Who actually enforces DMARC? Reject rates by email provider

By the team at MailTester Ninja — a real-time email verification API that stores nothing.

DMARC enforcement isn't spread evenly, it tracks who hosts the mail. Share of each provider's domains that reach p=reject (and SPF -all):

• Other / self-hosted, 18.6% on p=reject, 42% on SPF -all
• Google Workspace / Gmail, 26.8% on p=reject, 25.9% on SPF -all
• Microsoft 365 / Outlook, 31.1% on p=reject, 60.8% on SPF -all
• Proofpoint, 61.8% on p=reject, 44.2% on SPF -all
• Mimecast, 36% on p=reject, 42% on SPF -all
• Tencent QQ, 2.5% on p=reject, 6.5% on SPF -all
• Namecheap, 1% on p=reject, 1.4% on SPF -all

Proofpoint leads on enforcement (61.8% reject). Managed security gateways pull their customers toward strict policy by default, while self-hosted / other lags (18.6% reject), enforcement is a config someone has to choose, and manageds choose it for you. The practical read: the reputation and policy of an address depends heavily on its provider, which is exactly why testing against the real receiving server beats guessing from the domain alone.

---

Check any domain yourself — our free deliverability analyzer shows a domain's MX / SPF / DMARC in one click (no signup, nothing stored). Need to confirm whether a specific mailbox actually exists and is deliverable? That is exactly what MailTester Ninja's email verifier does in real time — and we store no data.

Source: MailTester Ninja's open Email Infrastructure Index — a live DNS scan of 50,000 of the world's most-linked domains, updated daily, aggregate only. Free to cite under CC BY 4.0. Snapshot: Mon, 13 Jul 2026 04:18:30 GMT.