The headline from EasyDMARC’s 2026 DMARC Adoption Report sounds like progress, and it is: 937,931 of the world’s top 1.8 million domains now publish a valid DMARC record, 52.1% of the total, up from 47.7% last year and just 27.2% in 2023. Adoption has grown 79% in three years. For a protocol that spent a decade being politely ignored, crossing the halfway mark is a genuine milestone.
Now the number that should bother you: 525,996 of those domains, more than half of everyone who adopted, are parked at p=none. Monitoring mode. The setting that watches spoofing happen and files a report about it. As protection against domain impersonation, p=none does precisely nothing, which is by design: it was meant to be the temporary first step while you identified your legitimate senders, not the destination. The 2026 data says it has become the destination.
EasyDMARC analysed the top 1.8 million domains by traffic across three snapshots (2023, 2025, early 2026), classifying each policy and checking for aggregate reporting. The enforcement numbers tell the real story. Domains at p=quarantine or p=reject: 411,935. Domains combining enforcement with RUA reporting, the configuration that both blocks spoofed mail and tells you what’s happening: roughly 9% of the analysed total. The stricter benchmark of p=reject plus reporting: 159,691 domains, out of 1.8 million. Call it one in eleven of the domains that bothered, and a rounding error of the internet.
Why the parking lot exists
It’s worth being honest about what drove the adoption surge, because it explains the enforcement gap. The growth since 2023 maps directly onto Google’s and Yahoo’s bulk sender requirements, which demanded DMARC at, note carefully, p=none minimum. Compliance asked for a record; the industry published a record. Hundreds of thousands of organisations did exactly what was required of them and not one step more. The surge is compliance-shaped, and compliance was shaped like monitoring mode.
The split between large and fast-growing companies makes the underlying cause visible. Among the Fortune 500, 95% have valid DMARC and more than 80% enforce; reporting is nearly universal at 97.9%. Among the Inc. 5000, adoption is a healthy 76.2%, but only 15.2% reach p=reject and more than half sit at p=none. The difference isn’t awareness. It’s operational courage: moving to enforcement means inventorying every platform that sends mail in your name, and fast-growing companies with sprawling third-party stacks are precisely the ones afraid of what enforcement might break. So they monitor, indefinitely, while remaining exactly as spoofable as the day they started. EasyDMARC CEO Gerasim Hovhannisyan’s framing in the report is the right one: adoption driven by compliance and deliverability requirements has arrived, but adoption alone doesn’t protect anyone, and the industry now needs a coordinated push from records to enforcement.
The half-built fence
Regular readers will recognise where this sits in the year’s authentication story. DMARCbis was published this spring, modernising the standard itself; we covered it then (“DMARCbis Is Here. It’s Just DMARC Now”). GMX, WEB.DE and mail.com moved their own domains to p=reject, mailbox providers practising what they preach. Gmail’s new Postmaster verdicts, which we covered this week, treat sender requirements as a pass/fail judgment, with technical compliance as the entry ticket rather than the achievement. Every piece of the ecosystem is moving toward the same conclusion: authentication that doesn’t enforce is paperwork.
And the threat side isn’t waiting. The phishing campaigns we’ve reported this quarter, from device-code kits to hijacked SES accounts, share a defining feature: they pass authentication, because they ride legitimate infrastructure. Against that class of attack, DMARC enforcement is necessary but not sufficient. Against the older, larger, dumber class, the plain spoof of your exact domain, enforcement is the fix, it’s available today, and half a million organisations have specifically chosen to log the attacks instead of stopping them.
What to actually do
If your domain is one of the 525,996: the path from p=none to enforcement is no longer guesswork. You have RUA reports (553,000+ domains now collect them, so the visibility habit has clearly landed); the work is reading them, authorising your legitimate senders, and ratcheting policy as confidence grows. The report’s own guidance is the standard staged route: monitor, fix alignment, quarantine, reject. The organisations that did it didn’t have simpler email estates than yours. They had a deadline, usually self-imposed.
And if you’re advising clients: the Fortune 500 numbers are now the benchmark to put in front of any board that asks whether enforcement is realistic. Ninety-five percent adoption, eighty percent enforcement. The biggest, most complex email estates on the planet got there. The parking lot is a choice.
The full report, including Fortune 500 and Inc. 5000 breakdowns, is available from EasyDMARC.
Source: EasyDMARC 2026 DMARC Adoption & Enforcement Report, analysing the top 1.8 million domains by traffic with comparative snapshots from 2023, 2025 and 2026.
Disclosure: EasyDMARC is an Enterprise Member of Emailexpert. Coverage decisions are made independently of commercial relationships.
