Email Authentication Adoption Across the Top 1 Million Domains: Month Two Data

How Many Top Domains Use DMARC, MTA-STS, DANE, and BIMI?

Every month, someone measures it. This is month two.

Email authentication standards exist to prove that a message really came from the domain it claims to be from. Without them, anyone can send email that looks like it came from your domain. DMARC, MTA-STS, DANE, and BIMI each solve a different part of that problem. But how many organizations actually use them?

A monthly measurement of the top 1 million domains by email traffic tries to answer that question. The second month of data is now available. Here is what it shows.

What the Numbers Show

DMARC Adoption

Of the top 1 million domains, approximately 21% have a DMARC record published. That means roughly 4 in 5 domains that send meaningful email traffic have taken the first step.

But publishing a DMARC record is not the same as enforcing it. The breakdown by policy is more revealing:

• p=none (monitor only): approximately 15% of measured domains
• p=quarantine (send suspicious mail to spam): approximately 2-3%
• p=reject (hard enforcement, no exceptions): approximately 3-4%

The vast majority of domains that use DMARC are still in monitor mode. They can see who is sending email on their behalf, but they have not told receiving servers to reject mail that fails authentication. The protection that p=reject offers against domain spoofing is only available to a small fraction of domains that have deployed DMARC at all.

Month one to month two showed a small but measurable increase in p=reject adoption, suggesting that the industry is slowly moving toward enforcement.

MTA-STS Adoption

MTA-STS (Mail Transfer Agent Strict Transport Security) is a standard that requires TLS encryption for email in transit between mail servers. It protects against man-in-the-middle attacks where someone intercepts and modifies email as it travels across the internet.

Approximately 3% of the top 1 million domains have an MTA-STS policy published. Of those, only a fraction enforce it in strict mode.

The gap between DMARC adoption (21%) and MTA-STS adoption (3%) is significant. Most domains that care enough about email authentication to deploy DMARC are not yet protecting the transport layer of their email. MTA-STS requires a more involved setup -- you need a valid TLS certificate and a policy file on your mail server -- which likely explains the lower adoption rate.

Month two showed a modest increase in MTA-STS deployment, consistent with growing awareness of email transport security.

DANE Adoption

DANE (DNS-based Authentication of Named Entities) uses TLSA records in DNS to bind a TLS certificate to the domain name, making it cryptographically impossible for an unauthorized server to impersonate your mail server even if they have a valid certificate for a different domain.

Approximately 0.5% of the top 1 million domains have a TLSA record published.

DANE has the lowest adoption rate of the four standards measured. The reason is straightforward: DANE is the most technically demanding to deploy. It requires DNSSEC-signed domains, precise TLSA record configuration, and any misconfiguration immediately breaks email delivery. There is no gradual rollout option.

Despite the low adoption rate, DANE offers the strongest cryptographic guarantee of any email transport security standard. For domains that can deploy it correctly, the protection is near-total against man-in-the-middle attacks.

BIMI Adoption

BIMI (Brand Indicators for Message Identification) displays a brand logo next to authenticated emails in supported email clients. It requires both a DMARC policy at enforcement level and a verified certificate (VMC) from a certificate authority.

Approximately 0.1% of the top 1 million domains have a valid BIMI record with a verified VMC certificate.

The numbers make sense given the requirements. BIMI is the only standard here that requires both strong email authentication (DMARC at p=reject) and an external certificate verification process. The combination of prerequisites keeps most domains out.

Month two showed a slight increase in BIMI adoption as more organizations reach DMARC enforcement and then add logo display on top.

Why These Numbers Matter for Your Domain

Here is the practical takeaway from this data.

The spoofing risk is still enormous. Roughly 80% of domains sending meaningful email have no DMARC protection at all. That means for most domains, an attacker can send email that passes DMARC checks by simply setting the From address correctly. Domain spoofing is not a theoretical problem -- it is the default state for the majority of the internet.

Most domains that use DMARC are not enforcing it. The p=none majority means they can see who is sending mail on their behalf, but they have not actually blocked the attackers. Operators who want real protection need to move to p=reject, and they need to do it carefully using aggregate report data to avoid breaking legitimate email sources. Without reading those reports, you are guessing about which legitimate senders will break when you enforce. With them, you have a precise map.

MTA-STS is underdeployed relative to its value. With only 3% adoption, most email is still transmitted without guaranteed encryption. For domains that handle sensitive communications, deploying MTA-STS closes a real gap. It does not require DNSSEC and it can be deployed incrementally.

DANE is the strongest option but only practical for technically sophisticated teams. The combination of DNSSEC, TLSA records, and the risk of complete mail delivery failure on misconfiguration keeps adoption near zero. If you have the expertise to deploy it correctly, DANE is the best transport security available. If you do not, MTA-STS is a practical alternative.

BIMI is a leading indicator of mature email authentication posture. Domains that meet BIMI requirements have already solved DMARC enforcement, certificate management, and DNS security. The low adoption rate reflects the genuine difficulty of reaching that state, not lack of interest.

How to Check Your Own Email Authentication Posture

The measurement data tells you where the industry stands. What about your own domains?

This is where reading your own DMARC aggregate reports becomes essential. The measurement above works by scanning DNS records across millions of domains. Your reports give you the same kind of visibility -- but specific to your domain, showing exactly which mail servers are sending on your behalf and which sources pass or fail DMARC checks.

Without these reports, you are guessing about your authentication posture. With them, you can make informed decisions about moving to enforcement without breaking legitimate email.

DMARCFlow processes your aggregate reports and turns them into a dashboard. You see which sources are sending on your domain, which are failing authentication, and when new sources appear that might indicate spoofing. You get the same analytical view the measurement used -- but for your specific domain. If you want a quick check of your current DMARC, MTA-STS, and BIMI status, DMARCFlow offers a free domain check that shows your current configuration in under a minute.

Key Takeaways

• Roughly 21% of the top 1 million domains have DMARC deployed, but only about 3-4% enforce p=reject. The industry is still mostly in monitor mode.
• MTA-STS adoption sits at approximately 3%, leaving most email transport without guaranteed encryption.
• DANE remains below 1% due to its DNSSEC and configuration requirements. It is the strongest option but the hardest to deploy.
• BIMI is below 0.1% because it requires both DMARC enforcement and a verified certificate.
• Month-over-month, all four standards show small upward trends -- email authentication adoption is growing slowly.
• The most actionable step for any domain today is to read your DMARC aggregate reports and move toward p=reject enforcement based on what you learn. DMARCFlow makes that process systematic rather than guesswork.

FAQ

What percentage of domains use DMARC?

Approximately 21% of the top 1 million domains have a DMARC record published, based on month two of ongoing measurement. However, only about 3-4% of all measured domains have reached p=reject enforcement, which is the only level that actively blocks spoofed email.

What is MTA-STS and why does it matter?

MTA-STS (Mail Transfer Agent Strict Transport Security) is a standard that requires TLS encryption for email transmitted between mail servers. Unlike DMARC, which authenticates the sender's domain, MTA-STS protects email in transit against interception or modification. It matters because unencrypted email can be read or altered by anyone positioned between the sending and receiving servers.

How does DANE differ from MTA-STS?

Both DANE and MTA-STS protect email transport encryption, but in different ways. MTA-STS allows any valid certificate from a trusted certificate authority. DANE uses DNSSEC to publish a hash of your specific TLS certificate in DNS, making it cryptographically tied to your domain. DANE is stronger but requires DNSSEC and is harder to configure correctly.

How do I check my domain's email authentication setup?

You need to publish a DMARC record for your domain and review the aggregate reports you receive. DMARCFlow automates this process and shows you a dashboard of your authentication status, including MTA-STS and BIMI if you have those deployed. Running a free DMARC check on your domain takes under a minute.