Publishing DMARC and enforcing it are different facts
DMARC is the line in a domain's DNS that tells receiving mail servers what to do with mail
that forges its name: nothing, quarantine it, or reject it. All three are a
published record. Only two of them stop anything. The board below reads the policy, so a
sector that is covered can be told from one that only looks it.
Across the 7,287 domains we have an email-auth reading for,
78% publish DMARC.
24% of those publish p=none, which enforces nothing.
rss
1,144 scanned
231 enforcing
293 p=none (enforces nothing)
620 no DMARC
46% publish DMARC. Of those, 56% are p=none, which enforces nothing.
fortune_500
684 scanned
464 enforcing
96 p=none (enforces nothing)
124 no DMARC
82% publish DMARC. Of those, 17% are p=none, which enforces nothing.
media_entertainment
331 scanned
216 enforcing
60 p=none (enforces nothing)
55 no DMARC
83% publish DMARC. Of those, 22% are p=none, which enforces nothing.
manufacturing
297 scanned
204 enforcing
56 p=none (enforces nothing)
37 no DMARC
88% publish DMARC. Of those, 22% are p=none, which enforces nothing.
web3_defi
275 scanned
167 enforcing
30 p=none (enforces nothing)
78 no DMARC
72% publish DMARC. Of those, 15% are p=none, which enforces nothing.
education_expanded
266 scanned
163 enforcing
99 p=none (enforces nothing)
4 no DMARC
99% publish DMARC. Of those, 38% are p=none, which enforces nothing.
pharma_biotech
264 scanned
173 enforcing
64 p=none (enforces nothing)
27 no DMARC
90% publish DMARC. Of those, 27% are p=none, which enforces nothing.
consulting
254 scanned
194 enforcing
34 p=none (enforces nothing)
26 no DMARC
90% publish DMARC. Of those, 15% are p=none, which enforces nothing.
cybersecurity_expanded
242 scanned
181 enforcing
25 p=none (enforces nothing)
36 no DMARC
85% publish DMARC. Of those, 12% are p=none, which enforces nothing.
fashion_luxury
232 scanned
170 enforcing
40 p=none (enforces nothing)
22 no DMARC
91% publish DMARC. Of those, 19% are p=none, which enforces nothing.
fintech_expanded
224 scanned
175 enforcing
26 p=none (enforces nothing)
23 no DMARC
90% publish DMARC. Of those, 13% are p=none, which enforces nothing.
non_profit
216 scanned
133 enforcing
50 p=none (enforces nothing)
33 no DMARC
85% publish DMARC. Of those, 27% are p=none, which enforces nothing.
automotive
215 scanned
131 enforcing
44 p=none (enforces nothing)
40 no DMARC
81% publish DMARC. Of those, 25% are p=none, which enforces nothing.
hospitality
209 scanned
131 enforcing
37 p=none (enforces nothing)
41 no DMARC
80% publish DMARC. Of those, 22% are p=none, which enforces nothing.
sports_entertainment
204 scanned
108 enforcing
46 p=none (enforces nothing)
50 no DMARC
76% publish DMARC. Of those, 30% are p=none, which enforces nothing.
insurance
188 scanned
124 enforcing
26 p=none (enforces nothing)
38 no DMARC
80% publish DMARC. Of those, 17% are p=none, which enforces nothing.
energy
174 scanned
103 enforcing
23 p=none (enforces nothing)
48 no DMARC
72% publish DMARC. Of those, 18% are p=none, which enforces nothing.
government_expanded
167 scanned
126 enforcing
33 p=none (enforces nothing)
8 no DMARC
95% publish DMARC. Of those, 21% are p=none, which enforces nothing.
construction
166 scanned
103 enforcing
33 p=none (enforces nothing)
30 no DMARC
82% publish DMARC. Of those, 24% are p=none, which enforces nothing.
telecom
155 scanned
91 enforcing
38 p=none (enforces nothing)
26 no DMARC
83% publish DMARC. Of those, 30% are p=none, which enforces nothing.
real_estate_expanded
151 scanned
87 enforcing
39 p=none (enforces nothing)
25 no DMARC
83% publish DMARC. Of those, 31% are p=none, which enforces nothing.
legal_expanded
140 scanned
98 enforcing
27 p=none (enforces nothing)
15 no DMARC
89% publish DMARC. Of those, 22% are p=none, which enforces nothing.
agriculture
131 scanned
68 enforcing
23 p=none (enforces nothing)
40 no DMARC
70% publish DMARC. Of those, 25% are p=none, which enforces nothing.
logistics_expanded
124 scanned
69 enforcing
28 p=none (enforces nothing)
27 no DMARC
78% publish DMARC. Of those, 29% are p=none, which enforces nothing.
aerospace
115 scanned
71 enforcing
27 p=none (enforces nothing)
17 no DMARC
85% publish DMARC. Of those, 28% are p=none, which enforces nothing.
crypto
62 scanned
58 enforcing
3 p=none (enforces nothing)
1 no DMARC
98% publish DMARC. Of those, 4.9% are p=none, which enforces nothing.
big_tech
56 scanned
53 enforcing
3 p=none (enforces nothing)
0 no DMARC
100% publish DMARC. Of those, 5.4% are p=none, which enforces nothing.
fintech
54 scanned
47 enforcing
5 p=none (enforces nothing)
2 no DMARC
96% publish DMARC. Of those, 9.6% are p=none, which enforces nothing.
misc
53 scanned
15 enforcing
7 p=none (enforces nothing)
31 no DMARC
42% publish DMARC. Of those, 32% are p=none, which enforces nothing.
devops
46 scanned
38 enforcing
4 p=none (enforces nothing)
4 no DMARC
91% publish DMARC. Of those, 9.5% are p=none, which enforces nothing.
languages
44 scanned
21 enforcing
13 p=none (enforces nothing)
10 no DMARC
77% publish DMARC. Of those, 38% are p=none, which enforces nothing.
security
44 scanned
44 enforcing
0 p=none (enforces nothing)
0 no DMARC
100% publish DMARC. Of those, 0% are p=none, which enforces nothing.
email_comms
44 scanned
38 enforcing
5 p=none (enforces nothing)
1 no DMARC
98% publish DMARC. Of those, 12% are p=none, which enforces nothing.
dev_tools
42 scanned
38 enforcing
1 p=none (enforces nothing)
3 no DMARC
93% publish DMARC. Of those, 2.6% are p=none, which enforces nothing.
media
41 scanned
26 enforcing
9 p=none (enforces nothing)
6 no DMARC
85% publish DMARC. Of those, 26% are p=none, which enforces nothing.
data_analytics
40 scanned
31 enforcing
6 p=none (enforces nothing)
3 no DMARC
93% publish DMARC. Of those, 16% are p=none, which enforces nothing.
ai_ml
39 scanned
30 enforcing
7 p=none (enforces nothing)
2 no DMARC
95% publish DMARC. Of those, 19% are p=none, which enforces nothing.
ecommerce
33 scanned
29 enforcing
4 p=none (enforces nothing)
0 no DMARC
100% publish DMARC. Of those, 12% are p=none, which enforces nothing.
infrastructure
31 scanned
16 enforcing
5 p=none (enforces nothing)
10 no DMARC
68% publish DMARC. Of those, 24% are p=none, which enforces nothing.
developer
31 scanned
7 enforcing
2 p=none (enforces nothing)
22 no DMARC
29% publish DMARC. Of those, 22% are p=none, which enforces nothing.
cloud
30 scanned
24 enforcing
1 p=none (enforces nothing)
5 no DMARC
83% publish DMARC. Of those, 4.0% are p=none, which enforces nothing.
cms
29 scanned
24 enforcing
5 p=none (enforces nothing)
0 no DMARC
100% publish DMARC. Of those, 17% are p=none, which enforces nothing.
CAA: naming which authorities may issue a certificate
CAA is an issuance allowlist: it names which certificate authorities are allowed to issue a
certificate for a domain, which is a real defense against mis-issuance. There is a catch worth
knowing: a CAA record that carries only an iodef reporting address restricts
nobody - any CA can still issue - even though it passes a simple "has CAA?"
check. So the number that matters is not who publishes CAA, but who actually constrains issuance.
53,840actually restrict who may issue
328publish CAA that restricts nobody
1forbid all issuance (issue ";")
751,987publish no CAA at all
Of 806,156 domains we have a reading for, 7% publish any CAA, and 1% of those constrain no one.
security.txt: publishing where to report a problem, and keeping it current
RFC 9116 asks a domain to publish where to report a vulnerability, and makes an
Expires date mandatory - so a stale file cannot sit there forever
pointing at an inbox nobody reads. An expired security.txt can be worse than
none: it points a researcher at a contact the organisation may no longer be watching.
3,216publish a security.txt
429of those have EXPIRED (13%)
30,878publish none
7,226refused our read (unknown, not "none")
Read for 41,320 domains so far, and climbing as enrichment sweeps the catalog.
What these percentages are counted against. Only domains we have actually taken an
email-auth reading for. A domain we have not read is unknown, never "has no
DMARC", and here that is the difference between a finding and a smear. Sectors under 25
observed domains are left out, because below that the percentages are noise. Every figure
comes from a signed observation you can re-verify.