{ "title": "SPF and DMARC across the top 10,000 domains", "publisher": "InfraNest", "scanned_on": "2026-09-25", "source": { "list": "Tranco top 1M", "list_id": "K9PXW", "url": "https://tranco-list.eu/list/K9PXW", "top": 10000, "citation": "Le Pochat et al., Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation, NDSS 2019" }, "method": { "analysers": "The InfraNest SPF checker (/tools/spf-check) and DMARC checker (/tools/dmarc-check) — same code", "dns": "Cloudflare DNS over HTTPS, Google as fallback; domains unreadable on both are excluded", "populations": { "all": "every readable domain", "mail": "domains with a real MX record (not a null MX, RFC 7505)" }, "definitions": { "valid_spf": "exactly one SPF record, at most 10 DNS lookups, at most 2 void lookups, no include loop (RFC 7208)", "enforced_dmarc": "p=quarantine or p=reject, applied to 100% of mail (RFC 7489)", "reports_unauthorised": "rua at another domain that publishes no ._report._dmarc authorisation record (RFC 7489 §7.1)" }, "not_measured": [ "DKIM (selectors cannot be enumerated from DNS)", "whether real mail passes alignment", "subdomains" ], "percentages": "of the population named; of_spf_domains / of_dmarc_domains are shares of domains publishing that record", "validation": "Random sample of 100 mail domains re-checked with checkdmarc 6.0.3 (independent open-source tool): SPF verdict agreed for 98/100, SPF lookup count for 76/76 records both tools found valid, DMARC policy for 99/100; the remaining differences were records checkdmarc could not read or objected to on style, confirmed by hand.", "corrections": "25 Sep 2026: the first run treated two senders including the same record as an include loop (a bug in our SPF checker, fixed in the same release); these numbers are from the corrected re-scan the same day." }, "summary": { "scanned": 10000, "unreadable": 23, "mx": { "real": 7204, "null_mx": 75, "none": 2698 }, "all": { "domains": 9977, "spf": { "published_pct": 75.2, "of_spf_domains": { "multiple_records_pct": 0.8, "over_10_lookups_pct": 2.5, "near_limit_pct": 12.8, "void_lookups_pct": 0, "include_missing_pct": 1.3, "ptr_used_pct": 0.9, "all": { "hardfail_pct": 50.2, "softfail_pct": 43.7, "neutral_pct": 2.1, "plus_all_pct": 0, "missing_pct": 0.4 }, "lookup_buckets_pct": { "0-3": 53.1, "4-7": 31.6, "8-10": 12.8, "11+": 2.5 }, "median_lookups": 3, "p90_lookups": 9 } }, "dmarc": { "published_pct": 67.1, "of_dmarc_domains": { "none_pct": 25, "quarantine_pct": 27.7, "reject_pct": 46.9, "invalid_policy_pct": 0.4, "partial_pct_pct": 2, "no_reports_pct": 14, "reports_unauthorised_pct": 9.8, "subdomains_exempt_pct": 4.7 } }, "combined": { "protected_pct": 45.9, "neither_pct": 22.3, "dmarc_without_spf_pct": 2.4 } }, "mail": { "domains": 7204, "spf": { "published_pct": 92.9, "of_spf_domains": { "multiple_records_pct": 0.8, "over_10_lookups_pct": 2.7, "near_limit_pct": 14.3, "void_lookups_pct": 0, "include_missing_pct": 1.3, "ptr_used_pct": 1, "all": { "hardfail_pct": 46.3, "softfail_pct": 47.4, "neutral_pct": 2.1, "plus_all_pct": 0, "missing_pct": 0.4 }, "lookup_buckets_pct": { "0-3": 48.1, "4-7": 34.9, "8-10": 14.3, "11+": 2.7 }, "median_lookups": 4, "p90_lookups": 9 } }, "dmarc": { "published_pct": 82.3, "of_dmarc_domains": { "none_pct": 26.5, "quarantine_pct": 30.5, "reject_pct": 42.5, "invalid_policy_pct": 0.4, "partial_pct_pct": 2.1, "no_reports_pct": 13.4, "reports_unauthorised_pct": 6.5, "subdomains_exempt_pct": 5.3 } }, "combined": { "protected_pct": 55.7, "neither_pct": 5.6, "dmarc_without_spf_pct": 1.5 } }, "mail_top_1000": { "domains": 695, "spf": { "published_pct": 94, "of_spf_domains": { "multiple_records_pct": 0.6, "over_10_lookups_pct": 3.4, "near_limit_pct": 15.2, "void_lookups_pct": 0, "include_missing_pct": 0.9, "ptr_used_pct": 0.9, "all": { "hardfail_pct": 53.6, "softfail_pct": 39.1, "neutral_pct": 2, "plus_all_pct": 0, "missing_pct": 0 }, "lookup_buckets_pct": { "0-3": 43.2, "4-7": 38.3, "8-10": 15.2, "11+": 3.4 }, "median_lookups": 4, "p90_lookups": 9 } }, "dmarc": { "published_pct": 89.5, "of_dmarc_domains": { "none_pct": 16.2, "quarantine_pct": 26.5, "reject_pct": 57.2, "invalid_policy_pct": 0, "partial_pct_pct": 1.3, "no_reports_pct": 6.3, "reports_unauthorised_pct": 6.6, "subdomains_exempt_pct": 4.5 } }, "combined": { "protected_pct": 71.1, "neither_pct": 5.2, "dmarc_without_spf_pct": 0.9 } }, "mail_rank_1001_10000": { "domains": 6509, "spf": { "published_pct": 92.8, "of_spf_domains": { "multiple_records_pct": 0.8, "over_10_lookups_pct": 2.7, "near_limit_pct": 14.2, "void_lookups_pct": 0, "include_missing_pct": 1.4, "ptr_used_pct": 1.1, "all": { "hardfail_pct": 45.5, "softfail_pct": 48.3, "neutral_pct": 2.1, "plus_all_pct": 0, "missing_pct": 0.4 }, "lookup_buckets_pct": { "0-3": 48.6, "4-7": 34.5, "8-10": 14.2, "11+": 2.7 }, "median_lookups": 4, "p90_lookups": 9 } }, "dmarc": { "published_pct": 81.5, "of_dmarc_domains": { "none_pct": 27.7, "quarantine_pct": 31, "reject_pct": 40.8, "invalid_policy_pct": 0.5, "partial_pct_pct": 2.2, "no_reports_pct": 14.2, "reports_unauthorised_pct": 6.4, "subdomains_exempt_pct": 5.4 } }, "combined": { "protected_pct": 54.1, "neither_pct": 5.6, "dmarc_without_spf_pct": 1.6 } } }, "licence": "CC BY 4.0 — cite InfraNest, https://infranest.io/blog/spf-dmarc-top-10000-domains-2026" }