Measuring Top Domains: SPF, DMARC, and MTA-STS

Protocols like SPF, DMARC, and MTA-STS act as essential DNS records preventing malicious actors from spoofing emails from your domain. While experts universally recommend configuring them, the actual implementation status among top-tier websites remains a critical question. Researchers queried live DNS records for 152 of the most frequently used domains to evaluate whether top web properties genuinely protect their email infrastructure, discovering that while fundamentals are well handled, newer transport standards remain widely overlooked.

Out of the 152 domains analyzed, 146 actively receive mail by publishing MX records. Among this active subset, the adoption rates for foundational authentication standards are exceptionally high, though the advanced standard drops off sharply.

A DMARC record can sometimes be merely decorative, as the p= policy dictates how receiving servers handle messages failing authentication. Therefore, the core question is not just whether domains publish DMARC, but whether they actively enforce it. At the upper echelon of the web, they certainly do: 114 out of 152 domains deploy p=reject, the strictest setting available, while 26 use p=quarantine, and only 10 remain at monitor-only p=none settings.

Stock photo for illustration only, not from the actual event

These figures demonstrate that 75% of the evaluated domains utilize the strictest policy, and 93% of those publishing DMARC actively enforce it. The common half-measure of publishing a record and leaving it on monitor-only mode indefinitely is exceptionally rare among these large-scale domains.