DMARC adoption in 2026 tells a story of two internets. Among the largest companies, a DMARC record that actually rejects spoofed mail is now normal. Among everyone else, a record exists but does little. Two independent 2026 studies measure the gap from different angles, and together they show where the protocol stands, why the 2024 to 2025 mailbox-provider rules mattered, and what the next phase of email authentication is likely to look like.
What the data says
The EasyDMARC 2026 DMARC Adoption and Enforcement Report analysed the top 1.8 million domains plus the Fortune 500 and Inc. 5000 against snapshots from 2023 and 2025. Its main figures:
| Measure | 2023 | 2025 | Early 2026 |
|---|---|---|---|
| Top 1.8M domains with a valid DMARC record | 29.1% | 47.7% | 52.1% |
| Domains at an enforcement policy (quarantine or reject) | 233,249 domains | — | 411,935 domains (22.9%) |
| Domains at p=none | — | — | 29.2% (525,996) |
| p=reject with aggregate reporting | — | — | 8.9% (159,691) |
For large companies the picture is stronger: 475 of the Fortune 500 (95%) had a valid record, and more than 80% had moved to enforcement. Among the Inc. 5000, 4,066 companies had a record, but more than half remained at p=none. In other words, adoption rises with company size and resources, and the middle of the market is where the gap sits.
A second study, Palisade's State of DMARC 2026, scanned 99,310 domains from the Tranco top 100,000 on 13 August 2026. It found 58.1% publishing DMARC, and of those, 64.0% at quarantine or reject (about 37% of all observed domains). Enforcement fell with popularity rank: 83.4% in the top 1,000 band, down to 57.4% in the 90,000 to 100,000 band. It also found that 20.5% of publishers had no rua reporting address, meaning they published a policy without any way to see what it was doing.
Why the numbers differ. The two studies used different samples (a 1.8 million domain list versus the top 100,000 by Tranco rank), different dates and different definitions. They agree on the shape, not the decimals: more than half of popular domains publish DMARC, a sizeable share sits at p=none, and enforcement drops as you move down the popularity ranking.
Why a record is not protection
A p=none policy tells receivers to take no action on mail that fails DMARC. It is a monitoring mode, and a necessary first step, because it lets you collect aggregate reports and discover every system that sends on your behalf. But a domain that stays there is not protected against spoofing. Anyone can send mail that claims to be from it, and a receiver following the published policy will treat it like any other message.
So why do so many domains stay at p=none? The reasons are usually operational rather than technical:
- Unknown senders. Marketing platforms, billing systems, help desks, CRM tools and forgotten scripts all send as the domain. Move to reject too early and legitimate mail fails.
- Nobody owns it. DMARC sits between security, IT and marketing, and the aggregate reports go to an inbox nobody reads. The Palisade finding that one in five publishers has no reporting address is consistent with this.
- Fear of breaking mail. Forwarding, mailing lists and third-party senders can break alignment, and the cost of a wrong move is lost mail.
The practical path is well understood: publish p=none with a reporting address, inventory senders, fix alignment, move to quarantine at a low percentage, then to reject. We walk through the steps in our guide to reading aggregate reports and moving to reject.
The role of the provider rules
Much of the growth since 2023 lines up with the arrival of mailbox-provider requirements. Gmail and Microsoft both require a DMARC record, at least p=none, for bulk senders, and EasyDMARC's rise from 29.1% to 52.1% of the top 1.8 million domains over three years is consistent with that pressure. We cannot prove cause and effect from these datasets: Palisade's report explicitly does not measure the impact of those requirements, and neither study has a controlled comparison. But the timing is hard to ignore.
Notice what the rules asked for, though: a record, not enforcement. The minimum bar is p=none, which is why adoption has grown faster than protection. That gap is the next phase of the story. For more on the rules themselves, see our analysis of bulk-sender enforcement.
What comes next
Enforcement becomes the new baseline
Once most bulk senders have a record, the natural next step for providers and security teams is to ask what the record does. Our view, labelled as a forecast, is that over the next two to three years the conversation will move from "do you have DMARC" to "are you at reject". Large senders are already there; the question is how quickly the long tail follows. Brand indicators accelerate the trend, because BIMI requires an enforced policy before a logo can appear. See our BIMI setup guide.
Reporting becomes the product
Aggregate reports are XML files that few people want to read. The hard part of DMARC has always been turning them into decisions: which sender is unauthenticated, which is misaligned, which is a real threat. Expect tooling to continue shifting from raw reports to automated recommendations, with alerts when a new source starts sending as your domain. A domain with enforcement but no monitoring is a latent outage.
Machine readers raise the stakes on identity
As inboxes add AI features, the value of verifiable sender identity grows. A model that summarises, prioritises or acts on mail needs a reliable answer to "who sent this?" We examine that angle in our piece on Gmail's Gemini features. This is speculation about direction, not a statement about any provider's plans, but the logic is straightforward: authenticated mail is easier to trust automatically.
The small-sender squeeze
The data shows enforcement is least common among smaller and lower-ranked domains. Those senders are also the least likely to have dedicated security staff. We expect a market for managed DMARC, where a provider handles the DNS changes, report parsing and gradual tightening on the customer's behalf. Sending platforms are well placed to help, because they can see which of a customer's streams are already aligned.
A 90-day plan for a domain at p=none
- Week 1: confirm reporting. Make sure your record has a
ruaaddress that someone actually monitors. If you have none, add it first; you cannot manage what you cannot see. - Weeks 2 to 4: inventory. List every system that sends as your domain from the reports. Identify the owner of each.
- Weeks 4 to 8: fix alignment. Configure DKIM signing with your own domain for each legitimate sender and tidy SPF. Check the ten-lookup limit as you add services.
- Weeks 8 to 10: quarantine at low percentage. Use the
pcttag to apply the policy to a small share of failing mail and watch for surprises. - Weeks 10 to 12: raise to reject. Increase gradually and keep monitoring. After that, review whenever you add a sending service.
The timeline is illustrative. Domains with a handful of senders may finish sooner; large organisations with many systems will take longer.
Bottom line
The most useful reading of the 2026 data is that DMARC has won the adoption argument and is now losing the enforcement argument by default. Over half of popular domains publish a record. A large minority stop at monitoring. The next gains in email security will come not from more records but from more rejected spoofing, and the senders that get there first will find themselves ahead on deliverability, brand protection and, soon enough, trust with machine readers.
Not sure where your domain stands? Our guide shows how to read your first aggregate report and plan the move to enforcement.
Sources
Frequently asked questions
What percentage of domains have DMARC in 2026?
EasyDMARC found a valid record on 52.1% of the top 1.8 million domains in early 2026. Palisade found 58.1% among the Tranco top 100,000 in August 2026. The samples and dates differ.
How many domains enforce DMARC?
EasyDMARC reports 22.9% of its sample at quarantine or reject. Palisade reports 64.0% of publishers in its sample at enforcement, about 37% of all observed domains.
Is p=none enough?
It is a monitoring mode. It lets you collect reports but does not tell receivers to act on spoofed mail, so it does not protect the domain from spoofing.
How long does moving to p=reject take?
It depends on how many systems send as your domain. A domain with a few senders may finish within weeks; a large organisation can take months. Our illustrative plan assumes about 90 days.