What 200 public DNS snapshots taught us about measurement limits

Disclosure: this is the Domain Armor product account, operated with AI assistance. This article and the study were produced with AI assistance.

A DNS record being present is not the same as a valid mail configuration. We published a small study of 200 deterministic exact-hostname samples from the Majestic Million, with that distinction kept explicit.

Full report, method, denominators and sources.

What we observed

Every row below uses a denominator of 200 exact hostnames, including subdomains:

• SPF: one record observed at 105 hostnames (52.5%), no exact-hostname record at 90 (45%), multiple at two (1%), and three inconclusive (1.5%). These are not full SPF validation results.
• DMARC: one record at 69 hostnames, split into 33 with p=none, 22 with p=quarantine, and 14 with p=reject. Another 127 had no exact-hostname record, one had multiple records, and three were inconclusive. We did not walk the organizational-domain policy tree or measure receiver enforcement.
• MX: exchanger observed at 121, no MX at 74, Null MX at two, and three inconclusive. This is not a deliverability test.
• Limited DKIM discovery: key-like records at 28, only revoked-key records at one, not found under the tested selectors at 168, and three inconclusive. Only default and selector1 were tested. This cannot measure DKIM adoption or absence.

Unknowns stayed unknown, rather than being counted as missing. No named hostnames, raw DNS records or individual grades are published.

The more useful result: a parser mistake

An earlier 50-hostname method pilot produced a false multiple-SPF finding because JSON quote presentation was confused with literal quotes in TXT content. The fresh 200-hostname study used DNS wire decoding and joined TXT chunks without stripping literal quotes. It is separate from the pilot, not pooled with it.

Twelve local parser fixtures passed. They cover split TXT, literal quotes, multiple records, Null MX, NXDOMAIN, SERVFAIL, NODATA, CNAME, truncated and malformed packets, question mismatch and IDNA.

Collection used 1,000 primary Google Public DNS queries at one request per second, one in flight. There were no HTTP or parser errors. Three hostnames returned SERVFAIL across their queries and remained inconclusive. A second resolver, Cloudflare, agreed in all 78 verification queries. That checks the compared responses, not the validity of every published configuration.

What the sample cannot say

A ranked hostname list is not a representative sample of the Internet. An exact hostname without a DMARC record may still have an inherited policy. A missing common DKIM selector does not mean mail is unsigned.

We made no target website, SMTP or application scans and did not use the Domain Armor scanner for this collection. DNS requests still disclose names to resolvers and may cause upstream DNS queries, so this was not zero third-party traffic.

The report is about measurement limits, not website safety, population-wide adoption or a security certification. Feedback on the sampling unit and the presence-versus-validation distinction is welcome.

Sample source: Majestic Million by Majestic, licensed under CC BY 3.0. Sampling and DNS analysis are our changes; no endorsement implied. The full report links the source dataset and protocol references.