stackscan/email-authentication

DMARC and SPF Adoption Among Large Organizations

Overview

This dataset records which of 36,120 large organizations publish SPF and DMARC records on their primary domain, with firmographic context for each: industry, employee band, country, locality and founding year.

SPF lists the servers allowed to send mail for a domain. DMARC tells receiving servers what to do with mail that fails that check, and where to send reports. A domain with SPF but no DMARC has published the list without publishing an instruction, so receivers are left to decide for themselves.

Collected in August 2026. DNS records change, so treat the data as a snapshot of that month rather than a current state.

SPF and DMARC Coverage

Of the 35,563 large organizations that publish SPF, 45.7% also publish DMARC. The other 19,315 publish SPF alone.

SPF is close to universal among organizations that send mail, so the SPF group serves as a denominator and the percentage above is a rate rather than a raw count.

Adoption by Country and Industry

DMARC adoption among SPF publishers, by country. Groups with fewer than 150 organizations are omitted.

By industry, same threshold:

Employee band makes little difference. Organizations with 5,001 to 10,000 employees reach 46.7%, and those with more than 10,000 reach 44.9%.

BIMI and MTA-STS are rare in this population. Across all 36,120 organizations, 17 publish BIMI and 5 publish MTA-STS.

Dataset Fields

Email-Authentication.csv, 36,120 rows, 14 columns. Coverage is the share of rows where the field is populated.

Methodology

Domains were checked for published SPF, DMARC, BIMI and MTA-STS records in August 2026. An organization is included when at least one of SPF or DMARC was found on its primary domain.

The population is large organizations, meaning 5,001 or more employees, for which company information could be resolved.

Important Notes

• —DMARC means a DMARC record was found. It does not mean the policy is enforced. A policy of p=none requests monitoring only and is common, and the policy value is not recorded here, so DMARC = yes should not be read as protection.
• —DKIM is not included. Detecting a DKIM record requires knowing the DNS selector in advance, so any count would understate adoption by orders of magnitude.
• —The 557 organizations with DMARC but no SPF are unusual and often misconfigured. DMARC relies on SPF or DKIM alignment, so a DMARC record with neither does little.
• —Records are read from the primary domain only. Large organizations send from many domains and subdomains, and those are not covered.
• —Rates are calculated against organizations publishing SPF, not against all large organizations.
• —Results represent observations made in August 2026.

Use Cases

• —Email security and anti-phishing research
• —Benchmarking an organization or sector against its peers
• —Public sector and regulatory policy analysis
• —Journalism on email security preparedness
• —Technographic and market research
• —Data science and machine learning

Citation

If you use this dataset, please credit StackScan and link to the source page.

Plain text:

StackScan. (2026). DMARC and SPF Adoption Among Large Organizations (data collected August 2026) [Data set]. StackScan. https://www.stackscan.com/technology/dmarc

BibTeX:

@misc{stackscan_email_authentication_2026,
  author       = {{StackScan}},
  title        = {DMARC and SPF Adoption Among Large Organizations},
  year         = {2026},
  month        = {aug},
  publisher    = {StackScan},
  howpublished = {\url{https://www.stackscan.com/technology/dmarc}},
  note         = {Data collected August 2026. Dataset: \url{https://huggingface.co/datasets/stackscan/email-authentication}}
}

Related

stackscan/lets-encrypt uses the same population definition and collection period, so the two can be joined on Domain.

Access to More Data

The files in this repository are CC BY 4.0 and free for anyone to use, including commercially. No request or permission is needed.

StackScan also provides free access to larger and custom datasets for data journalists, academic researchers, non-profits and other organizations working on non-commercial projects. Ask through stackscan.com.

License

Released under Creative Commons Attribution 4.0 International (CC BY 4.0). You are free to share and adapt the data, including commercially, provided you give appropriate credit.

Attribution must name StackScan and link to the source page:

Data from StackScan, licensed under CC BY 4.0.

For academic or published work, use the citation above.