By the team at MailTester Ninja, a real-time email verification API that stores nothing.
Across 50,000 of the world's most-linked domains, 64.6% publish a DMARC record. Sounds healthy, until you read the policy.
Only 22.8% of all domains are on p=reject. Of the domains that publish DMARC at all, the split is:
-
p=none, 37.2% -
p=reject, 35.2% -
p=quarantine, 27.6%
p=none is monitoring only: it asks receivers to do nothing. A domain on p=none announces a policy it doesn't enforce, spoofable in practice, even though the record exists. The takeaway for anyone sending or securing email: publishing DMARC is not the same as being protected by DMARC. The path is p=none → p=quarantine → p=reject, and most of the web stops at step one.
Check any domain yourself, MailTester Ninja's free deliverability tools cover it end to end in one place: MX / SPF / DMARC analysis, an inbox-placement test scored out of 100, an SPF & DMARC generator and a blocklist checker, all with no signup and nothing stored. Need to confirm whether a specific mailbox actually exists and is deliverable? That is exactly what MailTester Ninja's email verifier does in real time, and we store no data.
Source: MailTester Ninja's open Email Infrastructure Index, a live DNS scan of 50,000 of the world's most-linked domains, updated daily, aggregate only. Free to cite under CC BY 4.0. Snapshot: Mon, 06 Jul 2026 04:17:13 GMT.
Top comments (1)
That enforcement gap is the real problem - publishing
p=noneis just monitoring, not protection. The jump from none to reject is where most teams stall because they are worried about breaking legitimate mail streams. A managed service or at minimum a proper reporting setup makes that transition much safer.