domain authentication survey · august 2026
A third of the world's biggest domains can still be spoofed.
We checked SPF, DKIM and DMARC on the Tranco top 1,200. Of the 998 that actually accept mail, 319 publish no usable DMARC policy — meaning a forged message claiming to come from them arrives like any other, and nobody at the domain is told it happened.
The breakdown
Receivers are told nothing. A forged message is delivered like any other.
Monitoring only. The policy explicitly instructs receivers to take no action.
Forged mail is sent to spam or refused outright.
No published list of who may send as the domain.
Either mail is unsigned, or the selector is one we cannot guess.
Four domains publish two SPF records. That is a permanent error: receivers treat it as no SPF at all, so the record does nothing. They have been contacted and are not named here.
By top-level domain
The gap between .com and .net is the part we did not expect. Over half the top .net domains that accept mail have no enforcing DMARC policy.
| TLD | Spoofable | Sample | Rate |
|---|---|---|---|
| .net | 46 | 84 | 54.8% |
| .io | 12 | 26 | 46.2% |
| .org | 22 | 57 | 38.6% |
| .ru | 13 | 49 | 26.5% |
| .com | 156 | 591 | 26.4% |
Grade distribution
Method
Population: the Tranco top 1,200, a research-standard ranking that averages several sources to resist manipulation. Collected August 2026.
Every check is a public DNS lookup. Nothing is sent to any domain and no mailbox is probed. The sample is restricted to the 998 domains with a working MX record, because sender authentication on a domain that receives no mail means nothing.
“Spoofable” means no DMARC record, or a DMARC record with p=none. Both leave receiving servers with no instruction to reject a forgery. p=none is the correct place to begin a DMARC rollout and the wrong place to stop.
SPF is checked beyond mere presence: multiple records, exceeding the ten-lookup limit, and +all all count as failures, because each disables the record in practice.
Limitations
- DKIM is undercounted. Selectors cannot be enumerated from outside; we try about thirty that common providers use. A “not found” means we could not see one, not that none exists — treat the 36% as an upper bound.
- A published policy is not an enforced one. We read what a domain declares, not what receivers do with it.
- One point in time. DNS changes. Every result is timestamped and the survey re-runs in minutes.
- We sell a product in this space. Which is why the engine is MIT licensed and this is reproducible rather than asserted.
Check your own
Free, no signup, same checks. Every result gets a permanent link you can send to whoever owns your DNS.
Public DNS only — nothing is sent to the domain, nothing is stored unless you ask for the report. DKIM selectors can't be enumerated from outside, so a “not found” there may just mean a custom selector.