Two-Thirds of the Top Million Domains Can Still Be Spoofed

A measurement study of the internet's email spoofing surface: who actually enforces DMARC across the Tranco top-1M, and what two years of mailbox-provider mandates changed.TL;DR: We analyse daily DNS snapshots of the Tranco top-1M domain list. As of July 17, 2026, 659,259 of these domains receive email, and for 67.4% of them — roughly 444,000 domains — no enforced DMARC policy stands between an attacker and a forged From: header. 458,467 domains do publish DMARC, but only 46.9% enforce it (p=quarantine or p=reject at pct=100), and that share is falling — down 0.44 percentage points in 30 days. Roughly 96,000 domains publish a monitoring-only policy with no reporting address at all: a record that neither blocks spoofing nor tells anyone it is happening. We argue this is a predictable artefact of the 2024–2025 bulk-sender mandates, which made the compliance floor (p=none) the de facto ceiling. 1. The question Email forgery is not an exotic attack. SMTP will happily transport a message whose From: header claims to be ceo@yourcompany.com, written by anyone; whether that message dies at the receiving server depends almost entirely on the authentication policy your domain publishes. Phishing built on this — business email compromise — remains one of the most expensive crime categories the FBI tracks, with roughly $3 billion in reported US losses in the 2025 IC3 annual report alone. The standard defence is DMARC: a DNS record where a domain owner tells the world's mail servers what to do with mail that fails authentication — nothing (p=none), spam-folder it (p=quarantine), or drop it (p=reject). Only the last two actually prevent spoofing. p=none is explicitly a monitoring mode: it asks receivers to send you reports while changing nothing about delivery. A domain at p=none counts as "having DMARC" in most adoption statistics while offering exactly zero protection against impersonation. So the security-relevant question is not "how many domains have DMARC?" It is: across the most-visited slice of the internet, how many domains can still be impersonated — and which way is that number moving? 2. Method Our data source is the daily forward-DNS measurement of the OpenINTEL platform (University of Twente / SURF / SIDN Labs), which queries the full Tranco top-1M list every day for MX, TXT and related records. OpenINTEL's infrastructure is described in van Rijswijk-Deij et al., IEEE JSAC 2016; Tranco, a research-oriented ranking designed to resist manipulation, in Le Pochat et al., NDSS 2019. From each daily snapshot we extract, per domain: the MX RRset, the apex SPF record, and the TXT record at _dmarc.. DMARC records are parsed for p=, sp=, pct= and rua= tags. We count a domain as enforcing only if p=quarantine or p=reject with pct=100 (or pct absent, which defaults to 100). A p=reject; pct=5 record is a rollout in progress, not an enforced policy, so it does not qualify. The pipeline runs daily; everything below refers to the July 17, 2026 snapshot unless stated otherwise. Aggregates, time series back to 2016, and the full methodology (including classification dictionaries and their known blind spots) are public — see Data availability. Headline denominators for this snapshot: 659,259 domains with MX records, 618,271 with SPF, 458,467 with a syntactically valid DMARC record. 3. Results 3.1 The spoofing surface: 444,000 domains Start with the raw arithmetic. Of 659,259 mail-receiving domains in the snapshot, 200,792 publish no DMARC record at all. Another 243,446 publish one that does not enforce (p=none, partial pct rollouts, or syntactically broken records). That leaves 215,021 domains — 32.6% — where a forged message is subject to a quarantine-or-reject policy at full coverage. Put the other way round: for 67.4% of the mail-receiving top-1M, the domain owner has published nothing that instructs receivers to stop an impersonated message. Receivers still apply their own heuristics, and a spoofed mail is not guaranteed an inbox — but DMARC policy is the only standardised, domain-owner-controlled layer in that stack, and for two-thirds of the population it is absent or disarmed. Adoption, meanwhile, looks superb on paper: 69.5% of MX-publishing domains now "have DMARC" — a figure that would have seemed utopian to measurement studies a decade ago. The security content of that figure is the problem. Most domains that have DMARC have a no-op. 3.2 The most common DMARC record on the internet does nothing, twice Looking at verbatim record strings (the literal bytes served from DNS) is unglamorous but revealing. The single most common DMARC record in the dataset is: v=DMARC1; p=none; published by 58,064 domains. Second place, at 32,682 domains, is the same string without the trailing semicolon. Across the 25 most common verbatim strings, eleven are p=none variants, together covering ~115,000 domains. The detail we find most interesting: four of those variants — about 96,000 domains — contain no rua= tag. rua is the address where receivers send aggregate reports; it is the entire point of monitoring mode. A p=none record without rua enforces nothing and reports to no one. It is the DNS equivalent of installing a security camera with no storage and no screen. From an attacker's perspective these domains are the best of both worlds: mail forged in their name is not blocked, and the forgery generates no signal the owner will ever see. The prevalence of byte-identical strings (including whitespace quirks) also suggests these records are not being written; they are being copy-pasted from the same handful of tutorials and setup wizards. Over the 30 days preceding the snapshot, the enforced share fell from 47.3% to 46.9% (−0.44 pp). Over the last year the drift is consistently negative. A naive reading is that domains are downgrading their policies. The domain-level change feed says otherwise: policy downgrades are rare events. What actually happens is dilution. New DMARC publishers enter the population overwhelmingly at p=none, faster than existing publishers graduate to quarantine/reject. The enforcement ratio falls even as the absolute number of enforcing domains slowly grows. This matters for how adoption statistics get reported. "DMARC adoption up, enforcement share down" is not a contradiction; it is what a compliance-driven adoption wave looks like. 3.4 The mandate hypothesis In February 2024, Google and Yahoo began requiring bulk senders (5,000+ messages/day) to publish DMARC — with p=none explicitly sufficient. Microsoft followed with analogous requirements for Outlook in 2025. These mandates were arguably the most effective DMARC adoption driver in the protocol's history. They are also, we suspect, the direct cause of the pattern in §3.2–3.3. When the requirement is "publish a record" and the minimum viable record is v=DMARC1; p=none;, rational actors publish exactly that and stop. The floor becomes the ceiling. The ~96k no-rua records are hard to explain any other way: nobody sets up monitoring mode with no monitoring unless the goal is to pass a check, not to monitor. We want to be careful here: this is a hypothesis consistent with the timing and the record composition, not a causal proof. A proper event-study around the mandate dates is on our list. 3.5 Context: the receiving side is consolidating One reason spoofing-resistant policies matter more each year: the mail those policies protect increasingly terminates at two companies. In the same snapshot, Google Workspace hosts inbound mail for 21.8% of MX-publishing domains and Microsoft 365 for 16.8% — 38.6% combined. Self-hosted mail has fallen from 44.6% of MX-publishing domains in 2016 to 22.4% today. A monoculture of receivers raises the stakes of authentication policy on both ends: a handful of enforcement decisions at Google or Microsoft now shape deliverability for the majority of the web. 4. Limitations Tranco's top-1M skews toward US/EU and global SaaS; low-traffic ccTLD domains are under-represented, and our pre-2022 history uses the retired Alexa list, which had a different composition. We read policy from DNS only: we cannot observe whether receivers honour pct, nor detect white-labelled security vendors behind vanity records. "Enforced" is a property of the published record, not of observed mail flow — receiver-side heuristics block some spoofing that policy alone would permit. The converse also holds: p=reject stops exact-domain forgery only; display-name tricks and lookalike (cousin) domains are outside DMARC's threat model entirely, so our 32.6% figure is an upper bound on policy-derived protection, not on phishing resistance. Finally, verbatim-string analysis over-attributes intent — some minimal records belong to parked domains that send no mail, for which p=none is arguably harmless (though p=reject would be the correct choice for a domain that never sends). 5. Takeaway DMARC adoption statistics increasingly measure compliance, not security. Ten years into the protocol and two years into the mandates, two-thirds of the mail-receiving top-1M can still be impersonated at the policy level, ~96,000 domains run monitoring mode that monitors nothing, and the enforcement share is drifting down, not up. If you maintain a domain: check whether your record has a rua address and whether anyone reads what arrives there; if you've been at p=none for more than a year, you are not monitoring, you are procrastinating — and unlike most security migrations, this one is a single DNS edit away from done. If you consume adoption statistics — as a researcher, a journalist, or someone's CISO: ask for the enforcement share, not the adoption share. The two numbers now tell opposite stories, and only one of them is about security. Data availability All aggregates, daily time series since 2016, per-provider breakdowns and the full methodology are published at check.live-direct-marketing.online, with machine-readable output (JSON) for replication. Raw OpenINTEL data is deleted after aggregation per their data agreement; the classification dictionaries are open and we fold reader corrections into the next daily run. The dataset is maintained by the authors as an ongoing side project; there is nothing to buy on that page. References Kucherawy, M., Zwicky, E. (2015). Domain-based Message Authentication, Reporting, and Conformance (DMARC). RFC 7489. van Rijswijk-Deij, R., Jonker, M., Sperotto, A., Pras, A. (2016). A High-Performance, Scalable Infrastructure for Large-Scale Active DNS Measurements. IEEE JSAC 34(6). Le Pochat, V., et al. (2019). Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation. NDSS 2019. Google. Email sender guidelines. support.google.com/a/answer/81126. Microsoft. Outlook's new requirements for high-volume senders (2025). techcommunity.microsoft.com. dmarcian. Understanding Gmail and Yahoo DMARC Requirements. dmarcian.com. FBI Internet Crime Complaint Center. 2025 Internet Crime Report. ic3.gov.