The State of Email Authentication 2026: SPF, DMARC, MTA-STS, TLS-RPT and BIMI adoption across 100,000 domains

A measurement of email authentication adoption across 100,000 domains sampled from the Tranco top-1M list (list ID V3YPN, generated 2026-09-17).

The survey records, per domain: presence of MX; SPF including the RFC 7208 ten-lookup count and the all-qualifier; DMARC including policy strength, subdomain policy, pct and whether aggregate reporting is configured; MTA-STS; TLS-RPT; and BIMI.

Principal findings. 58.7% of domains publish a DMARC record but only 20.9% reach p=reject. 35.8% of those that publish DMARC leave it at p=none, where it blocks nothing. 20.8% of domains at enforcement publish no rua address and therefore enforce without visibility. 7.0% of enforcing domains set sp=none, leaving every subdomain unprotected. 3.4% of published SPF records exceed the ten DNS-lookup limit and therefore permerror, meaning they resolve correctly but no longer function. MTA-STS adoption is 2.0% and TLS-RPT 2.4%.

DKIM is deliberately not reported. DKIM selectors are arbitrary strings chosen by the sender, so probing a list of common selectors and finding nothing proves nothing. Any DKIM adoption figure derived that way is a lower bound at best and misleading at worst.

Limitations. DNS presence is not correctness: a published record may still be misconfigured in ways DNS cannot reveal. MTA-STS is counted on the DNS record alone; the policy file was not fetched for every domain, so the true enforcing figure is lower. Regional cuts are grouped by country-code TLD, which is a proxy for geography rather than a measurement of it.

Includes the raw per-domain dataset as JSON Lines, the computed findings, and the scanning and analysis code so the work can be reproduced against the same Tranco list.