"We monitor nine protocols, they monitor three." It's a common DMARC-vendor claim. Here's how to read it.
Protocol count is real, but it isn't the same as value.
Of the six we measured across 5.5M domains, three carry almost all the weight — SPF, DKIM, DMARC — and the advanced layers are rare: MTA-STS at 0.3%, BIMI at 0.4%, DANE at 30 domains total (Feb 2026).
A protocol almost nobody runs is easy to list and rarely the thing between you and a spoof.
The claim that matters isn't breadth — it's whether a tool gets you from p=none to enforcement without breaking mail.
That's the work most of the internet still hasn't done.
What to do: when you read a feature list, ask which items move your policy forward and which just make the list longer.
Count outcomes, not protocols.
How to compare on outcomes:
#DMARC #EmailSecurity