Runbook Foundry

Posted on Oct 19

What % of top domains are spoofable in October 2026?

#email #security #dns #devops

Anyone can put your domain in the From: line of an email. Whether receiving servers believe it comes down to a few DNS records, and DMARC is the one that tells them what to do when a message fails authentication.

So I wanted to know: among the most-linked domains on the web, how many still leave that door open?

Short answer: 27.9%. Of 974 domains we could audit from the Majestic Million top 1,000, 272 publish no DMARC record, publish one with p=none, or publish an invalid record. A policy of none asks receivers to do nothing.

Method

Source list: the Majestic Million top 1,000 by GlobalRank, downloaded on October 19, 2026. This is a one-day snapshot.
Attribution (CC BY 3.0): "Majestic Million" by Majestic (https://majestic.com/reports/majestic-million), licensed under the Creative Commons Attribution 3.0 Unported License. Domains were normalized; no other changes were made to the list.
Checks: passive DNS lookups (DMARC, SPF, MX, a set of common DKIM selectors, MTA-STS, TLS-RPT, BIMI) and one HTTPS request per domain. Nothing was sent to any mailbox and nothing was probed.
Coverage: 20 of the 1,000 entries are public suffixes rather than registrable domains, so they were skipped. Of the remaining 980, 974 resolved cleanly. One returned NXDOMAIN and five returned DNS errors. All percentages below are of those 974.
"Spoofable" means the effective DMARC policy isn't enforced: the record is missing, says p=none, or is invalid. Subdomains are judged by the policy they inherit from their organizational domain (sp= or p=).

Every figure was recomputed from the per-domain CSV with a short Python script. This post only reports aggregates, and no individual domains are named.

Findings

DMARC policy distribution

Effective policy	Domains	Share
reject	517	53.1%
quarantine	185	19.0%
none	165	16.9%
missing	107	11.0%

The good news first: 72.1% enforce DMARC, and most of them have gone all the way to reject. Among the biggest sites on the web, enforcement is now the norm.

The other 27.9% matters, though. These domains are heavily linked, widely recognized, and exactly what a phisher wants to put in a From: header.

Spoofable share by mail provider

We classified each domain by its MX records.

Provider (from MX)	Domains	Spoofable
Google Workspace	270	18.1%
Microsoft 365	161	20.5%
Proofpoint	93	17.2%
Mimecast	26	19.2%
Other / self-hosted	253	40.7%
None (no MX or null MX)	165	38.2%

(Zoho had only 6 domains, too few to chart.)

The pattern: domains on a major hosted platform or a secure email gateway are spoofable about 17-21% of the time. Domains on other or self-hosted mail are about twice as likely (40.7%). The provider doesn't set your DMARC policy for you, but the big platforms' admin consoles, setup wizards, and bulk-sender documentation all push toward it.

The "no MX" group is easy to overlook. A domain that never receives mail can still be impersonated in outbound mail. Parked and non-mail domains should publish v=spf1 -all and p=reject. It takes two TXT records and costs nothing.

The rest of the stack

No SPF record: 151 domains (15.5%). Another 10 (1.0%) go over SPF's 10-DNS-lookup limit, which makes evaluation return a permanent error.
SPF ending: -all 45.5%, ~all 35.4%, ?all 3.2%.
MTA-STS in enforce mode: just 15 domains (1.5%). TLS-RPT: 51 (5.2%). Encrypting mail in transit with downgrade protection is still rare.
BIMI with a logo: 150 (15.4%), 108 of which reference a mark certificate.
Average posture score: 62.3 / 100 on the audit's composite scale. Grade distribution: A 82, B 332, C 304, D 139, F 117.

Why p=none isn't protection

p=none is monitoring mode. It tells receivers: "If a message claiming to be from me fails SPF and DKIM alignment, deliver it anyway, and send me a report." That's a useful first step, because the reports show you every service that sends mail as your domain. But it's a step, not a destination.

To a phisher, a domain at p=none is effectively the same as a domain with no record. Receivers may still apply their own heuristics, but you've explicitly opted out of telling them to reject forgeries. 165 domains in this list (16.9%) are in that state.

The bulk-sender rules changed the baseline

The big mailbox providers now set a minimum for high-volume senders:

Gmail (Email sender guidelines): since February 1, 2024, anyone sending more than 5,000 messages a day to personal Gmail accounts needs SPF and DKIM, a DMARC record ("your DMARC enforcement policy can be set to none"), and a From: domain aligned with SPF or DKIM. Marketing and subscribed mail must support one-click unsubscribe and show a visible unsubscribe link. Spam rates in Postmaster Tools must stay below 0.30%, and Google recommends staying under 0.10%.
Yahoo (Sender Hub requirements): enforcement began in February 2024 and rolled out gradually. Bulk senders need SPF and DKIM, a valid DMARC policy of "at least p=none" that passes with an aligned From: domain, one-click unsubscribe (RFC 8058 POST recommended) honored within 2 days, and a spam rate below 0.3%. Yahoo doesn't publish a fixed volume threshold.
Microsoft (Outlook.com high-volume sender announcement, April 2025): domains sending more than 5,000 emails a day to Outlook.com, Hotmail.com and Live.com addresses must pass SPF and DKIM and publish DMARC of at least p=none, aligned with SPF or DKIM, from May 5, 2025; non-compliant mail goes to Junk at first, with later rejection (550 5.7.515). Unsubscribe links and list hygiene are listed as recommended practices rather than hard requirements, and no specific spam-rate limit is set.

Note the bar: p=none is enough to comply at all three. These rules got almost everyone to publish DMARC, which may be why only 11.0% of this list has no record at all. They didn't make anyone enforce it. Compliance and protection are two separate milestones.

A step-by-step DMARC rollout

Moving to enforcement is mostly an inventory exercise. Here's a sequence that rarely breaks legitimate mail:

Inventory senders. List everything that sends as your domain: your mail platform, marketing tools, CRM, ticketing, billing, HR systems, and any servers that send alerts.
Fix SPF. One record that includes only the services you actually use, under 10 lookups, ending in ~all for now (-all once you're confident).
Turn on DKIM everywhere. Use 2048-bit keys where you can, signing with your domain (aligned) rather than the vendor's.
Publish p=none with reporting: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.example; fo=1 Send aggregate reports to a mailbox or a DMARC report analyzer.
Watch for 2-4 weeks. Every legitimate source should pass aligned SPF or DKIM. Fix the ones that don't.
Move to p=quarantine, optionally ramping with pct=25, then 50, then 100. Keep reading reports.
Move to p=reject, and set sp=reject unless subdomains need their own policies.
Keep reporting on. New SaaS tools show up all the time, and the reports are how you catch them before they break.
Extras: v=spf1 -all plus p=reject on every non-mail domain, then MTA-STS and TLS-RPT for transport security.

Limitations

DKIM can't be fully enumerated. DNS doesn't let you list selectors. The audit checks a set of common ones, so "DKIM not found" doesn't prove DKIM is missing, and we deliberately left DKIM out of the headline.
A snapshot is not a verdict. This is public DNS as of October 19, 2026. Records change daily, and a domain at p=none may be partway through a planned rollout.
Spoofable ≠ spoofed. We measured policy, not abuse. Receivers also apply their own reputation filtering.
Provider detection is MX-based. A domain can receive mail through one service and send through several others.
The top 1,000 by links isn't the whole internet. Long-tail domains may look different.

DEV Community