92% of Fortune 500 companies publish a DMARC record. Only 34% actually enforce it. That 58-point gap between "having DMARC" and "using DMARC to stop spoofing" is the story of email authentication in 2026.

I pulled data from Valimail's Email Fraud Landscape report, Agari's enterprise benchmarks, dmarcian's SMB aggregates, and Proofpoint's domain analysis. The numbers paint a clear picture: DMARC adoption surged after Gmail and Yahoo's 2024 bulk sender mandates. But most domains still sit at p=none — monitoring spoofing without stopping it. Here's where adoption actually stands. (If you're tracking deliverability metrics alongside authentication, JustAnalytics can help visualize the correlation.)

Methodology

We compiled DMARC adoption statistics from five primary sources:

Valimail's 2025 Email Fraud Landscape Report — analysis of 3+ million domains across industries
Agari's 2025 Q1 Enterprise DMARC Report — Fortune 500 and Global 2000 specific data
dmarcian's aggregate platform data — SMB and mid-market adoption trends from their DMARC monitoring service
Proofpoint's 2025 Domain Analysis — sector-specific enforcement rates across 2,000+ enterprise domains
Google Postmaster Tools aggregate data — authentication pass rates for Gmail-bound mail (published in Google's 2025 transparency reports)

Limitation: adoption statistics come from vendors who sell DMARC monitoring and enforcement tools. Selection bias exists — domains actively using these tools likely have better-than-average email hygiene. Where possible, we've cross-referenced multiple sources to verify trends.

Global DMARC Adoption: 58% Publish, 22% Enforce

Let's start with the headline numbers.

According to Valimail's 2025 report (their most recent annual release, covering data through Q4 2025), 58% of domains globally publish some form of DMARC record. That's up from 51% in 2024 and 43% in 2023.

But here's where it gets depressing. And I mean genuinely frustrating to anyone who's spent time explaining DMARC to a client.

Only 22% of domains enforce DMARC at quarantine or reject. That's it. The remaining 36% sit at p=none — watching spoofing happen and doing nothing about it. It's like installing a security camera, never checking the footage, and calling yourself protected.

Here's the policy breakdown:

DMARC Policy	Percentage of All Domains	Change from 2024
No DMARC record	42%	-7%
p=none	36%	+4%
p=quarantine	9%	+2%
p=reject	13%	+1%

The p=none pile grew fastest. Not great. Most new DMARC adopters stopped at monitoring and never ramped to enforcement. I get it — the jump from none to reject is scary. You imagine breaking payroll emails or killing a launch campaign. Fair.

But p=none doesn't actually protect your domain from spoofing. It just generates XML reports that land in a shared inbox nobody checks. I've been guilty of this myself (hence why I built tooling around it). (We wrote a full guide to ramping DMARC safely if you're stuck in p=none purgatory.)

Fortune 500 vs SMB: The Enforcement Gap

Enterprise adoption outpaces everyone else. No surprise there — bigger companies have dedicated security teams and more to lose from business email compromise.

Agari's 2025 Q1 analysis of Fortune 500 domains found:

92% publish DMARC records (up from 89% in 2024)
34% enforce at p=reject (up from 29% in 2024)
18% enforce at p=quarantine (steady)
40% still at p=none (down from 45%)

That 34% p=reject figure is actually encouraging. It jumped 5 percentage points in a year. The Gmail/Yahoo mandates lit a fire under enterprise security teams. But 40% of Fortune 500 companies — nearly half — still sit at p=none. These are companies with dedicated InfoSec budgets and compliance obligations. If they can't get past monitoring mode, what hope do smaller businesses have?

Speaking of smaller businesses.

dmarcian's aggregate data (covering their SMB and mid-market customer base) paints a different picture:

45% of SMB domains publish any DMARC record (vs 92% of Fortune 500)
Under 15% enforce at quarantine or reject (vs 52% of Fortune 500)
The most common state is no DMARC at all — not p=none, just nothing

The gap is brutal. Fortune 500 domains are 2x more likely to have DMARC and 3.5x more likely to enforce it. If you're a 50-person company competing with enterprise players, your domain is probably getting spoofed more often and stopping it less. That matters for deliverability — Gmail and Yahoo now factor DMARC enforcement into sender reputation. A domain with p=reject signals "we care about email security," and recipients treat your mail accordingly. (For sales teams making outbound calls, VeloCalls tracks which domains respond best — and DMARC-enforced senders consistently see higher reply rates.)

Industry-by-Industry: Finance Leads, Retail Lags

Enforcement rates vary wildly by industry. Proofpoint's 2025 sector analysis found:

Industry	DMARC Record Present	p=quarantine or p=reject
Financial services	89%	48%
Healthcare	81%	38%
Technology	78%	35%
Government	85%	32%
Education	72%	24%
Manufacturing	68%	21%
Retail	61%	18%
Hospitality	55%	15%

Finance leads because regulators forced them. PCI-DSS 4.0 (effective 2024) includes requirements around email authentication for organizations handling payment data. FFIEC guidance has pushed DMARC adoption at US banks since 2019. When compliance is mandatory, adoption follows. (Similar logic applies to ad fraud protection with ClickzProtect — regulated industries adopt faster because the cost of not doing so is audit findings, not just budget waste.)

Healthcare's 38% enforcement rate surprises me. HIPAA doesn't mandate DMARC directly, but business email compromise in healthcare triggers breach notifications. The 2024 Change Healthcare attack — where spoofed emails contributed to the initial compromise — pushed a lot of health systems to finally ramp enforcement.

Retail's 18% is embarrassing. Full stop. These are companies sending millions of order confirmations and marketing emails per week. Their domains are prime spoofing targets. Most can't even reach p=quarantine.

I'll be honest: I don't fully get the hesitation. Maybe marketing teams fear breaking promo sends? But here's what they're missing — the deliverability cost of not enforcing DMARC in 2026 is higher than the risk of temporary breakage during deployment. And "temporary" usually means a week, not a quarter.

The Gmail/Yahoo Effect: 2024 Mandates Drove a 14% Adoption Spike

Here's the biggest story in the data.

In February 2024, Gmail and Yahoo jointly announced bulk sender requirements: domains sending 5,000+ emails daily to Gmail or Yahoo addresses must authenticate with SPF, DKIM, and DMARC (at minimum p=none), maintain alignment, and keep spam complaint rates below 0.3%.

The mandate deadline was April 2024. And adoption spiked hard.

Valimail tracked a 14% year-over-year increase in DMARC record publication between Q1 2024 and Q1 2025 — the largest jump since DMARC launched in 2012. The previous record was 8% growth in 2020 (driven by pandemic-era phishing concerns).

What changed:

Bulk senders who'd ignored DMARC for years suddenly needed at least p=none
Marketing platforms (Mailchimp, Klaviyo, HubSpot) started requiring custom DMARC before allowing high-volume sends
Email deliverability consultants were fully booked for months — I heard of 3-month backlogs at multiple agencies

The mandate worked. Sort of.

Here's the thing: it only required p=none. So that's where most new adopters stopped — because that's all Gmail asked for. p=none satisfies the mandate without actually stopping spoofing. Gmail's stated goal was authentication visibility, not enforcement. They got visibility. The spoofing? Still happening. Cool.

Google's Postmaster Tools aggregate data (from their 2025 transparency reports) shows authentication pass rates for Gmail-bound mail improved from 82% in Q1 2024 to 91% in Q1 2025. That's real progress. But pass rates measure whether legitimate senders are authenticated — not whether spoofed mail is blocked. Only p=reject accomplishes that.

Why p=none Sticks: The Enforcement Barrier

If p=none is basically useless for blocking spoofing, why do 36% of domains stay there forever?

Based on dmarcian's customer surveys and Proofpoint's deployment data, the blockers are:

Fear of breaking legitimate mail. This is the big one. Teams see aggregate reports showing third-party senders (marketing tools, billing platforms, recruiting systems) and panic. "If we go to reject, half our email will bounce." Usually wrong — those senders just need DKIM enabled. But the fear is real. (Our DMARC ramp guide covers how to identify and fix these senders before moving past none.)

Nobody owns the DMARC reports. Aggregate reports arrive daily as XML attachments. Security team thinks email team reads them. Email team thinks IT reads them. IT thinks security handles it. Nobody reads them. The reports pile up in a shared inbox until audit season or someone gets spoofed badly enough to check.

p=none satisfied the Gmail mandate. Bulk senders who adopted DMARC specifically for Gmail compliance hit p=none and stopped. Mission accomplished, back to other fires. The mandate created a floor, not a ceiling.

Third-party senders won't cooperate. Some legacy vendors still don't support custom DKIM signing. If your contract management platform sends from your domain but signs with their own keys, you can't reach DMARC alignment without changing vendors. Some teams decide that's too expensive.

The irony: staying at p=none actually costs more in the long run. Gmail and Yahoo now weight enforcement in reputation scoring. A domain at p=reject (with clean authentication) sees better inbox placement than one at p=none with identical content and volume. The deliverability hit of non-enforcement compounds daily.

What Changed Since 2024: Enforcement Finally Accelerating

Here's the good news.

p=reject adoption grew 5 percentage points among Fortune 500 companies in 2024-2025 (Agari data). That's not fast, but it's faster than the previous decade. Some context:

p=reject adoption grew just 2 percentage points from 2019-2023 in the same cohort
The 2024-2025 growth rate was 2.5x the historical pace

What's driving it:

The Gmail mandate normalized DMARC conversations. Before 2024, DMARC was an InfoSec concern that marketing ignored. The mandate forced cross-functional discussions. Once marketing teams understood why DMARC matters for deliverability, they stopped blocking enforcement.

DMARC tooling improved. dmarcian, Valimail, and Agari all shipped better dashboards in 2024. Identifying unaligned senders got easier. The "we can't figure out what's failing" excuse lost credibility.

High-profile BEC losses made the news. Business email compromise losses hit $2.9 billion in 2024 according to the FBI's IC3 report. CEOs started asking why spoofing their domain was still possible. Security teams got budget to finish DMARC deployments. (For teams tracking security incidents alongside development workflows, DevOS offers unified dashboards that surface email security alerts.)

For multi-domain operators — agencies, freelancers, SaaS founders running multiple products — the trend has a practical implication. Every domain you control should have DMARC at p=reject before you scale email volume. The deliverability advantages compound. The spoofing protection is real. And the Gmail mandate is just the beginning — Microsoft has signaled similar requirements for Outlook.com in 2026. Get ahead of it. (JustEmails auto-configures DMARC on new domains, which is how we get around the "nobody sets it up" problem. But you still have to ramp past none yourself.)

Implications: What to Do With This Data

If your domain has no DMARC record: Add one today. Start at p=none with rua= pointing to a parser you'll actually check. You're in the 42% minority without any DMARC — that's worse than average now.

If you're stuck at p=none: Read your aggregate reports. Identify every legitimate sender. Enable DKIM on third-party services. Ramp to p=quarantine with pct=10 and work up from there. The average time from none to reject for a mid-sized domain is 6-12 weeks — not months, not years.

If you manage multiple domains: Prioritize by volume. Your highest-traffic domains face the most spoofing risk and benefit most from enforcement. For low-traffic domains, even basic p=none provides visibility. JustEmails supports unlimited domains at $49/year, so cost isn't a blocker. The bottleneck is actually reading the reports and acting on them. (For context on multi-domain hosting economics, see our flat-fee vs per-mailbox pricing breakdown.)

If you're comparing email providers: Check whether the provider auto-configures DMARC or leaves it to you. Google Workspace and Microsoft 365 require manual DNS setup. JustEmails, Fastmail, and Migadu offer varying levels of auto-configuration. The easier setup is, the more likely you'll actually finish it. (For deliverability-focused comparisons, see our business email pricing survey.)

The DMARC story in 2026 is adoption without enforcement. Most domains have the record. Most don't use it. That gap is closing — slowly — but the majority still watch spoofing happen instead of stopping it.

If you're reading this and your domain is at p=none, you know what to do. I'm not going to pretend it's painless. But it's less painful than explaining to your CEO why someone impersonated your CFO via your own domain.

Frequently Asked Questions

What percentage of domains have DMARC records in 2026?

According to Valimail's 2025 Email Fraud Landscape report, approximately 58% of domains globally publish some form of DMARC record — up from 51% in 2024. However, only 22-25% enforce policies at quarantine or reject level. The majority remain at p=none, which monitors but doesn't block spoofing.

How does Fortune 500 DMARC adoption compare to SMB adoption?

Fortune 500 companies lead significantly: 92% publish DMARC records according to Agari's 2025 analysis. But enforcement lags — only 34% have reached p=reject. SMB adoption is lower across the board: roughly 45% publish any DMARC record, and under 15% enforce rejection policies, per dmarcian's aggregate data.

Did Gmail and Yahoo's 2024 bulk sender requirements increase DMARC adoption?

Yes. Valimail reported a 14% increase in DMARC record publication between Q1 2024 and Q1 2025 — the largest year-over-year jump since DMARC's introduction in 2012. The requirements forced bulk senders (5,000+ daily sends to Gmail/Yahoo) to publish at least p=none, driving adoption among marketing-heavy domains.

Which industries have the highest DMARC enforcement rates?

Financial services leads with 48% enforcement at p=quarantine or p=reject, followed by healthcare at 38% and technology at 35%. Retail and hospitality lag at 18-22% enforcement. The regulatory pressure in finance (PCI-DSS, FFIEC guidance) correlates with stricter adoption.

Try JustEmails

Unlimited custom domain email hosting for $49/year flat — unlimited domains, unlimited mailboxes, 10 GB storage, full IMAP/SMTP. Built for agencies, freelancers, and anyone managing email across more than one domain.

Start your 7-day free trial → · How it compares

DMARC Adoption Statistics 2026: Who Enforces, Who Lags, and Why