GoKawiilanalysis
DMARC has existed since 2012. It is a free DNS record that tells receiving mail servers what to do with email that fails to authenticate as coming from your domain: report it, quarantine it, or reject it outright. It is primarily concerned with unauthorised use of a domain in the visible From address; it doesn't stop lookalike-domain registrations, display-name spoofing, or a phishing email sent from a compromised legitimate account. Fourteen years on, we checked the DNS records for 67,336 domains in CipherCue's tracked entity set between 2026-04-14 and 2026-07-28. This is a snapshot of CipherCue's dataset, not a statistically representative sample of every company worldwide; the method note below covers how the cohort is built. 30,362 of them (45.1%) still don't have a record.
The domains that do have a record are not much further along. Only 10,963 (29.7% of domains with a record) actually enforce anything: p=reject , mail that fails authentication gets dropped. 10,258 (27.7%) sit at p=quarantine , junk folder but not blocked. The largest single group, 15,709 domains (42.5%), is set to p=none . A p=none policy collects authentication data and aggregate reports but does not ask receiving mail systems to quarantine or reject messages that fail DMARC. In this analysis, enforcement means a published policy of p=quarantine or p=reject ; domains using p=none are counted as non-enforcing.
42.5% of domains with a DMARC record are still at p=none, collecting reports but not requesting quarantine or rejection, as of our most recent observation window
p=none is meant to be a temporary monitoring phase before you move to enforcement, typically a few weeks. Fourteen years after the standard shipped, for the largest single group of domains in our data, it looks like the permanent state.
Put the two together and the picture is starker than either number alone: of all 67,336 domains we checked, 46,071 (68.4%) either have no DMARC record or have one that doesn't enforce a policy. Publishing a DMARC record is no longer the main adoption gap in this dataset; moving from monitoring to enforcement is.
68.4% of all domains checked have no DMARC record, or have one that does not enforce a policy (no record: 45.1%; record present but p=none: 23.3% of the total)
The policy breakdown, in full
30,362 No record 45.1% 15,709 p=none 23.3% 10,258 p=quarantine 15.2% 10,963 p=reject 16.3% Share of all 67,336 domains checked, not just those with a record
State Domains Share of all checked Share of domains with a record No DMARC record 30,362 45.1% n/a p=none (monitor only) 15,709 23.3% 42.5% p=quarantine 10,258 15.2% 27.7% p=reject (full enforcement) 10,963 16.3% 29.7%
... continue reading