Skysnag Research

The State of Email Authentication 2026

A live analysis of the top domains across 21 countries, measuring how many are actually protected against email spoofing with enforced DMARC.

45%of domains were at DMARC enforcement (protected)
31%had no DMARC visibility at all
24%had a DMARC record but were not enforcing it

Share of domains analyzed

The takeaway

Publishing DMARC is not enough: p=none monitors, while p=quarantine and p=reject request action on messages that fail DMARC. Verify legitimate senders before enforcing a policy.

Methodology

Based on live DMARC checks of the top domains in each of 21 countries (18,710 in total), ranked by authority, as of November 8, 2026. Top domains adopt DMARC more than the general population. Figures are rounded.

Based on live DMARC checks of the top domains in each of 21 countries (18,710 in total), ranked by authority, November 2026. Top domains adopt DMARC more than the general population. Refresh periodically.

See your SPF, DKIM and DMARC status in seconds.

Check your domain free →