REPORT · 17 OCTOBER 2026

Email security of the top 1,000 websites.

We read the SPF and DMARC records of the 1,000 most popular domains on the web. Four in ten still let anyone send email in their name without being blocked.

Key findings

39.3% of the top 1,000 domains do not enforce DMARC: 27.5% publish no DMARC record and 11.8% publish one at p=none, which only collects reports.
Among the 686 domains that receive email, 25.3% still do not enforce DMARC (10.6% missing, 14.7% at p=none).
Of the 314 domains that do not receive email, 64.3% have no DMARC record and only 22.9% are fully locked down with SPF -all and DMARC p=reject. A domain that never sends mail can still be used to fake it.
Popularity barely matters: enforcement among mail domains is 76.1% in the top 100 and 73.7% in ranks 501–1,000.
No SPF record ended in +all, but 3 domains publish more than one SPF record, which receivers treat as an error.

DMARC policy, all 1,000 domains

Policy	Domains	Share
`p=reject`	437	43.7% 43.7%
`p=quarantine`	169	16.9% 16.9%
`p=none`	118	11.8% 11.8%
No record	275	27.5% 27.5%
Invalid record	1	0.1% 0.1%

SPF, the 686 domains that receive email

SPF ending	Domains	Share
`-all` (reject unlisted senders)	340	49.6% 49.6%
`~all` (mark as suspicious)	258	37.6% 37.6%
Other ending (`?all`, redirect)	44	6.4% 6.4%
No SPF record	41	6.0% 6.0%
More than one SPF record	3	0.4% 0.4%

DMARC enforcement by popularity, mail domains

Rank	Mail domains	Quarantine or reject
1–100	67	76.1% 76.1%
101–250	93	78.5% 78.5%
251–500	165	73.9% 73.9%
501–1,000	361	73.7% 73.7%

What this means for your own domain

If the most visited domains on the web leave gaps, smaller ones usually do too. Three checks cover most of the risk:

Publish exactly one SPF record that ends in -all or ~all and lists every service that sends for you.
Publish DMARC, read the reports for a few weeks, then move from p=none to quarantine or reject.
For domains that never send email, publish SPF v=spf1 -all and DMARC p=reject so nobody can borrow them.

Check your domain free

The check takes a few seconds, needs no sign-up and shows SPF, DMARC, MX and registration expiry. To have these records watched every day, with an email when they change, see Domain Watch plans.

Method

Domains. The first 1,000 entries of the Tranco top-1M list (list ID 64VVX, downloaded 17 October 2026). Tranco ranks registrable domains, so it includes infrastructure and CDN domains as well as consumer brands.

Lookups. On 17 October 2026 at 19:13 UTC we queried TXT records for each domain and for _dmarc. plus the domain, and its MX records, through Cloudflare's DNS-over-HTTPS resolver. All 1,000 domains answered.

Classification. A domain "receives email" when it has MX records other than a null MX (0 .). DMARC policy is the p= tag of the apex record. SPF is grouped by its all mechanism. We did not check DKIM, BIMI or MTA-STS, and a policy in DNS is not proof of how receivers handle mail.

Data. Rank, domain, whether it receives mail, SPF and DMARC class for every domain: email-security-top-1000-2026-10.csv (CSV, 1,000 rows). Free to reuse with a link to this page.