In February I scanned the full Tranco Top Sites list, 5,499,028 domains, for email authentication records. The headline: fewer than half of the domains that publish DMARC enforce it.
The numbers (DMARC Adoption 2026, scanned 27 February 2026)
30.4% publish a DMARC record.
12.8% enforce it with p=quarantine or p=reject.
56.0% publish SPF, the most widely deployed of the protocols measured.
At least 22.7% publish DKIM at one of six common selectors. That's a floor, because other selectors weren't probed.
What the gap means
For every 100 domains with DMARC, about 42 enforce. The other 58 don't ask receivers to quarantine or reject mail that fails, so what happens to spoofed mail is left to each receiver's own judgment.
p=none is the right first step. It turns on reporting without affecting delivery. It's a poor place to stay, because on its own it doesn't stop anything. If you want a staged rollout, the current standard (RFC 9989) uses t=y for testing; the old pct tag was removed.
Why domains stall
What usually holds a domain at p=none is uncertainty, not DNS: nobody is sure which legitimate services send as the domain, so nobody wants to be the one who breaks invoicing or password resets. The aggregate reports answer that question, if they're collected and read.
What to do
Look up your DMARC record.
If it says p=none, take the last month of aggregate reports and list every source that sends as your domain.
Fix SPF or DKIM alignment for the ones you recognize. Investigate the ones you don't.
Move to p=quarantine, watch the reports, then move to p=reject.
The study, with aggregate data and full methodology, no email required: https://dmarcguard.io/research/email-authentication/?utm_source=buymeacoffee&utm_medium=social&utm_campaign=social-2026-w45&utm_content=1106-eu-adoption