Anyone can send an email that claims to come from any domain. Two DNS records exist to stop that: SPF, which lists the servers allowed to send email for a domain, and DMARC, which tells receiving servers what to do with messages that fail the checks. We looked up both records for the 6,971 websites in the world’s top 10,000 domains (Tranco list 8PX8V).
Key findings
- 85% have an SPF record and 76% have a DMARC record.
- Only 55.9% enforce DMARC with a quarantine or reject policy. The other 44.1% either have no DMARC record (24%) or use p=none (20.1%), which only monitors.
- 33.1% use the strictest policy, p=reject, which asks mail servers to refuse forged messages.
- The biggest sites are the best protected: 77.6% of the top 100 enforce DMARC, compared with 54.2% of sites ranked 1,001 to 10,000.
- Domains that do not receive email are the most exposed. Of the 1,098 websites without mail servers (no MX record), only 19.2% have both SPF and an enforced DMARC policy, the recommended setup for domains that never send email.
- 0.8% publish more than one SPF record, which is invalid and makes SPF fail.
DMARC: the record that actually stops spoofing
SPF alone does not protect the address people see in the From field. DMARC ties the checks to that visible address and tells the receiving server what to do when they fail: nothing (p=none), send the message to spam (p=quarantine) or reject it (p=reject). Since February 2024, Gmail and Yahoo require bulk senders to publish a DMARC record, which has pushed adoption up. But many domains stop at p=none, which gives visibility through reports without blocking anything.
DMARC policy of the top websites
% of 6,971 websites
Protection by popularity
The biggest sites protect their email best
% of websites in each Tranco ranking tier
How SPF records end
The end of an SPF record says how strict it is. 40.3% of the websites end with -all (fail anything not listed) and 39.3% with ~all (soft fail). Both are common; with an enforced DMARC policy, ~all is usually enough. 2.7% have no all mechanism at all, and 1.9% end with ?all, which protects nothing.
Why it matters for SEO and brands
- Brand trust. Phishing emails that impersonate your domain damage your reputation with customers.
- Deliverability. Gmail, Yahoo and Microsoft increasingly filter mail from domains without proper authentication, including your newsletters and transactional emails.
- Domain reputation. A domain used for spam can end up on blocklists that affect more than email.
A safe setup in three records
For a domain that sends email, after listing every service that sends on your behalf:
example.com. TXT "v=spf1 include:_spf.google.com ~all"
_dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"Start DMARC at p=none to collect reports, check that all legitimate senders pass, then move to quarantine and reject. For a domain that never sends email:
example.com. TXT "v=spf1 -all"
_dmarc.example.com. TXT "v=DMARC1; p=reject;"
example.com. MX 0 .Check any domain’s SPF, DMARC and DNS records with our free Domain Lookup tool.
Methodology
We took the 6,971 websites of the top 10,000 domains in Tranco list 8PX8V (domains whose home page responds) and queried their MX, TXT and _dmarc TXT records through DNS over HTTPS. A domain enforces DMARC when its policy is quarantine or reject. Domains with no MX record, or with a null MX, are counted as not receiving email. Results describe the registrable domain, not every subdomain, and were collected on October 18, 2026.
How to cite: SEOOn.page (2026). Email Spoofing Protection in the World’s Top 10,000 Websites (2026). https://seoon.page/research/email-security-top-websites-2026/