption, likely due to decentralized IT infrastructure and the alumni forwarding challenge.

Fortune 500 Domains

Approximately 300 likely Fortune 500 domains were identified via Tranco ranks 1-500:

• DMARC adoption: ~70% (higher than 62.5% overall)
• BIMI adoption: ~15% (2x higher than 7.5% overall)
• Driver: Brand visibility and anti-phishing trust signals drive BIMI investment among large enterprises

Estimated from manual identification within the Tranco 10K sample. Dedicated sector studies with authoritative source lists are planned for Q2 2026.

Coming in Q2 2026: Full sector deep-dives on government email security (CISA .gov list), education (.edu zones), and Fortune 500 adoption.

Frequently Asked Questions

Conclusion

Email authentication adoption is accelerating, driven by Google and Yahoo's 2024 bulk sender mandates, but significant gaps remain in enforcement and advanced protocol deployment.

Key takeaways:

• DMARC adoption (62.5%) is improving, but 37.5% of top domains remain unprotected
• Enforcement is critical — only 46% of domains actively block spoofed emails with p=quarantine or p=reject
• SPF is most widely adopted (67.6%), but 3.2% risk PermError from 10-lookup limit violations
• DKIM lags (38.9%) due to configuration complexity (key pairs, DNS publishing, mail server integration)
• Advanced protocols remain niche — MTA-STS 1.8%, BIMI 7.5%, DANE 0.0%
• Full-stack adoption (DMARC+SPF+DKIM+MTA-STS+BIMI) is only 1.2% of domains

This is the baseline study for 2026. Quarterly re-scans will track adoption trends, protocol migration (p=none → p=reject), and sector-specific changes. Watch for Q2 2026 updates.

DMARCguard. (2026). State of Email Authentication 2026: Adoption Statistics for DMARC, SPF, DKIM, and Advanced Protocols. Retrieved from https://dmarcguard.io/research/email-authentication-2026/

@misc{dmarcguard2026,
  title={State of Email Authentication 2026: Adoption Statistics for DMARC, SPF, DKIM, and Advanced Protocols},
  author={DMARCguard Research Team},
  year={2026},
  month={February},
  howpublished={\url{https://dmarcguard.io/research/email-authentication-2026/}},
  note={Data collected February 25, 2026. Sample: 10,000 domains from Tranco Top Sites List.}
}