Security · 1h ago
Email Auth Still Broken: 33% of Top 10k Domains Lack DMARC
A June 2026 scan of the top 10,000 domains found 33.4% have no DMARC record, and only 46.5% of those with DMARC enforce p=reject. SPF is missing on 25% of domains, and 1.7% exceed the 10-lookup limit. MTA-STS adoption is near zero at 2.2%.
Meridian48 take
The numbers confirm that email authentication remains a half-finished project, with most domains stuck at monitor-only p=none and transport security largely ignored.
Read the full reporting
What 10,000 domains actually publish for email authentication in 2026 →
DEV Community
email-authenticationdmarc