DMARC Adoption Is Rising. Is Protection Keeping Up?

Executive takeaway

Publishing DMARC does not prove that receivers reject impersonated email. The 2026 studies cover different populations, so their headline percentages cannot establish a global trend. Sendmarc’s fixed panel offers a stronger comparison: publication increased more percentage points than reject-policy adoption. However, that widening gap includes quarantine policies and does not directly measure exposure or successful attacks.

Security teams should inspect policy settings, coverage, and subdomains—not just record presence. Buyers evaluating research should ask what was scanned, when, and whether “enforcement” includes quarantine. DMARC remains one layer of email security, not protection against every email threat.

A DMARC record is only the starting line

Publishing a DMARC record does not necessarily request action against messages that fail authentication. An EasyDMARC-sourced count reported by DMARC Report identified 937,931 domains with valid records in early 2026. More than 525,996 used p=none: a monitoring policy, not a request to block messages.

More than half of those records therefore remained at the monitoring stage. That distinction frames the central question: how much published adoption translates into stronger policy?

DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. Domain owners publish its instructions in a Domain Name System (DNS) record. Receiving mail servers consult those instructions when messages fail DMARC authentication.

The record’s p= field specifies the requested action:

• p=none: monitor: Requests no special handling because of a DMARC failure. Reporting, when configured, helps owners understand mail using their domain.
• p=quarantine: treat as suspicious: Asks receivers to place failing messages in spam or otherwise isolate them.
• p=reject: refuse delivery: Asks receivers to reject messages that fail DMARC authentication.

These are requested actions, not guaranteed outcomes. Receiving systems make the final handling decision. A published policy therefore does not establish what happened to a particular message.

Monitoring provides useful visibility before owners request stricter handling. But visibility and blocking serve different purposes. A valid record can support reporting without requesting quarantine or rejection.

Likewise, p=reject does not prevent every email attack, and an absent record does not establish that other defenses are missing. Adoption counts measure publication. Assessing configured protection requires examining what those records request.

Why apparently conflicting adoption numbers can coexist

An adoption percentage is meaningful only when its population and denominator are clear. The 2026 studies examine different domain groups, and their enforcement headlines do not always measure the same thing.

DDMARC’s July 1, 2026 snapshot targeted the top 10,000 domains in the Tranco ranking. It resolved 8,907 domains and reported 68.2% DMARC publication. Among adopters, 73% used quarantine or reject policies—the study’s enforcement category.

DMARCguard’s February 2026 scan covered the broader, 5.5-million-domain Tranco list. It reported 30.4% publication, while 12.8% of the entire scanned population used enforcement policies. Comparing that 12.8% directly with DDMARC’s 73% would confuse population-wide enforcement with enforcement among publishers.

A publisher-based comparison requires a calculation: 12.8 ÷ 30.4 ≈ 42.1%. This estimates enforcement among DMARCguard’s adopters from two rounded percentages; it is not a separately reported measurement. The resulting estimate remains below DDMARC’s 73%, although matching denominators does not make the cohorts equivalent.

CyberFurl’s million-domain cohort reports enforcement both ways: 19.4% of publishers and 8.7% of the overall population. These figures describe the same cohort through different denominators, not conflicting assessments of its security.

The comparisons answer three distinct questions:

• Publication across studied domains: 68.2% in DDMARC’s top-domain snapshot versus 30.4% in DMARCguard’s broader scan.
• Enforcement among publishers: 73% for DDMARC, approximately 42.1% calculated for DMARCguard, and 19.4% for CyberFurl.
• Enforcement across the overall population: 12.8% for DMARCguard and 8.7% for CyberFurl.

Shared ranking origins do not make the Tranco samples interchangeable. Selecting the top 10,000 yields a different cohort from scanning 5.5 million domains. Unresolved domains also affect coverage. Because the snapshots occurred in February and July 2026, their contrast cannot isolate population differences from temporal change.

The top-domain snapshot reports higher publication and publisher-level enforcement, but these scans do not establish why. Domain prominence, organizational resources, and other cohort differences remain possible explanations rather than demonstrated causes. Neither the broader Tranco scan nor CyberFurl’s cohort represents every internet domain.

Do not average these studies into one adoption score or arrange them as a progress trend. Match denominators first, then examine population, timing, coverage, and policy definitions. Measuring change requires a more stable comparison.

Source: DDMARC and DMARCguard, 2026

Publication and enforcement rates shift dramatically depending on which domains are counted and how enforcement is defined. Method: Compiled directly from each study’s reported headline statistics; no recalculation except where separately labeled in the text.

The same domains reveal a widening reject-policy gap

By June 2026, 71.5% of Sendmarc’s tracked domains published DMARC, while 26.6% used p=reject. The calculated difference was 44.9 percentage points, measured across the same domain population.

The 2026 Cyberthreat Report follows 34,212 identical domains at three checkpoints: June 2024, June 2025, and June 2026. This fixed panel provides the clearest longitudinal comparison in the supplied evidence. Its changes cannot simply reflect replacing one year’s sample with a different set of domains.

Historical comparison—June 2024: the reported two-year increases imply publication near 48.6% and reject-policy adoption near 12.6%. These are calculated baselines, not directly supplied observations. They subtract increases of 22.9 and 14 percentage points from the respective June 2026 values.

The same arithmetic places the historical publication-to-reject gap at roughly 36.0 percentage points. By June 2026, it had widened to 44.9 points—an increase of approximately 8.9 points.

Reject-policy adoption therefore did not stall. Both measures increased, but publication gained more percentage points. A larger share of the full panel consequently published DMARC without requesting rejection.

That gap is not a measure of wholly unprotected domains. It includes publishers using quarantine, as well as those using monitoring policies. Nor does a widening percentage-point gap establish that a smaller proportion of publishers used reject. Absolute differences and publisher-level proportions answer different questions.

The report also draws on 1,207 implementation projects. That count alone establishes neither a typical rollout duration nor why the panel’s gap widened. The supplied evidence does not show which domain-level transitions contributed most to the aggregate change.

A stable panel strengthens comparison over time without proving global representativeness or security outcomes. The defensible conclusion is narrower: among these 34,212 domains, publication advanced faster in percentage-point terms than reject-policy adoption.

Tracking the identical cohort of domains across two years shows enforcement rising more slowly than publication, widening the gap. Method: 2024 baseline values calculated by subtracting Sendmarc’s reported percentage-point increases from its reported 2026 endpoints.

The same publication-versus-enforcement gap appears at very different scales; highest-traffic domains enforce far more often than the broader domain population. Method: Figures taken directly from each study’s published headline statistics.

Company size does not settle the protection question

Company size alone cannot settle the protection question. Fortune 500 benchmarks use different measures, and the supplied evidence cannot fully reconcile their results.

DMARC Report’s analysis of EasyDMARC data puts Fortune 500 publication above 95% and enforcement above 80%. The supplied evidence does not confirm that enforcement category’s precise policy breakdown. It should not be presented as a reject-only measure.

CyberFurl’s Fortune 500 scan reports 42.1% adoption of p=reject. Unlike an unspecified enforcement category, this measures a particular policy. The remaining 57.9% should not automatically be described as completely exposed: absence of reject does not establish absence of other defenses.

Digital Applied’s benchmark reports publication above 75%, with roughly 35% of published records using reject. That denominator differs from CyberFurl’s whole-cohort percentage, so the two reject figures cannot be compared directly.

Definitions explain why these measures are not interchangeable, but they do not fully reconcile the reports. The publication claims—above 95% and above 75%—also provide different levels of precision, although both could be true. Cohort selection, timing, and methodology remain possible explanations, not established causes of the differences.

The Accounting Today review of small accounting firms offers a narrower implementation snapshot. Its findings require three explicit denominators:

• 29% of sampled firms had SPF, enforced DMARC, and DKIM together—the combined configuration assessed.
• 34% of sampled firms requested quarantine or rejection.
• 45% of firms with a DMARC policy used none.

SPF identifies authorized sending servers; DKIM supplies a cryptographic message signature. Their combination with enforced DMARC measures a broader configuration than the policy request alone. The 29% and 34% figures therefore assess different criteria, while the 45% figure covers only policy holders.

This sector-specific sample cannot establish how all small businesses configure email security. Nor can these heterogeneous benchmarks support a simple protection ranking of large companies against small firms. They compare measured configurations, not observed resistance to attacks.

Source: Accounting Today, 2026

DMARC is one layer of email security

DMARC addresses only part of email security. In DDMARC’s 2026 top-domain study, just 0.7% deployed all five controls in its defined bundle: SPF, enforced DMARC, MTA-STS, TLS-RPT, and BIMI. This is not a universal test of complete email security. The study targeted 10,000 domains but resolved 8,907, so its headline should not imply complete coverage of the intended cohort.

The bundle combines controls with distinct purposes. Sender authentication, transport protection, reporting, and logo display are not interchangeable defenses:

• SPF identifies servers authorized to send email for a domain. It provides an authentication signal, not transport protection.
• Enforced DMARC requests quarantine or rejection when messages fail its authentication and domain-alignment checks.
• MTA-STS sets requirements for encrypted, authenticated connections between mail servers. It does not establish message trustworthiness.
• TLS-RPT reports transport-encryption problems. Reporting helps operators identify failures but does not itself enforce secure connections.
• BIMI supports brand-logo display in compatible inboxes. A displayed logo is not a guarantee of message safety.

These complementary controls remained uncommon in DDMARC’s sample: MTA-STS reached 2.6%, TLS-RPT 3%, and BIMI 9.5%. Their different functions limit what a single “complete stack” percentage can reveal about protection.

Infrastructure also correlated with DMARC publication in the same study. Managed-provider domains reached 87.5–95.5% adoption, compared with 28.7% for self-managed servers. This association does not establish causation. Organizational resources or differences in customer composition could also contribute.

Provider requirements add another distinction: baseline compliance is not necessarily reject-policy adoption. Sendmarc’s report describes Cloudflare Email Routing’s SPF-or-DKIM requirement and DMARC recommendation. It also describes an announced phased rollout toward p=reject at GMX, WEB.DE, and mail.com in May 2026. These requirements target different implementation stages; an announcement alone does not establish completed deployment.

Check the policy, then check the benchmark

Check the configuration before treating publication as protection. A record establishes presence; its policy and scope describe the action requested from receiving servers.

Use this checklist when reviewing your domains:

• Confirm record presence. Absence means no published DMARC policy—not necessarily an absence of other email defenses.
• Read p=. Distinguish monitoring (none), requested quarantine (quarantine), and requested rejection (reject). Sendmarc’s adoption report separates publication from reject-policy adoption.
• Check any reported pct= restriction. A partial setting qualifies policy coverage. It does not describe a percentage of all outgoing mail guaranteed to be blocked.
• Check subdomain treatment. Inspect sp= where present, or determine the applicable inherited policy. Do not assume a primary domain’s headline classification fully describes its subdomains.

Read the following figure as a simplified policy guide, not a complete receiver algorithm. It describes requested treatment rather than guaranteed handling.

Record or policy	Simplified interpretation
No DMARC record	No published DMARC policy
p=none	Monitoring posture; no requested DMARC enforcement
p=quarantine	Requests quarantine for messages failing DMARC
p=reject	Requests rejection for messages failing DMARC
Reported pct= restriction	Qualifies policy coverage
sp= or inherited policy	Determines the applicable subdomain policy

Apply the same scrutiny to adoption benchmarks. The broad population in DMARCguard’s research differs substantially from top-domain and sector-specific samples. Before using a headline percentage, establish:

• Population: Which domains were selected, and how? Prominent websites, sector samples, and broad scans answer different questions.
• Scan date: When were observations collected? Publication year alone does not establish comparable measurement dates.
• Denominator: Does the percentage cover all targeted domains, resolved domains, or only DMARC publishers?
• Enforcement definition: Does enforcement combine quarantine and rejection, or count rejection alone?
• Unresolved domains: Were failed lookups excluded, counted as missing records, or reported separately? Did that treatment change between scans?

For internal tracking, follow a stable cohort and report publication, quarantine, and rejection separately. Keep dates, coverage restrictions, and unresolved results visible. Document additions and removals rather than silently changing the denominator.

The evidence supports progress in publication and reject-policy adoption, but not a single global protection score. Measure configured policy, coverage, and subdomain treatment. Assess actual security outcomes separately rather than treating record presence as proof that protection has caught up.

A practical sequence for judging whether a domain’s DMARC setup actually blocks spoofed mail, not just whether a record exists. Method: Derived from the DMARC protocol fields (p=, pct=, sp=) described across the cited 2026 studies; this is an interpretive guide, not new survey data.

Limitations

• This review relies on supplied summaries, mostly of commercial vendor research. Underlying source text, scan methods, and raw datasets were not independently verified.
• Different populations, scan dates, denominators, and enforcement definitions prevent a defensible pooled adoption rate. Unresolved DNS lookups may also affect coverage.
• The DMARCguard publisher-level enforcement rate and Sendmarc historical baselines are calculations from reported figures, not independently observed measurements.
• Some supplied source details conflict. The census headline and chronology of the Q3 mail-pass statistic require verification; neither statistic is used here.
• DNS scans describe published policies, not guaranteed receiver behavior or measured reductions in successful attacks. A stable panel improves longitudinal comparison without establishing global representativeness.

References

1. 2026 Cyberthreat Report: DMARC Adoption Trends | Sendmarc
2. State of Email Security 2026 — DMARC Adoption Data | DDMARC
3. The State of DMARC Adoption in 2026:938000 Domains …
4. Only a third of small firms actively block email spoofing their domain
5. DMARC Adoption 2026: 30.4%, DKIM 22.7% of 5.5M
6. DMARC Adoption Intelligence Insight 2026: Global Email …
7. Email Deliverability Benchmarks 2026: Industry Report