--- title: "DMARC Adoption Numbers Disagree. Here’s How To Read Them. | AutoSPF" description: "Understand why 2026 DMARC adoption statistics differ and how to compare enforcement rates, domain populations, and authentication metrics accurately." image: "https://autospf.com/og/blog/dmarc-adoption-numbers-disagree-here-s-how-to-read-them.png" canonical: "https://autospf.com/blog/dmarc-adoption-numbers-disagree-here-s-how-to-read-them/" --- Quick Answer DMARC adoption statistics vary because studies use different domain populations, sampling methods, and enforcement definitions. To compare results accurately, examine publication rates, valid records, enforcement policies, and denominators separately. ## Try Our Free DMARC Checker Validate your DMARC policy, check alignment settings, and verify reporting configuration. [ Check DMARC Record → ](/tools/dmarc-checker/) Share [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fdmarc-adoption-numbers-disagree-here-s-how-to-read-them%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=DMARC%20Adoption%20Numbers%20Disagree.%20Here%E2%80%99s%20How%20To%20Read%20Them.&url=https%3A%2F%2Fautospf.com%2Fblog%2Fdmarc-adoption-numbers-disagree-here-s-how-to-read-them%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fdmarc-adoption-numbers-disagree-here-s-how-to-read-them%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Fdmarc-adoption-numbers-disagree-here-s-how-to-read-them%2F&title=DMARC%20Adoption%20Numbers%20Disagree.%20Here%E2%80%99s%20How%20To%20Read%20Them. "Share on Reddit") [ ](mailto:?subject=DMARC%20Adoption%20Numbers%20Disagree.%20Here%E2%80%99s%20How%20To%20Read%20Them.&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Fdmarc-adoption-numbers-disagree-here-s-how-to-read-them%2F "Share via Email") ![DMARC Adoption Statistics Analysis](https://media.mailhop.org/autospf/creating-spf-record-9356-1794472155998.jpg) ## Executive takeaway DMARC statistics answer different questions, even when their headlines sound interchangeable. Broad domain scans, corporate cohorts, and message telemetry measure different populations. Publication, valid configuration, enforcement, and authentication also represent distinct states. Before quoting a percentage, identify who was counted, what qualified, and which denominator was used. Compare it with your own inventory only when those rules align. The goal is not to beat a convenient average. It is to identify remaining configuration gaps while checking that legitimate mail authenticates correctly. ## Two DMARC headlines can both be right One 2026 study reports DMARC enforcement at **12.8%**; another reports **63%**. _The first, DMARCguard’s broad scan, covers roughly 5.5 million domains from the Tranco Top Sites list_. The second examines 500 primary corporate domains belonging to [Fortune Global 500](https://en.wikipedia.org/wiki/Fortune%5FGlobal%5F500) companies. [SimpleDMARC’s June 2026 scan](https://simpledmarc.com/research) reports enforcement on 63% of those domains—not across their companies’ entire domain portfolios. Both findings can be right without measuring the same thing. Each describes a selected population rather than one **universal enforcement rate**. Their compatibility does not independently establish either study’s accuracy. The central question is therefore not simply “Which number should we believe?” It is “Which statistic can meaningfully benchmark our organization?” Apply three checks before choosing one: - **Population:** Who was studied, and how were domains selected? A **primary corporate domain** differs from a complete corporate domain portfolio. - **Definition:** What qualifies as adoption, enforcement, or protection? Record publication does not necessarily request action against [authentication failures](https://www.computerworld.com/article/4221257/connectwise-patches-critical-screenconnect-authentication-failure-after-five-days.html). - **Denominator:** What forms the base of the percentage? All scanned domains, only adopters, and observed messages answer different questions. DMARC—Domain-based Message Authentication, Reporting, and Conformance—lets domain owners publish instructions for handling messages that fail its authentication checks. Here, an enforcing policy requests quarantine or reject, rather than monitoring alone. This describes a published configuration, not a measured security outcome. Even an unchanged sample can produce different headlines when the denominator changes. [DMARC Report’s methodological explainer](https://dmarcreport.com/blog/why-2026-email-authentication-numbers-don-t-agree/) distinguishes enforcement among adopters from enforcement across every domain scanned. Both percentages can describe exactly the same enforcing domains. **Message statistics introduce a different unit of analysis**: [email traffic](https://emailanalytics.com/email-traffic/) rather than domains. High authentication pass rates can coexist with low domain-level enforcement. Neither measure alone establishes whether impersonation, fraud, or other harms declined. This article separates those questions using the supplied 2026 findings. _It treats reported counts as evidence about specific cohorts, labels derived calculations, and avoids interpreting configuration as a universal protection score._ ![Spf Record Checker 1632](https://media.mailhop.org/autospf/spf-record-checker-1632-1794471668305.jpg) _Side-by-side view of how major 2026 DMARC studies use different denominators, leading to divergent publication and enforcement percentages. Method: Table summarizing sample size, population type, DMARC publication, and whole-population enforcement for five prominent 2026 studies: DMARCguard’s full Tranco scan, DDMARC’s top-10,000 subset, EasyDMARC’s top-1.8M panel, DmarcDkim.com’s global dashboard, and the Domain Security Census, using their reported values without normalization._ ## Who gets counted changes the result **Population selection and exclusion rules** affect percentages separately. DMARCguard and DDMARC illustrate both effects. They begin with different portions of Tranco’s website rankings, then handle unsuccessful lookups differently. [DMARCguard’s February 2026 scan](https://dmarcguard.io/research/email-authentication/) covered 5,499,028 domains. It found [DMARC records](https://autospf.com/dmarc-record-generator/) on 1,670,975 domains, yielding **30.4% publication** across the full panel. Quarantine-or-reject enforcement covered 702,246 domains, or **12.8%**. ![Spf Record Syntax 6123](https://media.mailhop.org/autospf/spf-record-syntax-6123-1794471753551.jpg) _Source: DMARCguard, February 2026_ [DDMARC’s 2026 study](https://ddmarc.com/research/state-of-email-security-2026/) started with Tranco’s top 10,000 entries and calculated percentages over 8,907 resolved domains. Within that retained group, **68.2% published DMARC**, while **49.9% published quarantine or reject policies**. Those rates describe the resolved subset, not the original list. The first difference concerns **which domains enter the study**. Selecting the top 10,000 concentrates the sample near the top of a website ranking. Scanning millions covers a broader population, but neither sample represents every registered domain. Website rank also does not establish email activity. It does not reveal whether a domain sends email, its sending volume, or its email services. Differences in email use could matter, but these percentages do not establish that explanation. The second difference concerns **which entries remain in the denominator**. DDMARC excluded 1,093 entries, approximately 10.9% of its starting list. Its [methodological description](https://ddmarc.com/research/) identifies exclusions involving non-resolving, parked, or unregistered entries. _By contrast, DMARCguard reportedly treats failed lookups as “no record,” retaining those domains in its denominator._ An unsuccessful lookup and a confirmed absence are not identical observations. Combining them produces a different measure from excluding unresolved entries. An illustrative calculation isolates DDMARC’s denominator effect. Keeping its positive findings unchanged, but dividing by all 10,000 starting entries, gives approximately **60.7% publication** and **44.4% enforcement**. These calculations multiply the rounded published rates by 8,907 ÷ 10,000; they are not additional scan results. _That adjustment lowers publication by about 7.5 percentage points and enforcement by about 5.5 points_. Both adjusted rates remain substantially above DMARCguard’s findings. Exclusions alone therefore do not explain the headline gap. The adjustment does not make the studies directly comparable. Their populations, lookup procedures, and observation dates still differ. **DMARCguard scanned in February 2026**; DDMARC used a July 2026 Tranco snapshot. These are not repeated measurements of an unchanged cohort. The defensible comparison keeps each rate attached to its population and counting rule. One describes a broad panel retaining failed lookups; the other describes resolved top-10,000 entries. ![Spf Record Example 6319](https://media.mailhop.org/autospf/spf-record-example-6319-1794471801423.jpg) _Key DMARCguard metrics show that only a minority of Tranco-ranked domains both publish DMARC and request enforcement. Method: Stat-style figure drawing on DMARCguard’s February 2026 scan of 5,499,028 Tranco-ranked domains, highlighting the share with any DMARC record and the share that publish quarantine or reject policies across the full population._ ## A DMARC record is not the same as enforcement **A published DMARC record** is not necessarily an enforcing policy. Record presence, validity, and requested action answer separate questions: - **Publication:** Does a DMARC record exist in DNS, the system storing domain configuration? Presence alone need not establish validity. - **Valid configuration:** Is the record correctly formed and usable? A valid record can still request no enforcement. - **Quarantine-or-reject enforcement:** Does the policy request either action against messages that fail DMARC? Studies often combine these policies. - **Stricter reject-based thresholds:** Does the policy request rejection, potentially at full coverage and with reporting enabled? These measures exclude some configurations counted by **broader enforcement statistics**. DMARCguard’s 2026 findings illustrate the distinction within one population: 30.4% publication versus 12.8% quarantine-or-reject enforcement. The publication rate cannot substitute for the enforcement rate. A policy of `p=none` requests no enforcement action under [DMARC](https://autospf.com/blog/dmarc-test-email-before-launching-email-campaigns/). It does not mean messages cannot authenticate or that every message from the domain fails. Authentication results and the requested response to failure are separate dimensions. DmarcDkim.com’s dashboard uses its own protection categories. The supplied late-2026 summary describes 1,446,724 monitored domains as follows: - **11.8% “full protection”:** `p=reject` with `pct=100`, requesting rejection at 100% enforcement. - **20.4% “partial protection”:** quarantine policies or partial enforcement percentages. - **67.8% “no effective protection”:** no record, an invalid record, or `p=none`. These labels describe configuration categories, not guarantees against fraud. Missing, invalid, and monitoring-only records share an absence of requested enforcement, but represent different operational states. _The supplied evidence contains inconsistencies in other dashboard breakdowns, so those breakdowns cannot be combined confidently here._ Reporting adds another qualifying criterion. **RUA aggregate reporting** lets domain owners request summaries of observed authentication results. A reporting destination establishes configuration, not proof that reports arrive, receive review, or lead to corrective action. [DMARC Report’s analysis of EasyDMARC’s panel](https://dmarcreport.com/blog/the-dmarc-adoption-2026-domains-records-only-9-percent-protected/) describes `p=reject` plus RUA reporting as a “gold standard.” This is a stricter configuration threshold, not demonstrated [fraud prevention](https://www.mastercard.com/global/en/news-and-trends/Insights/2026/ai-is-helping-banks-save-millions-by-transforming-payment-fraud-prevention.html). Reject-only findings also require separate treatment. [CyberFurl’s Q1 2026 analysis](https://cyberfurl.com/research/dmarc-adoption-report-2026) reports `p=reject` for 19.4% of DMARC adopters, or about 8.7% of its entire million-domain sample. Those figures exclude quarantine and therefore cannot represent combined enforcement. _Before comparing protection claims, identify the qualifying policy, treatment of partial enforcement, and reporting requirements._ Matching the denominator is insufficient when the qualifying configurations differ. ## How 44% enforcement becomes 22.9% EasyDMARC’s early-2026 panel contained **937,931 valid DMARC records across 1.8 million domains**, according to DMARC Report’s secondary summary. It also identified 411,935 domains with quarantine-or-reject enforcement policies. ![Spf Tester 9567](https://media.mailhop.org/autospf/spf-tester-9567-1794471871221.jpg) _Source: EasyDMARC 2026 panel, as summarized by DMARC Report, 2026_ Those counts produce three useful calculations: - **Valid-record adoption:** 937,931 ÷ 1,800,000 × 100 = **52.1%**, rounded. - **Enforcement among valid-record adopters:** 411,935 ÷ 937,931 × 100 = **43.9%**, or approximately **44%**. - **Enforcement across the full panel:** 411,935 ÷ 1,800,000 × 100 = **22.9%**, rounded. The **enforcing domains** have not changed; the question has. The 44% figure measures enforcement within the group already publishing valid records. The 22.9% figure measures enforcement coverage across the entire panel. Neither ratio establishes movement from monitoring to enforcement during a particular period. They describe a snapshot, not individual domains’ progress. Calling the adopter-level share a “conversion rate” would imply longitudinal evidence that these calculations do not provide. The monitoring-only share completes the configuration picture. [9cv9’s secondary summary](https://blog.9cv9.com/top-112-email-security-software-statistics-data-trends-in-2026/?amp=1) reports that **29.2% of the full panel** used `p=none`. Calculation: subtracting 411,935 enforcing domains from 937,931 valid-record adopters leaves 525,996 domains, approximately 29.2% of the panel. _At the reported precision, 29.2% monitoring plus 22.9% enforcement accounts for the 52.1% valid-record share_. This arithmetic is consistent with the reported monitoring figure; it does not independently verify classifications. A stricter threshold produces a smaller count without contradicting those results. DMARC Report’s EasyDMARC analysis identifies **159,691 domains** meeting its reject-plus-RUA-reporting “gold standard.” Calculation: 159,691 ÷ 1,800,000 × 100 gives approximately **8.9% of the full panel**. Unlike the shift from 44% to 22.9%, this changes the qualifying criteria rather than the denominator. It should not be labelled simply “the enforcement rate.” ![Spf Flattening 8346](https://media.mailhop.org/autospf/spf-flattening-8346-1794471959944.jpg) _Within EasyDMARC’s top-1.8M panel, valid DMARC adoption is common, but enforcement covers less than a quarter of domains while nearly a third sit at `p=none`. Method: Radial chart using EasyDMARC’s 2026 breakout as summarized by DMARC Report and 9cv9, plotting the shares of the 1.8M-domain panel with valid DMARC records, with `p=none`, and with enforcement policies (quarantine or reject)._ The figure’s reference to a quarter of “top domains” needs the same boundary. Here, “top domains” means **this 1.8-million-domain panel**, and 22.9% supports _less than a quarter_. It does not establish enforcement across every ranking or all domains worldwide. These findings come through secondary summaries, not a directly examined EasyDMARC dataset. Their arithmetic is reproducible from the supplied counts, but sampling and classification remain unverified. The clearest headline preserves both denominators: **about 44% of valid-record adopters** enforced DMARC, representing 22.9% of the full panel. ![Email Spf 9245](https://media.mailhop.org/autospf/email-spf-9245-1794471996067.jpg) _In EasyDMARC’s 1.8M-domain panel, roughly one in four domains use enforcement policies, leaving the majority either without DMARC or stuck at `p=none`. Method: Single-metric waffle figure representing the 22.9% share of EasyDMARC’s 1.8M top-domain panel that use DMARC enforcement policies, as calculated from the reported 411,935 enforcing domains._ ## Big brands are a different benchmark Big-brand benchmarks describe selected **flagship domains**, not the average internet domain.SimpleDMARC’s June 2026 Fortune Global 500 snapshot examines 500 primary corporate domains. It does not measure every domain those companies own. Of those domains, 397 published DMARC, yielding **79.4% publication**. The reported policy counts distinguish publication from enforcement: - **240 domains requested rejection:** 48% of all 500 domains. - **75 domains requested quarantine:** 15% of the same denominator. - **315 domains requested either policy: 63% enforcement** across the list. Calculated from those totals, 82 domains published records without either enforcement policy, while 103 lacked records. These differences show why publication cannot serve as shorthand for enforcement. The U.S. Fortune 500 supplies a separate comparison. [JustEmails’ 2026 summary of Agari’s analysis](https://justemails.app/blog/dmarc-adoption-statistics-2026) reports 92% publication, including 34% rejection, 18% quarantine, and 40% monitoring-only policies. Combined enforcement therefore reaches about **52%**. The U.S. figures show higher publication but lower enforcement than the Fortune Global 500 snapshot. This contrast illustrates why broader publication need not imply stricter policy choices. It does not establish which corporate population has better overall email security. The populations differ, and the supplied evidence does not establish identical scan dates or procedures. _Company composition, timing, and measurement remain possible explanations for the contrast—not demonstrated causes_. The Agari findings also reach this analysis through a secondary summary. The gap from **broad-domain surveys** is larger still. DMARCguard’s February 2026 scan reports 12.8% enforcement across 5,499,028 Tranco-listed domains. Comparing that rate with 63% across 500 flagship names reveals different sampled populations, not necessarily conflicting findings. Dedicated security resources and [brand exposure](https://netenrich.com/fundamentals/brand-exposure) could help explain stronger enforcement among large companies. These snapshots do not test those explanations, however, and cannot establish causation. _The flagship-domain boundary matters as much as company size. Subsidiaries, secondary brands, and dormant names fall outside a one-primary-domain-per-company denominator_. Consequently, 63% enforcement does not mean the sampled companies enforced DMARC throughout their portfolios. Use corporate figures to compare **primary-domain policy** choices among large-company peers. A flagship domain can match that benchmark while leaving the organization’s wider domain coverage unanswered. ## Why a high message pass rate proves something else **A high DMARC pass rate** measures observed messages, not domains enforcing DMARC. A stream dominated by authenticated mail can coexist with many domains lacking enforcement. The reported Cloudflare Radar distribution for Q1 2026 was **88.99% pass, 4.33% fail, and 6.68% “none.”** The attribution is indirect: [DMARC Report’s methodological explainer](https://dmarcreport.com/blog/why-2026-email-authentication-numbers-don-t-agree/) cites TechnologyChecker’s summary of Cloudflare Radar. These are reported telemetry figures, not independently verified readings of the underlying dataset. The denominator is observed email traffic rather than unique domains. In a message-weighted measure, senders contribute according to message volume. High-volume senders can dominate the result; low-volume senders contribute little. For example, one hypothetical sender could generate more authenticated traffic than hundreds of smaller domains combined. It could raise the overall pass rate without changing any other domain’s configuration. Dormant domains contribute no outgoing messages during the observation period, yet can still appear in domain scans. This weighting explains why the near-89% pass figure cannot estimate domain-level enforcement. _DMARCguard’s 2026 scan reports 12.8% enforcement across its 5,499,028-domain panel_. The two percentages answer different questions and need not contradict each other. **Passing authentication** also differs from enforcing a policy. A message can pass DMARC while its domain publishes `p=none`. The pass result describes authentication; enforcement describes the requested treatment of failures. Likewise, the reported 6.68% “none” category cannot be interpreted as the percentage of domains without DMARC. _It belongs to the observed message distribution. Without the original category definition, a more specific interpretation would overstate the evidence._ Unspam provides another example involving tested email programs rather than a generic domain inventory. As summarized by DMARC Report, its 2026 findings report **48% DMARC adoption and 63% inbox placement**. Those aggregate figures do not show that adoption caused [inbox placement](https://nhimg.org/glossary/inbox-placement/) or reveal sender-level relationships. Keep three operational questions separate: - **Authentication:** Did observed messages meet DMARC’s authentication requirements? - **Delivery:** Did tested messages reach the inbox? - **Fraud outcomes:** Did impersonation or other [email fraud](https://www.insurancebusinessmag.com/us/news/cyber/business-email-fraud-drives-bulk-of-us-cybercrime-losses-analysis-590687.aspx) succeed, and what harm followed? A pass result alone establishes neither inbox delivery nor harmless content. Read the Cloudflare figure narrowly: most messages in the reported observation passed DMARC, not most domains enforced it. ![Spf Record Lookup 9366](https://media.mailhop.org/autospf/spf-record-lookup-9366-1794472081977.jpg) _Source: Cloudflare Radar, Q1 2026, as summarized through TechnologyChecker by DMARC Report_ ## Trust transparent methods, not impressive sample sizes Transparent methods matter more than impressive sample sizes. A large scan can still obscure selection, exclusions, or classification. _Commercial authorship warrants scrutiny, but does not itself establish weak measurement_. **DDMARC reportedly** publishes a [downloadable CSV and metadata](https://ddmarc.com/research/state-of-email-security-2026.csv) for its 2026 study. Its specified Tranco top-10,000 snapshot becomes an 8,907-domain denominator after exclusions. [Data availability](https://www.tibco.com/glossary/what-is-data-availability) supports scrutiny of those decisions, although this analysis has not inspected the file or independently validated its contents. The supplied evidence describes DMARCguard’s methodology as documenting its sampling frame, scan date, lookup totals, and error handling. Its treatment of failed lookups as “no record” differs from DDMARC’s exclusion approach. Neither rule should disappear when their percentages are compared. The distinction is between **documented decisions and unexamined assumptions**, not simply good and bad studies. Explicit rules let readers assess what results measure. An undefined label such as “global domains” provides little guidance, however large the reported sample. Customer-selection bias likewise requires evidence about recruitment. A customer-based sample could overrepresent organizations already investing in [email security](https://autospf.com/). A vendor’s public-list scan need not share that bias. Neither its presence nor direction follows automatically from the **publisher’s commercial role**. Evaluate three methodological dimensions: - **Selection:** Which list or recruitment process supplied the domains, and what was excluded? - **Measurement:** How were invalid records, failed lookups, and partial enforcement classified? - **Auditability:** Can readers inspect data, reconstruct percentages, and identify the observation period? The Domain Security Census illustrates why scale and numerical agreement require separate scrutiny. [DMARC Report’s secondary account](https://dmarcreport.com/blog/dmarc-divide-big-brands-enforce-while-most-domains-do-not/) describes **332.5 million** graded domains in October 2026\. It reports 25.1% adoption and enforcement among 47.6% of adopters. The supplied evidence lacks enough methodological detail to evaluate that population fully. Multiplying those rates yields approximately 11.9% enforcement across graded domains, assuming compatible definitions. _This is a derived calculation, not independent validation of DMARCguard’s 12.8%_. Similar results do not establish comparable measurement when population construction remains unclear. The evidence also contains a misleading comparison between **reject-only coverage and combined enforcement**. The [DmarcDkim.com dashboard](https://dmarcdkim.com/dmarc-adoption) defines its 11.8% figure as `p=reject` at 100%, not quarantine and reject combined. Grouping those measures creates apparent agreement without matching definitions. A defensible comparison therefore needs transparent methods and equivalent metrics. Large samples and close percentages cannot compensate for missing foundations. ## Choose a benchmark that resembles your portfolio Define your inventory before **choosing an external benchmark**. Specify whether it covers all owned domains, active senders, or customer-facing domains. These categories answer different questions and should not share an unlabelled percentage. _Retain all owned domains in the overall inventory, then create separate views for active and dormant domains_. Treat customer-facing status as another filter because visibility and sending activity differ. Narrower comparisons should not make excluded domains disappear from internal oversight. Evaluate external studies as **candidate comparators**, not automatically suitable peers: - **Enterprise cohorts:** SimpleDMARC’s Fortune Global 500 research measures primary corporate domains. Use it for flagship-domain comparisons, not entire corporate portfolios. - **Broad Tranco panels:** DMARCguard’s 2026 scan provides context across roughly **5.5 million ranked domains**. Breadth alone does not establish similarity to your industry or sending activity. - **Monitored dashboards:** DmarcDkim.com’s dashboard describes its monitored population. Establish whether that population resembles yours before treating it as a peer benchmark. A mid-market company cannot assume that a **“top-domain”** panel represents comparable businesses. Website popularity does not establish company size, email use, or portfolio composition. Without evidence of those similarities, use the panel as background context. **Match definitions** as carefully as populations. Decide whether the comparison requires publication, valid records, quarantine-or-reject policies, or full rejection. Specify how partial enforcement and reporting requirements affect eligibility. A matching population does not repair a mismatched threshold. Align exclusions and observation dates wherever possible. [DDMARC’s 2026 study](https://ddmarc.com/research/state-of-email-security-2026/) excludes non-resolving entries, whereas DMARCguard retains failed lookups as “no record.” Create a comparable internal view if useful, but preserve the complete inventory and disclose exclusions. For live dashboards, record the observation date, percentage, and population size together. _For fixed studies, use the scan date rather than assuming publication year establishes comparability_. Label comparisons approximate when timing, classification, or exclusions cannot be aligned. Before accepting a benchmark, ask: - **Inventory:** Are we comparing all owned domains, active senders, or customer-facing domains? - **Population:** What evidence shows that the sampled domains resemble ours? - **Threshold:** Does enforcement mean the same policy settings? - **Denominator:** Does the percentage cover all domains or only adopters? - **Exclusions:** What disappears from the comparison, and where is it retained internally? - **Timing:** When were both populations observed? Benchmarks **contextualize performance**. They do not establish that remaining gaps are acceptable simply because an organization exceeds an external average. ![Spf Record Generator 3158](https://media.mailhop.org/autospf/spf-record-generator-3158-1794472116481.jpg) _Decision guide to pick DMARC adoption benchmarks whose denominators and definitions match your own domain population and risk profile. Method: Conceptual decision tree synthesizing guidance from DMARC Report, DMARCguard, DDMARC, EasyDMARC, DmarcDkim.com, and CyberFurl on aligning internal denominators with appropriate external studies; no new quantitative data is introduced._ ## Build a scorecard that shows the remaining work Build a scorecard that exposes unfinished work, rather than one **reassuring adoption percentage.** The following recommendations translate the evidence into reporting practices; they are not a validated rollout standard. Start with a named inventory and measurement date. Document inclusion rules, exclusions, and configuration checks so readers can reconstruct each percentage. Keep four **configuration measures separate**, showing counts and percentages against the same inventory: - **Publication:** Domains with a published DMARC record, including records that fail the stated validity checks. - **Valid records:** Domains whose records pass documented configuration checks. Explain what those checks establish. - **Quarantine or reject:** Domains with valid policies requesting either action against DMARC failures. State how partial enforcement is handled. - **Reject with reporting:** Domains meeting explicit rejection and aggregate-reporting requirements. Distinguish a configured reporting address from confirmed receipt of usable reports. _Avoid calling the last measure simply “protected.” DmarcDkim.com’s dashboard and other reports apply different protection thresholds_. A precise configuration label communicates more than an undefined assurance. Report enforcement among adopters separately from **portfolio-wide coverage**. The first divides enforcing domains by adopters; the second divides them by the complete inventory. Specify whether adopters means published records or valid records. Reserve terms such as conversion for measured changes over time. The EasyDMARC analysis summarized by DMARC Report illustrates this distinction: 411,935 enforcing domains represent about 44% of valid-record adopters, but 22.9% of the full panel. A scorecard should make that relationship visible rather than presenting the percentages as separate achievements. _Show remaining counts beside the percentages: missing records, invalid configurations, and valid records without enforcement_. Assign owners and review dates to these distinct work queues. Do not add overlapping configuration measures as though they were mutually exclusive categories. Keep **message authentication and delivery indicators** alongside configuration measures, using separate denominators. Report DMARC passes against observed messages, with the traffic source and measurement period identified. For inbox placement, specify the tested-message population. These indicators answer operational questions, not portfolio-coverage questions. DMARC Report’s methodological explainer distinguishes [message authentication](https://trainingcamp.com/glossary/message-authentication/) from domain-policy scans. Strong authentication results cannot establish enforcement across dormant or unobserved domains. Preserve inventory rules between reporting periods. Disclose acquisitions, retirements, exclusions, and newly discovered domains. When scope changes materially, show both the current portfolio and an unchanged comparison cohort. This separates configuration improvements from changes in what is counted. Set risk-informed targets rather than borrowing cohort averages. _Consider impersonation exposure, business importance, legitimate sending dependencies, and disruption risk_ Document exceptions and the evidence required before **advancing policies**. End each review with unresolved domains, responsible owners, and next decisions. The central question remains the same for external headlines and internal scores: compared with which domains, under which definition? ## Limitations - This analysis checks reported findings against the supplied evidence, not underlying DNS datasets, source pages, or message telemetry. Several findings depend on secondary summaries. - Different populations, observation dates, and exclusion rules prevent these percentages from establishing one internet-wide rate or trend. - The supplied evidence sometimes conflates reject-only protection with [quarantine-or-reject](https://autospf.com/dmarc/dmarc-policy/) enforcement. Its dashboard breakdowns also contain inconsistencies that cannot be resolved here. - Published **policies and message pass rates** do not establish fraud reduction. Vendor-defined protection labels describe configuration thresholds, not security guarantees. ## References - [State of Email Security 2026 — DMARC Adoption Data](https://ddmarc.com/research/state-of-email-security-2026/) - [Email Authentication Research & Data](https://ddmarc.com/research/) - [state-of-email-security-2026.csv](http://ddmarc.com/research/state-of-email-security-2026.csv) - [DMARC Adoption Statistics 2026 - Live Global Data](https://dmarcdkim.com/dmarc-adoption) - [DMARC Adoption Intelligence Insight 2026: Global Email …](https://cyberfurl.com/research/dmarc-adoption-report-2026) - [Why 2026 Email Authentication Numbers Don't Agree](https://dmarcreport.com/blog/why-2026-email-authentication-numbers-don-t-agree/) - [The State of DMARC Adoption in 2026:938,000 Domains Have …](https://dmarcreport.com/blog/the-dmarc-adoption-2026-domains-records-only-9-percent-protected/) - [The DMARC Divide: Why Big Brands Enforce While Most Domains Still Do Not](https://dmarcreport.com/blog/dmarc-divide-big-brands-enforce-while-most-domains-do-not/) - [DMARC Adoption Statistics 2026: Data | JustEmails](https://justemails.app/blog/dmarc-adoption-statistics-2026) - [Top 112 Email Security Software Statistics, Data & Trends in 2026](https://blog.9cv9.com/top-112-email-security-software-statistics-data-trends-in-2026/?amp=1) - [Email Security Research - SimpleDMARC](https://simpledmarc.com/research) - [DMARC Adoption 2026: 30.4% of 5.5M Domains, 12.8% Enforce](https://dmarcguard.io/research/email-authentication/) ![Brad Slavin](https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg) [ Brad Slavin ](/authors/brad-slavin/) General Manager General Manager of DuoCircle. Product strategy and commercial lead for AutoSPF's 2,000+ customer base. [LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) ## Ready to get started? Try AutoSPF free — no credit card required. [ Book a Demo ](/book-a-demo/) Scan Your Domain Now Instantly scan your domain for DKIM, SPF, and DMARC issues Check My Domain Share this article [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fdmarc-adoption-numbers-disagree-here-s-how-to-read-them%2F) [ ](https://twitter.com/intent/tweet?text=DMARC%20Adoption%20Numbers%20Disagree.%20Here%E2%80%99s%20How%20To%20Read%20Them.&url=https%3A%2F%2Fautospf.com%2Fblog%2Fdmarc-adoption-numbers-disagree-here-s-how-to-read-them%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fdmarc-adoption-numbers-disagree-here-s-how-to-read-them%2F) Copy Related Articles - [ ![permanent error](https://media.mailhop.org/autospf/images/2024/07/spf-record-office-365-4110.jpg) Fix '554 5.7.5 Permanent Error Evaluating DMARC Policy' Advanced ](/blog/554-5-7-5-permanent-error-in-dmarc-and-how-to-fix-it/) - [ ![cybersecurity trends](https://media.mailhop.org/autospf/images/2024/09/spf-checker-52320.jpg) 8 cybersecurity trends that will redefine the digital landscape in 2024 Advanced ](/blog/8-cybersecurity-trends-that-will-redefine-the-digital-landscape-in-2024/) - [ ![Protect Your Domain](https://media.mailhop.org/autospf/images/2026/03/spf-validator-5901.jpg) Advanced SPF Record Testing: Protect Your Domain from Permerror Issues Advanced ](/blog/advanced-spf-record-testing-protect-your-domain-from-permerror-issues/) - [ ![Advanced SPF Validation](https://media.mailhop.org/autospf/images/2026/05/kitterman-spf-5620.jpg) Advanced SPF Validation Tips To Eliminate Permerror And Lookup Issues Advanced ](/blog/advanced-spf-validation-tips-to-eliminate-permerror-and-lookup-issues/) ## Related Articles [ Advanced 8m Fix '554 5.7.5 Permanent Error Evaluating DMARC Policy' Jul 9, 2024 ](/blog/554-5-7-5-permanent-error-in-dmarc-and-how-to-fix-it/)[ Advanced 6m 8 cybersecurity trends that will redefine the digital landscape in 2024 Sep 20, 2024 ](/blog/8-cybersecurity-trends-that-will-redefine-the-digital-landscape-in-2024/)[ Advanced 13m Advanced SPF Record Testing: Protect Your Domain from Permerror Issues Mar 3, 2026 ](/blog/advanced-spf-record-testing-protect-your-domain-from-permerror-issues/)[ Advanced 12m Advanced SPF Validation Tips To Eliminate Permerror And Lookup Issues May 4, 2026 ](/blog/advanced-spf-validation-tips-to-eliminate-permerror-and-lookup-issues/) ```json {"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]} ``` ```json {"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}} ``` ```json {"@context":"https://schema.org","@type":"BlogPosting","headline":"DMARC Adoption Numbers Disagree. Here’s How To Read Them.","description":"Understand why 2026 DMARC adoption statistics differ and how to compare enforcement rates, domain populations, and authentication metrics accurately.","url":"https://autospf.com/blog/dmarc-adoption-numbers-disagree-here-s-how-to-read-them/","datePublished":"2026-11-12T00:00:00.000Z","dateModified":"2026-11-12T00:00:00.000Z","dateCreated":"2026-11-12T00:00:00.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://autospf.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the General Manager of DuoCircle, the company behind AutoSPF, DMARC Report, Phish Protection, and Mailhop. He founded DuoCircle in 2014 to solve the SPF 10-DNS-lookup problem at scale and has led the company's growth to 2,000+ customers. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement) rather than hands-on DNS engineering.","image":"https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/dmarc-adoption-numbers-disagree-here-s-how-to-read-them/"},"articleSection":"advanced","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/creating-spf-record-9356-1794472155998.jpg","caption":"DMARC Adoption Statistics Analysis"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}} ``` ```json {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Advanced","item":"https://autospf.com/advanced/"},{"@type":"ListItem","position":4,"name":"DMARC Adoption Numbers Disagree. Here’s How To Read Them.","item":"https://autospf.com/blog/dmarc-adoption-numbers-disagree-here-s-how-to-read-them/"}]} ```