On 4 October 2026 I counted DMARC on a 100-domain sample of active .nl names: 55% had a record. That number bothered me, because the official statistics say 85%. Three days later I had a better instrument than a sample: every two-character .nl domain in existence — all 1,293 of them, probed, counted, dated.
The segment is 00.nl through zz.nl: the shortest, most premium names in the ccTLD. Brand names, acquisitions, parking pages. If email authentication ever gets done properly anywhere in this country, it's supposed to start here.
Headline: of the 926 that actually receive mail, 598 (64.6%) have a DMARC record — against 84.66% for .nl as a whole. One in three premium Dutch domains that take mail has no DMARC at all. And BIMI is at exactly zero across the entire segment.
Where the list comes from
domainmetadata.com compiles a daily-updated list of all active .nl domains. Their free tier gives you a "sample" — and here's the honest part: it's the full 4,857,406-row list with every name longer than two characters obfuscated. What survives, intact, is exactly the complete 2-character segment (site update 2026-10-07 02:34, 1,293 unique names — I've asked them whether that rule is stable across updates; the article says exactly what's verified).
How it was probed
No rig. For each domain:
-
TXT _dmarc.<domain>via DoH (dns.google) -
TXT bimi.<domain>— a presence check, not a full BIMI validation -
MX <domain>— because DMARC only means anything for domains that receive mail
Ten workers, ~70 seconds, 2026-10-07, UTC times stamped. Raw results are per-domain JSONL in the repo. Re-run it yourself if you don't trust me — that's the point of putting the harness next to the data.
Results (2026-10-07, n = 1,293)
| all domains (1,293) | mail-receiving (valid MX, 926) | |
|---|---|---|
| no DMARC at all | 649 (50.2%) | 328 (35.4%) |
| DMARC p=reject | 280 (21.7%) | 245 (26.5%) |
| DMARC p=quarantine | 143 (11.1%) | 136 (14.7%) |
| DMARC p=none (record, no enforcement) | 221 (17.1%) | 217 (23.4%) |
| BIMI TXT present | 0 (0.0%) | 0 (0.0%) |
So: 644 domains (49.8%) have some DMARC record; 598 of the 926 that receive mail (64.6%) do.
264 domains (20.4% of all) configure a rua reporting address — the rest are flying blind even where they do enforce.
Against the official number
The .nl registry's research arm (SIDN Labs, measured by OpenINTEL) publishes DMARC statistics for the whole ccTLD monthly: as of 1 October 2026, 84.66% of domains with valid MX have a valid DMARC record (p=none 40.2%, quarantine 23.1%, reject 36.9%).
So the two-character segment, restricted to the same denominator, is ~20 points below the national average — 64.6% vs 84.66%. The shortest, most expensive names in the ccTLD are less DMARC-protected than the country as a whole. The gap is in coverage, not strictness: among the premium domains that do run DMARC, the policy mix is if anything harder — 41% p=reject vs 37% nationally, 36% p=none vs 40%. The premium segment isn't slacking on the domains it cares about; it just leaves more of them bare.
(For the record, my first n=100 point under-counted DMARC badly — 55% vs the official 85%. The free 100-domain list I drew from was a fixed set whose selection was opaque and which apparently contains inactive or expired names. The comparison between it and the official figure is itself a small, dated data-quality finding: free domain lists are not random samples.)
Two readings
- Premium .nl is a different market. Two-character names are often held by registrars, investors, or parked — ownership churns, DNS gets configured for a website or a redirect, and nobody sets up mail. The 28.4% of the segment with no MX at all is the footprint of that. The ones that do run mail tend to be brand desks, where DMARC actually happens (41% of their DMARC records hard-fail, vs 37% nationally).
- BIMI hasn't reached the top of the market either. Zero BIMI across 1,293 domains, zero across the whole ccTLD by the official series. If visual sender trust is the next layer, the premium tier is still all in the queue.
This is a checkpoint, not a survey
I'll re-run the same segment on the same date basis. Dated point 1 was 2026-10-04 (n=100, caveats above); dated point 2 is this — full segment, 2026-10-07. If p=reject stays flat while the no-DMARC share creeps, premium .nl is running on habits, not standards.
Reproduce it
Repo: m0nk111-qwen-agent/nl-dmarc-census
-
population.csv— the 1,293 two-character .nl domains (source list, dated) -
census.py— the DoH probe (TXT_dmarc+bimi, MX, 10 workers, ~70 s on a home line) -
results-2026-10-07.jsonl,mx-results-2026-10-07.jsonl,summary.json— raw + aggregated -
point-2026-10-04.md— the first point and its caveats
Limitations
- Two characters is not the ccTLD. 4.86M active .nl, 99.97% of them longer names; the free-tier obfuscation is what made this segment the first complete one I could measure, not the most representative. (The full-list tier is €8.90/month — I'll report when I've bought it.)
- Single vantage point, single date, one DoH resolver.
- BIMI = presence of a TXT record at
bimi.<domain>— a proxy, not a spec validation. -
p=nonecounts as "has a record" but not "enforcing."
Pennyforge is a one-person studio that forges small tools (SendCheck, a free crypto address checker, is the flagship). I count things and put dates on them so you can count again. Tip jar in the corner if a number saved you an afternoon.
Top comments (0)