---
title: "Email authentication census of 3,000 domains"
url: "https://lookvalid.com/research/email-authentication-census.md"
canonical_url: "https://lookvalid.com/research/email-authentication-census"
last_updated: "2026-10-19"
type: "reference"
summary: "We ran our own DNS lookups on 3,000 domains from the Majestic Million, 1,000 from each of three rank bands."
related: ["https://lookvalid.com/research.md", "https://lookvalid.com/research/us-phone-numbering-landscape.md", "https://lookvalid.com/research/phone-complaints-fcc.md"]
---

# Email authentication census of 3,000 domains

We ran our own DNS lookups on 3,000 domains from the Majestic Million, 1,000 from each of three rank bands.

Published 2026-10-19. Data collected or dated 2026-10-18.

## Findings

- Of 2,754 conclusive domains, 1,435 (52.1%) publish exactly one DMARC record and 942 (34.2%) publish an enforcing one; 467 DMARC records (32.5% of the records) set p=none, which only asks receivers to report.
- Enforcing DMARC drops with rank: 65.8% of 991 conclusive domains in ranks 1 to 1,000, 24.0% of 808 in ranks 100,001 to 101,000 and 10.1% of 955 in ranks 900,001 to 901,000.
- 1,668 of 2,754 conclusive domains (60.6%) publish at least one SPF record, and 16 publish two or more, which RFC 7208 treats as a permanent error for SPF checks.
- Among the 1,652 domains with exactly one SPF record, 49.6% end in ~all, 44.6% end in -all and 0 end in +all.
- Of the 1,683 conclusive domains that publish a mail host, 29.4% point their lowest-preference MX at Google Workspace and 20.3% at Microsoft 365 (n = 1,683).
- 158 sampled domains no longer resolved and 88 lookups were inconclusive, so rates rest on 2,754 of 3,000 sampled domains.

## Definitions

- Sample: the first 1,000 domains, in file order, whose Majestic GlobalRank falls in a band. The bands are ranks 1 to 1,000, ranks 100,001 to 101,000, ranks 900,001 to 901,000. No random picking.
- Conclusive: a domain whose MX lookup, apex TXT lookup and _dmarc TXT lookup all returned an answer, including an answer that no such record exists. Every rate in this report uses conclusive domains as its n.
- Inconclusive: a domain where at least one lookup ended in SERVFAIL, a refusal or a timeout after one retry. It is left out of every rate and counted on its own.
- Nonexistent: a domain whose MX and TXT lookups both returned NXDOMAIN at the time of the run. It is left out of every rate and counted on its own.
- MX present: the domain publishes at least one MX record that names a mail host. A null MX (a single record with preference 0 and the root "." as the host, RFC 7505) is counted separately and does not count as MX present.
- MX provider: the provider that matches the host of the lowest-preference MX record, by hostname suffix, using a rule table written by LookValid. A host that matches no rule is Other. A domain with no MX, or a null MX, is None.
- SPF record: a TXT record at the domain that starts with v=spf1. The all qualifier is the final all term of a single SPF record: -all (fail), ~all (soft fail), ?all (neutral) or +all (pass). A record that has no all term but has a redirect is listed as redirect.
- DMARC record: a TXT record at _dmarc.<domain> that starts with v=DMARC1. A domain counts as publishing DMARC here only when it has exactly one such record; domains with several are counted separately. Policy p is none, quarantine or reject. pct is the share of mail the policy applies to and is 100 when absent. rua is the address for aggregate reports.
- Enforcing: exactly one DMARC record, with p set to quarantine or reject and pct either absent or 100.
- 95% interval: the Wilson score interval for a share, which shows how far a share could move because only some domains were sampled.

## Authentication records by rank band

| Band | Conclusive n | MX present | SPF record | One DMARC record | DMARC enforcing | Enforcing, 95% interval |
| --- | --- | --- | --- | --- | --- | --- |
| Ranks 1 to 1,000 | 991 | 814 (82.1%) | 868 (87.6%) | 822 (82.9%) | 652 (65.8%) | 62.8% to 68.7% |
| Ranks 100,001 to 101,000 | 808 | 509 (63.0%) | 483 (59.8%) | 383 (47.4%) | 194 (24.0%) | 21.2% to 27.1% |
| Ranks 900,001 to 901,000 | 955 | 360 (37.7%) | 317 (33.2%) | 230 (24.1%) | 96 (10.1%) | 8.3% to 12.1% |
| All three bands | 2,754 | 1,683 (61.1%) | 1,668 (60.6%) | 1,435 (52.1%) | 942 (34.2%) | 32.5% to 36.0% |

Each share is the count divided by the conclusive n in the same row.

## DMARC policy among domains that publish one DMARC record

| Band | DMARC records | p=none | p=quarantine | p=reject | pct below 100 | rua present |
| --- | --- | --- | --- | --- | --- | --- |
| Ranks 1 to 1,000 | 822 | 160 (19.5%) | 183 (22.3%) | 479 (58.3%) | 10 (1.2%) | 765 (93.1%) |
| Ranks 100,001 to 101,000 | 383 | 176 (46.0%) | 103 (26.9%) | 103 (26.9%) | 15 (3.9%) | 264 (68.9%) |
| Ranks 900,001 to 901,000 | 230 | 131 (57.0%) | 56 (24.3%) | 43 (18.7%) | 5 (2.2%) | 135 (58.7%) |
| All three bands | 1,435 | 467 (32.5%) | 342 (23.8%) | 625 (43.6%) | 30 (2.1%) | 1,164 (81.1%) |

The n in each row is its DMARC records count. Domains with more than one DMARC record (6 overall) are not counted here and are never enforcing; a record with no valid p value is not shown as a policy column.

## SPF records and the all qualifier

| Band | No SPF record | One SPF record | Two or more | -all | ~all | ?all | +all | redirect or no all |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Ranks 1 to 1,000 | 123 (12.4%) | 865 (87.3%) | 3 (0.3%) | 451 (52.1%) | 346 (40.0%) | 25 (2.9%) | 0 (0.0%) | 43 (5.0%) |
| Ranks 100,001 to 101,000 | 325 (40.2%) | 475 (58.8%) | 8 (1.0%) | 182 (38.3%) | 271 (57.1%) | 11 (2.3%) | 0 (0.0%) | 11 (2.3%) |
| Ranks 900,001 to 901,000 | 638 (66.8%) | 312 (32.7%) | 5 (0.5%) | 103 (33.0%) | 202 (64.7%) | 4 (1.3%) | 0 (0.0%) | 3 (1.0%) |
| All three bands | 1,086 (39.4%) | 1,652 (60.0%) | 16 (0.6%) | 736 (44.6%) | 819 (49.6%) | 40 (2.4%) | 0 (0.0%) | 57 (3.5%) |

The first three columns use conclusive domains as n. The qualifier columns use only domains with exactly one SPF record as n.

## MX provider, share of conclusive domains

| Provider | Ranks 1 to 1,000 | Ranks 100,001 to 101,000 | Ranks 900,001 to 901,000 | All three bands |
| --- | --- | --- | --- | --- |
| Google Workspace | 271 (27.3%) | 126 (15.6%) | 97 (10.2%) | 494 (17.9%) |
| Microsoft 365 | 159 (16.0%) | 113 (14.0%) | 69 (7.2%) | 341 (12.4%) |
| Proofpoint | 89 (9.0%) | 18 (2.2%) | 3 (0.3%) | 110 (4.0%) |
| Mimecast | 25 (2.5%) | 20 (2.5%) | 7 (0.7%) | 52 (1.9%) |
| Cloudflare | 2 (0.2%) | 13 (1.6%) | 12 (1.3%) | 27 (1.0%) |
| Zoho | 6 (0.6%) | 7 (0.9%) | 10 (1.0%) | 23 (0.8%) |
| Fastmail | 1 (0.1%) | 1 (0.1%) | 0 (0.0%) | 2 (0.1%) |
| Proton | 0 (0.0%) | 0 (0.0%) | 0 (0.0%) | 0 (0.0%) |
| Amazon SES | 2 (0.2%) | 7 (0.9%) | 1 (0.1%) | 10 (0.4%) |
| Other | 259 (26.1%) | 204 (25.2%) | 161 (16.9%) | 624 (22.7%) |
| None | 177 (17.9%) | 299 (37.0%) | 595 (62.3%) | 1,071 (38.9%) |

The n for each column is its conclusive count (991, 808, 955, and 2,754 overall). None includes 11 domains with a null MX overall.

## How many sampled domains answered

| Band | Sampled | Nonexistent | Inconclusive | Conclusive |
| --- | --- | --- | --- | --- |
| Ranks 1 to 1,000 | 1,000 | 1 | 8 | 991 |
| Ranks 100,001 to 101,000 | 1,000 | 141 | 51 | 808 |
| Ranks 900,001 to 901,000 | 1,000 | 16 | 29 | 955 |
| All three bands | 3,000 | 158 | 88 | 2,754 |

## Method

1. Domain list: the Majestic Million file (1,000,000 rows, file dated Sun, 18 Oct 2026 05:00:28 GMT). For each band, the first 1,000 rows in file order with a GlobalRank inside the band were taken.
2. Cross-check: 3,000 of 3,000 sampled domains were found in LookValid's own hashed copy of the file (1,000,000 entries), and 3,000 carried the same rank.
3. DNS: node:dns/promises through the public resolver 1.1.1.1, between 22:58 and 22:59 UTC on 2026-10-18. At most 40 lookups in flight, a 5 second timeout, and 1 retry on timeout.
4. Three lookups per domain: MX at the domain, TXT at the domain (for SPF) and TXT at _dmarc.<domain>. SERVFAIL, refusals and timeouts after the retry are inconclusive. NXDOMAIN on both the MX and TXT lookups is nonexistent. Both are excluded from every rate.
5. MX providers are matched by hostname suffix with LookValid's own rule table, listed in the data file and the script. Only the lowest-preference MX is used; the first provider match among equal-preference hosts wins.
6. The script and the per-domain CSV are on this page. Running the script again gives a new snapshot: DNS changes daily, so the counts will differ.

## What this cannot show

- This is one snapshot taken from one resolver at one time. It says what DNS answered in that run, not how the records change over time.
- Majestic ranks measure how many networks link to a domain. They do not measure email volume. Many ranked domains never send mail, so a missing SPF or DMARC record on a domain is not always a gap.
- The sample is the first 1,000 domains in each band in file order, not a random draw. Three bands do not stand for every domain in the file or for the whole internet.
- Only the domain itself was queried. Subdomains that send mail, and sending domains that differ from the ranked domain, are not covered. A DMARC record at a parent domain is not looked up when the ranked name is a subdomain.
- DKIM was not checked, because its selector names are not public. SPF include chains and the ten lookup limit were not followed, and the address in rua was not tested. A published enforcing policy does not show that mail is aligned or protected.
- The MX provider is read from the primary mail host only. A filtering gateway in front of a mailbox host hides the mailbox provider, and a domain with no MX record that receives mail through an address record is counted as no MX.
- 158 nonexistent and 88 inconclusive domains are left out. If those domains differ from the rest, the rates would move.

## Downloads

- Per-domain results (CSV): https://lookvalid.com/research/email-authentication-census.csv (One row per sampled domain with the flags used here. Domain list from the Majestic Million, CC BY 3.0.)
- Script (Node, no packages): https://lookvalid.com/research/email-authentication-census.mjs (Downloads the Majestic file, runs the DNS lookups and writes the data file and the CSV.)

## Questions

### What counts as an enforcing DMARC policy here?

Exactly one DMARC record at _dmarc.<domain> with p set to quarantine or reject, and pct either absent or 100. A record with p=none, a pct below 100, or more than one DMARC record is not counted as enforcing.

### Why were some domains left out of the rates?

A domain is left out when its DNS lookups failed (SERVFAIL, refusal or timeout after one retry) or when it no longer exists. In this run that was 88 inconclusive and 158 nonexistent domains out of 3,000 sampled, so the rates use 2,754.

### Can I repeat the run myself?

Yes. Download the script from this page and run it with Node 20 or newer. It fetches the Majestic Million file, samples the same three rank bands and queries public DNS. Expect different counts, since DNS records and Majestic ranks change every day.

## Sources

- [Majestic Million, licensed under Creative Commons Attribution 3.0 Unported (CC BY 3.0). Domain list by Majestic.](https://majestic.com/reports/majestic-million), read 2026-10-18
- [Majestic Million file (majestic_million.csv)](https://downloads.majestic.com/majestic_million.csv), read 2026-10-18
- [RFC 7208, Sender Policy Framework (more than one SPF record gives permerror)](https://www.rfc-editor.org/rfc/rfc7208), read 2026-10-18
- [RFC 7489, DMARC (pct defaults to 100; rua; multiple records)](https://www.rfc-editor.org/rfc/rfc7489), read 2026-10-18
- [RFC 7505, A "Null MX" No Service Resource Record](https://www.rfc-editor.org/rfc/rfc7505), read 2026-10-18

## Related

- [LookValid research](https://lookvalid.com/research.md)
- [US phone numbering landscape from NANPA files](https://lookvalid.com/research/us-phone-numbering-landscape.md)
- [Unwanted-call complaints in FCC data](https://lookvalid.com/research/phone-complaints-fcc.md)