Email Authentication Adoption 2026: DMARC MTA-STS

The State of Email Authentication in 2026

The most interesting thing about email security in 2026 is not that DMARC adoption is climbing. It is that the two protocols which actually protect how mail travels between servers are more than a decade behind.

New monthly measurements across the top million domains show DMARC valid record coverage growing by 2,282 domains this month alone, with domains tightening their policy outnumbering those loosening it by nearly 4 to 1. At the current pace, DMARC reaches near-universal coverage by the early 2030s. MTA-STS and DANE, which encrypt the transport connection, are on pace to take until the 2040s.

That gap matters for practitioners making decisions about email security right now.

The data comes from a monthly measurement study run across the top 1 million domains, using two independent resolvers in different regions to confirm each result. Only domains present in both the current and prior month are compared, which removes the noise from the 25% monthly churn in domain popularity rankings. You can read the full methodology at laneful.com.

How Many Domains Use DMARC in 2026

DMARC valid records increased by 2,282 domains this month, and the direction of change is telling: 2,488 domains tightened their DMARC policy while only 567 loosened it. That is a roughly 4-to-1 ratio of enforcement growth to rollback.

This matters because the major email receivers - Google and Microsoft - have been applying increasing pressure on senders to adopt DMARC at enforcement levels. As that pressure continues, the number of domains sitting at p=none (monitoring only) will continue to shrink.

For organizations managing multiple domains, this trend has a direct operational consequence. As DMARC enforcement tightens across the ecosystem, third-party senders who have not configured authentication correctly will increasingly be the source of legitimate email failures. A single misconfigured marketing platform or productivity tool sending on your behalf can generate hundreds of aggregate report failures. Without centralized monitoring across all your domains, you will not see those failures until users report that transactional emails are not arriving.

DANE Adoption: How One Provider Moved 500 Domains Overnight

DANE, which binds TLS certificates to DNS records for SMTP, is the protocol that depends most heavily on provider defaults.

This month DANE showed a net decline of 249 domains. But the explanation reveals how email security works at scale. One provider, Migadu, removed the TLSA records for its entire customer fleet sometime in June. Around 500 domains that had DANE in June did not have it in July, and almost none of those domain owners made that decision consciously.

Remove Migadu from the numbers and DANE actually grew by 258 domains.

The growth story is equally provider-driven in reverse. Of the 488 domains that gained DANE this month, 466 got it simply by migrating to Cloudflare Email Routing, which publishes DANE by default for its customers. About 60 of those domains were low-effort setups that clearly never gave email security a deliberate thought. They picked up DANE the moment their DNS pointed at a different host.

This is the central structural fact about email security adoption in 2026: for most domains, security posture is inherited from the provider, not chosen by the operator.

For organizations that rely on third-party email service providers, this provider-dependency dynamic creates a specific monitoring challenge. When your ESP changes its authentication infrastructure - whether that is adding DANE support, rotating DKIM keys, or migrating to a new sending platform - your DMARC alignment can break without any action on your part. Aggregate reports are the only way to see those changes in real time rather than discovering them when a mail flow failure reaches your users.

MTA-STS: Growing, But on a Very Slow Track

MTA-STS, which allows domains to require TLS encryption for incoming mail server connections, gained 163 valid policies this month. Of those, 76 domains moved from testing mode to full enforce, while 10 domains went the other direction.

On its face, those are small numbers relative to the top million domains measured. The more important observation is the trajectory.

At current growth rates, MTA-STS reaches universal adoption sometime in the 2040s. That is roughly 15 years behind DMARC.

The reason is structural. There is no major email receiver forcing MTA-STS adoption the way Google and Yahoo forced DMARC p=reject for large senders in 2024. Until a major receiver makes MTA-STS a requirement for mail delivery, adoption will remain slow and voluntary.

For security teams, the practical question is not just whether your own domains have MTA-STS enabled. It is whether the third-party services sending mail on your behalf are enforcing TLS. If your vendor's mail infrastructure still accepts plaintext connections, your sensitive communications can be intercepted in transit - regardless of your own domain's MTA-STS policy.

Monitoring MTA-STS policy status across all your domains and their associated sending services is not yet a standard practice. It will need to become one as transport security becomes a greater focus.

BIMI: Growing but Still a Small Fraction

BIMI, which allows domains to display their logo next to authenticated emails in supporting mail clients, added 346 domains this month.

BIMI has two hard requirements: DMARC at enforcement level, and a certified logo loaded into a VMC (Verified Mark Certificate). The additional complexity means BIMI adoption will continue to be a fraction of DMARC adoption, and its growth is largely proportional to the underlying DMARC growth.

For organizations considering BIMI deployment, the prerequisite work is the same as for any DMARC enforcement program: get to p=quarantine first, then p=reject, and ensure your aggregate reports show consistent passing alignment across all authorized senders. DMARCFlow can help you track that passing rate across all your domains before you invest in a VMC.

Why the Gap Between Sender Authentication and Transport Security Matters

Here is the practical implication.

Sender authentication (DMARC) tells you that the domain in the From header is the domain that actually sent the email. Transport security (MTA-STS, DANE) tells you that the connection between mail servers was encrypted and that the receiving server can verify the sending server's certificate.

Both are needed for a complete email security posture. DMARC alone does not prevent a sophisticated attacker who has compromised a legitimate sending server from using it to relay mail through an encrypted connection. MTA-STS and DANE alone do not prevent sender spoofing.

The measurement data shows that while organizations have largely moved to authenticate their sending domains, the infrastructure that protects email in transit is lagging by over a decade.

For practitioners assessing their organization's email security posture, this means checking DMARC compliance reports is necessary but not sufficient. MTA-STS policy status across domains and third-party senders deserves the same attention. And for teams managing dozens or hundreds of domains, that visibility requires centralized monitoring - not a manual review of individual domain reports.

What This Means for Multi-Domain Email Security Programs

Organizations managing multiple domains face a compounding version of the adoption gap problem. Even if your own domains have reached DMARC enforcement, the third-party services you send mail through may not have. And unlike your own infrastructure, you cannot directly control when a vendor enables MTA-STS or DANE for their mail infrastructure.

This is where aggregate report monitoring becomes critical. DMARC reports show you which third parties are sending mail on your behalf and whether their authentication is passing or failing. As DMARC enforcement becomes more common, third parties who have not configured authentication correctly will increasingly be the source of delivery failures.

Organizations that monitor aggregate reports across all their domains can catch authentication regressions from third-party senders before they cause production email failures. Whether it is a new SaaS tool your marketing team added that sends mail with mismatched DKIM, or a vendor whose mail infrastructure quietly changed its TLS configuration, those changes show up in aggregate reports before they show up as user complaints.

DMARCFlow is built for exactly this use case: multi-domain visibility into DMARC policy status, aggregate report analysis, and alerting when third-party senders break authentication for your domains.

FAQ: Email Authentication Adoption Rates in 2026

What percentage of domains use DMARC?
Based on month-over-month measurements across the top million domains, valid DMARC record coverage is growing at roughly 2,000 to 3,000 domains per month. At that pace, DMARC approaches near-universal coverage by the early 2030s. The majority of Fortune 500 domains already have DMARC deployed, but small business and startup coverage lags significantly.

What is the difference between DMARC and MTA-STS?
DMARC authenticates the sender domain (who sent the email). MTA-STS secures the connection between mail servers (how the email traveled). Both are needed for a complete email security posture. DMARC has much higher adoption because major receivers forced it; MTA-STS has no equivalent mandate.

Why is DANE adoption so low?
DANE requires both a TLSA DNS record and DNSSEC, which many domain owners find complex to configure. More importantly, DANE adoption is largely determined by mail host defaults. One provider changing its settings can move hundreds of domains in or out of DANE coverage overnight, as happened with Migadu and Cloudflare Email Routing.

Does BIMI require a VMC?
Yes. BIMI requires a Verified Mark Certificate (VMC), which is a type of SSL/TLS certificate specifically for logos. Obtaining a VMC costs money and requires trademark registration, which is why BIMI adoption remains a small fraction of DMARC adoption even though both have been available for years.

How often is this data updated?
The underlying research is published monthly by laneful.com, measuring the top 1 million domains for DMARC, MTA-STS, DANE, and BIMI adoption. Month-over-month comparisons are only valid for domains present in both months to avoid churn artifacts.

Summary

The headline finding from the latest email authentication adoption data is structural, not numerical. Email security adoption at scale happens in provider-sized blocks, not one domain at a time. The forcing functions that drive adoption are mandates from major receivers, not organic adoption by domain operators.

DMARC is on a clear path to near-universal coverage by the early 2030s because Google and Microsoft made it a requirement for large senders. MTA-STS and DANE have no equivalent forcing function and are tracking toward universal coverage in the 2040s.

For practitioners managing email security across multiple domains, the practical implication is that monitoring DMARC aggregate reports across your entire domain portfolio is no longer optional. It is the baseline visibility you need to catch third-party senders and vendors whose authentication misconfigurations will increasingly cause delivery failures as enforcement tightens across the ecosystem.