DMARC Census, September 2026: the Tranco top million

We looked up the DMARC and SPF records of 1,000,767 domains on 1 September 2026. The domains are the Tranco top 1 million (list GQJJK) plus 1,321 US federal domains. 554 of the federal domains are already in the Tranco list, and we scanned those once.

1,000,424 domains answered the DMARC lookup. 343 lookups failed after retries. Those domains could not be measured and we left them out. We never counted them as publishing no record.

aggregates.json has every count and share published in the September 2026 edition. It covers DMARC adoption, policy, record quality, reporting addresses, SPF, mail providers and report vendors, with breakdowns by country, by TLD and for the US federal domains. It also has MTA-STS, TLS-RPT and BIMI adoption, and the change since the August 2026 edition.

manifest.json has what you need to repeat the scan. It lists the Tranco list id, the Public Suffix List hash, the resolvers, the scanner version and the scan times.

The data is aggregate. It has counts and shares, and no record of how any single domain was configured.

You can read the September 2026 report at: https://domaincanary.com/research/dmarc-census/2026-09

Past and future editions are listed at: https://domaincanary.com/research/dmarc-census