# How many popular domains use SPF, DMARC and MTA-STS in 2026? > We read SPF, DMARC and MTA-STS for the 1,000 most popular domains: 88.9% of mail domains publish DMARC, 50.2% at p=reject, 5.2% use MTA-STS. - URL: https://postelva.com/data/email-authentication-statistics-2026/ - Last updated: 2026-11-12 - Publisher: Postelva (https://postelva.com) We looked up the public email records of the 1,000 most popular domains on the Tranco list of 11 November 2026: MX, SPF, DMARC, MTA-STS, SMTP TLS reporting and BIMI. Here are the aggregate figures, the method and its limits. **Quick answer — How many popular domains use SPF, DMARC and MTA-STS in 2026?** Of the 691 domains that receive mail among the 1,000 most popular (Tranco, 11 November 2026), 93.9% publish SPF and 88.9% publish DMARC, but only 50.2% enforce p=reject and 5.2% use MTA-STS. **Postelva** read the records on 12 November 2026 through public DNS. ## Results for the 691 domains that receive mail *Tranco list PY2NJ (13 October to 11 November 2026), top 1,000; 691 domains with MX records. A lookup that failed is left out of its line, so the totals differ by one or three.* | Record | Published | Share | What it means | | --- | --- | --- | --- | | SPF (TXT v=spf1) | 647 of 689 | 93.9% | Lists the servers allowed to send for the domain | | SPF ending in -all (hard fail) | 343 of 689 | 49.8% | Mail from other servers should be rejected | | SPF ending in ~all (soft fail) | 261 of 689 | 37.9% | Mail from other servers is only marked | | More than one SPF record (invalid) | 3 of 689 | 0.4% | RFC 7208 allows one; receivers return an error | | DMARC (TXT at _dmarc) | 614 of 691 | 88.9% | A policy for mail that fails SPF and DKIM | | DMARC p=reject | 347 of 691 | 50.2% | Failing mail is refused | | DMARC p=quarantine | 168 of 691 | 24.3% | Failing mail goes to spam | | DMARC p=none | 99 of 691 | 14.3% | Monitoring only, nothing is blocked | | MTA-STS (TXT at _mta-sts) | 36 of 688 | 5.2% | Senders must use TLS to reach the domain | | SMTP TLS reporting (TXT at _smtp._tls) | 43 of 688 | 6.2% | Reports on TLS delivery failures | | BIMI (TXT at default._bimi) | 159 of 688 | 23.1% | A brand logo record for supporting inboxes | *Last checked on November 12, 2026; older figures carry their own date.* ## What did the study find? **Publishing SPF and DMARC is now the norm among popular domains; enforcing them is not.** Nine in ten mail domains in the top 1,000 publish a DMARC record, but only half tell receivers to refuse failing mail. One in seven stays at p=none, which collects reports and blocks nothing, and a quarter quarantine. Almost every DMARC record asks for aggregate reports: 93.3% carry a rua address. SPF tells the same story. 93.9% publish a record, but a hard fail (-all) closes only 49.8% of them; 37.9% end with a soft fail (~all). Three domains publish two SPF records, which RFC 7208 treats as a permanent error, and our [guide to the SPF record](https://postelva.com/guides/spf-record-setup/ "How to set up an SPF record") shows why one record must hold every sender. Transport security lags far behind. MTA-STS, which forces sending servers to use TLS, is published by 36 of 688 mail domains (5.2%), and SMTP TLS reporting by 43. Only 30 of the 691 combine SPF, an enforced DMARC policy and MTA-STS. ## The 100 most popular domains compared with the top 1,000 *All domains of each group, whether or not they receive mail; a domain without mail can still publish SPF and DMARC to stop spoofing.* | Measure | Top 100 (all domains) | Top 1,000 (all domains) | | --- | --- | --- | | SPF published | 81 of 100 (81%) | 762 of 996 (76.5%) | | DMARC published | 76 of 100 (76%) | 730 of 998 (73.1%) | | DMARC p=reject | 51 of 100 (51%) | 439 of 998 (44%) | | MTA-STS | 10 of 100 (10%) | 38 of 994 (3.8%) | | BIMI | 17 of 99 (17.2%) | 159 of 994 (16%) | *Last checked on November 12, 2026; older figures carry their own date.* ## Do domains that send no mail protect themselves? **Mostly not.** 306 of the 1,000 domains have no MX record or a null MX (RFC 7505), so they never send legitimate mail. A criminal can still put any of them in a From line. The fix costs two DNS records: SPF "v=spf1 -all" and DMARC "p=reject". 95 of the 306 publish the SPF hard fail and 92 the DMARC reject policy, so roughly two in three leave the door open. The same applies to a personal domain you keep for later, or to a second extension bought only to protect your address. The [DMARC setup guide](https://postelva.com/guides/dmarc-setup/ "How to set up DMARC for a personal domain") includes the no-mail record set, and Postelva's DNS editor has a one-click template for it. ## How was the study done? **We took the Tranco list PY2NJ, built from five providers' data between 13 October and 11 November 2026, and kept its first 1,000 domains.** Each domain got six DNS lookups through Cloudflare's public DNS-over-HTTPS resolver on 12 November 2026: MX at the apex, TXT at the apex (SPF), and TXT at _dmarc, _mta-sts, _smtp._tls and default._bimi. A domain counts as receiving mail when it has at least one MX record other than a null MX. SPF counts when exactly one TXT record starts with v=spf1, and its policy is read from the all mechanism. DMARC counts when a TXT record at _dmarc starts with v=DMARC1, and its policy is the p tag. A lookup that failed after three tries is left out of that line. Tranco ranks registrable domains, so some entries are infrastructure names that never send mail, which is why the mail figures use only the 691 domains with MX records. The raw answers and the script are kept with the study. We publish totals only, without naming domains. ## What the figures mean for your own domain **A personal or family domain can match the best of the top 1,000 in an afternoon.** According to Postelva's survey of 12 November 2026, 347 of the 691 most popular mail domains refuse failing mail with DMARC p=reject and 36 publish MTA-STS; a domain connected to Proton Mail, Fastmail or Zoho Mail through our templates starts with SPF, DKIM and DMARC already written. The usual order is SPF and DKIM first, DMARC at p=none for a week of reports, then quarantine and reject; the [comparison of SPF, DKIM and DMARC](https://postelva.com/spf-vs-dkim-vs-dmarc/ "SPF vs DKIM vs DMARC") explains what each record checks. MTA-STS takes a small policy file on a web host, as our [MTA-STS guide](https://postelva.com/guides/mta-sts-setup/ "How to set up MTA-STS") shows. A .com at Postelva costs $12.49/year, the same price every year. ## Questions about the study ### What share of popular domains use DMARC in 2026? 88.9% of the 691 domains that receive mail in the Tranco top 1,000 published DMARC on 12 November 2026, and 50.2% used p=reject. Across all 1,000 domains, 73.1% published DMARC. ### How many popular domains use MTA-STS? 36 of 688 mail domains (5.2%) in the top 1,000, and 10 of the top 100 domains. It is the least adopted of the records we checked. ### Is p=none enough? No. p=none only asks for reports; spoofed mail is still delivered. 14.3% of the mail domains we checked stayed at p=none. ### Why are some domains counted out of 689 or 688? A lookup that failed after three tries is left out of that record's line, so the base varies by one to three domains. ### Will the study be repeated? Yes, with the same list size, script and records, so the figures form a dated series; each update is logged on our updates page. **In summary** - 1,000 most popular domains (Tranco, 11 November 2026), DNS read on 12 November 2026; 691 receive mail. - Mail domains: SPF 93.9%, DMARC 88.9%, DMARC p=reject 50.2%, p=none 14.3%. - MTA-STS is rare: 5.2% of mail domains, 10% of the top 100; only 30 combine SPF, enforced DMARC and MTA-STS. - Of 306 domains that send no mail, 92 publish DMARC p=reject and 95 an SPF hard fail. - Totals only; the script and raw answers are kept for a repeat of the study. ## Sources and method 1. [Tranco list PY2NJ (top 1M, 13 October – 11 November 2026)](https://tranco-list.eu/list/PY2NJ/1000000) — Tranco (downloaded 2026-11-12) 2. [DNS over HTTPS, JSON API](https://developers.cloudflare.com/1.1.1.1/encryption/dns-over-https/make-api-requests/dns-json/) — Cloudflare (used 2026-11-12) 3. [RFC 7208: Sender Policy Framework (SPF)](https://www.rfc-editor.org/rfc/rfc7208) — IETF (read 2026-11-12) 4. [RFC 8461: SMTP MTA Strict Transport Security (MTA-STS)](https://www.rfc-editor.org/rfc/rfc8461) — IETF (read 2026-11-12) 5. [RFC 7505: A "Null MX" No Service Resource Record](https://www.rfc-editor.org/rfc/rfc7505) — IETF (read 2026-11-12) --- Postelva: Postelva registers domain names for private email — the address you keep when you change provider — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.