Publishing DMARC and enforcing it are different facts
DMARC is the line in a domain's DNS that tells receiving mail servers what to do with mail
that forges its name: nothing, quarantine it, or reject it. All three are a
published record. Only two of them stop anything. The board below reads the policy, so a
sector that is covered can be told from one that only looks it.
Across the 7,287 domains we have an email-auth reading for,
78% publish DMARC.
24% of those publish p=none, which enforces nothing.
rss
1,144 scanned
240 enforcing
300 p=none (enforces nothing)
604 no DMARC
47% publish DMARC. Of those, 56% are p=none, which enforces nothing.
fortune_500
684 scanned
466 enforcing
90 p=none (enforces nothing)
128 no DMARC
81% publish DMARC. Of those, 16% are p=none, which enforces nothing.
media_entertainment
331 scanned
217 enforcing
57 p=none (enforces nothing)
57 no DMARC
83% publish DMARC. Of those, 21% are p=none, which enforces nothing.
manufacturing
297 scanned
204 enforcing
54 p=none (enforces nothing)
39 no DMARC
87% publish DMARC. Of those, 21% are p=none, which enforces nothing.
web3_defi
275 scanned
169 enforcing
28 p=none (enforces nothing)
78 no DMARC
72% publish DMARC. Of those, 14% are p=none, which enforces nothing.
education_expanded
266 scanned
165 enforcing
96 p=none (enforces nothing)
5 no DMARC
98% publish DMARC. Of those, 37% are p=none, which enforces nothing.
pharma_biotech
264 scanned
179 enforcing
59 p=none (enforces nothing)
26 no DMARC
90% publish DMARC. Of those, 25% are p=none, which enforces nothing.
consulting
254 scanned
193 enforcing
36 p=none (enforces nothing)
25 no DMARC
90% publish DMARC. Of those, 16% are p=none, which enforces nothing.
cybersecurity_expanded
242 scanned
180 enforcing
26 p=none (enforces nothing)
36 no DMARC
85% publish DMARC. Of those, 13% are p=none, which enforces nothing.
fashion_luxury
232 scanned
170 enforcing
39 p=none (enforces nothing)
23 no DMARC
90% publish DMARC. Of those, 19% are p=none, which enforces nothing.
fintech_expanded
224 scanned
176 enforcing
23 p=none (enforces nothing)
25 no DMARC
89% publish DMARC. Of those, 12% are p=none, which enforces nothing.
non_profit
216 scanned
134 enforcing
49 p=none (enforces nothing)
33 no DMARC
85% publish DMARC. Of those, 27% are p=none, which enforces nothing.
automotive
215 scanned
130 enforcing
44 p=none (enforces nothing)
41 no DMARC
81% publish DMARC. Of those, 25% are p=none, which enforces nothing.
hospitality
209 scanned
134 enforcing
34 p=none (enforces nothing)
41 no DMARC
80% publish DMARC. Of those, 20% are p=none, which enforces nothing.
sports_entertainment
204 scanned
111 enforcing
45 p=none (enforces nothing)
48 no DMARC
77% publish DMARC. Of those, 29% are p=none, which enforces nothing.
insurance
188 scanned
123 enforcing
25 p=none (enforces nothing)
40 no DMARC
79% publish DMARC. Of those, 17% are p=none, which enforces nothing.
energy
174 scanned
104 enforcing
23 p=none (enforces nothing)
47 no DMARC
73% publish DMARC. Of those, 18% are p=none, which enforces nothing.
government_expanded
167 scanned
124 enforcing
32 p=none (enforces nothing)
11 no DMARC
93% publish DMARC. Of those, 21% are p=none, which enforces nothing.
construction
166 scanned
104 enforcing
29 p=none (enforces nothing)
33 no DMARC
80% publish DMARC. Of those, 22% are p=none, which enforces nothing.
telecom
155 scanned
91 enforcing
37 p=none (enforces nothing)
27 no DMARC
83% publish DMARC. Of those, 29% are p=none, which enforces nothing.
real_estate_expanded
151 scanned
86 enforcing
40 p=none (enforces nothing)
25 no DMARC
83% publish DMARC. Of those, 32% are p=none, which enforces nothing.
legal_expanded
140 scanned
99 enforcing
26 p=none (enforces nothing)
15 no DMARC
89% publish DMARC. Of those, 21% are p=none, which enforces nothing.
agriculture
131 scanned
68 enforcing
23 p=none (enforces nothing)
40 no DMARC
70% publish DMARC. Of those, 25% are p=none, which enforces nothing.
logistics_expanded
124 scanned
69 enforcing
28 p=none (enforces nothing)
27 no DMARC
78% publish DMARC. Of those, 29% are p=none, which enforces nothing.
aerospace
115 scanned
69 enforcing
27 p=none (enforces nothing)
19 no DMARC
84% publish DMARC. Of those, 28% are p=none, which enforces nothing.
crypto
62 scanned
58 enforcing
3 p=none (enforces nothing)
1 no DMARC
98% publish DMARC. Of those, 4.9% are p=none, which enforces nothing.
big_tech
56 scanned
53 enforcing
3 p=none (enforces nothing)
0 no DMARC
100% publish DMARC. Of those, 5.4% are p=none, which enforces nothing.
fintech
54 scanned
48 enforcing
4 p=none (enforces nothing)
2 no DMARC
96% publish DMARC. Of those, 7.7% are p=none, which enforces nothing.
misc
53 scanned
15 enforcing
7 p=none (enforces nothing)
31 no DMARC
42% publish DMARC. Of those, 32% are p=none, which enforces nothing.
devops
46 scanned
38 enforcing
4 p=none (enforces nothing)
4 no DMARC
91% publish DMARC. Of those, 9.5% are p=none, which enforces nothing.
languages
44 scanned
22 enforcing
12 p=none (enforces nothing)
10 no DMARC
77% publish DMARC. Of those, 35% are p=none, which enforces nothing.
security
44 scanned
44 enforcing
0 p=none (enforces nothing)
0 no DMARC
100% publish DMARC. Of those, 0% are p=none, which enforces nothing.
email_comms
44 scanned
37 enforcing
5 p=none (enforces nothing)
2 no DMARC
96% publish DMARC. Of those, 12% are p=none, which enforces nothing.
dev_tools
42 scanned
38 enforcing
1 p=none (enforces nothing)
3 no DMARC
93% publish DMARC. Of those, 2.6% are p=none, which enforces nothing.
media
41 scanned
26 enforcing
9 p=none (enforces nothing)
6 no DMARC
85% publish DMARC. Of those, 26% are p=none, which enforces nothing.
data_analytics
40 scanned
31 enforcing
6 p=none (enforces nothing)
3 no DMARC
93% publish DMARC. Of those, 16% are p=none, which enforces nothing.
ai_ml
39 scanned
30 enforcing
7 p=none (enforces nothing)
2 no DMARC
95% publish DMARC. Of those, 19% are p=none, which enforces nothing.
ecommerce
33 scanned
29 enforcing
4 p=none (enforces nothing)
0 no DMARC
100% publish DMARC. Of those, 12% are p=none, which enforces nothing.
infrastructure
31 scanned
16 enforcing
5 p=none (enforces nothing)
10 no DMARC
68% publish DMARC. Of those, 24% are p=none, which enforces nothing.
developer
31 scanned
8 enforcing
2 p=none (enforces nothing)
21 no DMARC
32% publish DMARC. Of those, 20% are p=none, which enforces nothing.
cloud
30 scanned
24 enforcing
1 p=none (enforces nothing)
5 no DMARC
83% publish DMARC. Of those, 4.0% are p=none, which enforces nothing.
cms
29 scanned
24 enforcing
5 p=none (enforces nothing)
0 no DMARC
100% publish DMARC. Of those, 17% are p=none, which enforces nothing.
CAA: naming which authorities may issue a certificate
CAA is an issuance allowlist: it names which certificate authorities are allowed to issue a
certificate for a domain, which is a real defense against mis-issuance. There is a catch worth
knowing: a CAA record that carries only an iodef reporting address restricts
nobody - any CA can still issue - even though it passes a simple "has CAA?"
check. So the number that matters is not who publishes CAA, but who actually constrains issuance.
54,229actually restrict who may issue
331publish CAA that restricts nobody
2forbid all issuance (issue ";")
751,587publish no CAA at all
Of 806,149 domains we have a reading for, 7% publish any CAA, and 1% of those constrain no one.
security.txt: publishing where to report a problem, and keeping it current
RFC 9116 asks a domain to publish where to report a vulnerability, and makes an
Expires date mandatory - so a stale file cannot sit there forever
pointing at an inbox nobody reads. An expired security.txt can be worse than
none: it points a researcher at a contact the organisation may no longer be watching.
3,511publish a security.txt
486of those have EXPIRED (14%)
34,518publish none
7,999refused our read (unknown, not "none")
Read for 46,028 domains so far, and climbing as enrichment sweeps the catalog.
What these percentages are counted against. Only domains we have actually taken an
email-auth reading for. A domain we have not read is unknown, never "has no
DMARC", and here that is the difference between a finding and a smear. Sectors under 25
observed domains are left out, because below that the percentages are noise. Every figure
comes from a signed observation you can re-verify.