Skip to content
emailrules.today

The Index · measured daily from public DNS

96% of the best-known senders enforce DMARC.

Read from public DNS on 28 Sep 2026 across 98 domains in seven sectors. Every percentage on this page carries the number it was calculated from, the roster is published in full, and each domain’s own reading is printed below so the aggregate can be checked rather than believed.

At quarantine or reject

96%

94 of 98

Still at p=none

2%

2 of 98 publish a policy that enforces nothing

No DMARC at all

2%

2 of 98

Collecting rua reports

97%

95 of 98 would find out if something broke

Enforcement over time

Share of the roster at quarantine or reject, one point per day measured. Nobody can backfill this — it starts the day it starts.

0%25%50%75%100%4 Aug 2026 — 94%5 Aug 2026 — 94%6 Aug 2026 — 94%7 Aug 2026 — 94%8 Aug 2026 — 94%9 Aug 2026 — 94%10 Aug 2026 — 94%11 Aug 2026 — 94%12 Aug 2026 — 94%13 Aug 2026 — 94%14 Aug 2026 — 94%15 Aug 2026 — 94%16 Aug 2026 — 94%17 Aug 2026 — 94%18 Aug 2026 — 94%19 Aug 2026 — 94%20 Aug 2026 — 94%21 Aug 2026 — 94%22 Aug 2026 — 94%23 Aug 2026 — 94%24 Aug 2026 — 94%25 Aug 2026 — 94%26 Aug 2026 — 94%27 Aug 2026 — 94%28 Aug 2026 — 94%29 Aug 2026 — 94%30 Aug 2026 — 94%31 Aug 2026 — 94%1 Sep 2026 — 94%2 Sep 2026 — 94%3 Sep 2026 — 94%4 Sep 2026 — 94%5 Sep 2026 — 94%6 Sep 2026 — 94%7 Sep 2026 — 94%8 Sep 2026 — 94%9 Sep 2026 — 94%10 Sep 2026 — 94%11 Sep 2026 — 94%12 Sep 2026 — 94%13 Sep 2026 — 94%14 Sep 2026 — 94%15 Sep 2026 — 94%16 Sep 2026 — 94%17 Sep 2026 — 94%18 Sep 2026 — 95%19 Sep 2026 — 96%20 Sep 2026 — 96%21 Sep 2026 — 96%22 Sep 2026 — 96%23 Sep 2026 — 96%24 Sep 2026 — 96%25 Sep 2026 — 96%26 Sep 2026 — 96%27 Sep 2026 — 96%28 Sep 2026 — 96%
4 Aug 202656 daily readings · no smoothing, no interpolation28 Sep 2026

What moved since 27 Sep 2026

  • 1password.comDKIM keys40
  • adidas.comDKIM keys50
  • airbnb.comDKIM keys02
  • atlassian.comDKIM keys40
  • bombas.comDKIM keys20
  • brooklinen.comDKIM keys01
  • costco.comDKIM keys40
  • deliveroo.co.ukDKIM keys30
  • delta.comDKIM keys40
  • doordash.comDKIM keys60
  • glossier.comDKIM keys06
  • hilton.comDKIM keys04
  • hm.comDKIM keys40
  • hubspot.comDKIM keys41
  • ikea.comDKIM keys20
  • klarna.comDKIM keys30
  • marriott.comDKIM keys50
  • medium.comDKIM keys40
  • n26.comDKIM keys40
  • nike.comDKIM keys30
  • oatly.comDKIM keys45
  • uniqlo.comDKIM keys07
  • united.comDKIM keys20
  • vercel.comDKIM keys04
  • vox.comDKIM keys40

By sector

SectornEnforcingp=noneNo DMARCrua
Ecommerce & DTCDirect-to-consumer brands, the heaviest lifecycle senders in the index.1883%11%6%94%
FinanceThe category with the strongest regulatory pressure on authentication.12100%0%0%100%
MarketplacesPlatforms sending on behalf of third parties, the hardest alignment problem.1292%0%8%92%
Media & publishingNewsletter-first businesses, where the list is the product.12100%0%0%100%
RetailLarge multi-channel retailers with long-lived legacy sending estates.14100%0%0%100%
SoftwareProduct and transactional senders, usually the most technically staffed.18100%0%0%94%
Travel & hospitalityHigh transactional volume, and the most phished category in the index.12100%0%0%100%

What this does not claim

An unreadable SPF is not a failure. 31 of 98 publish a macro record or delegate their sender list to a hosted manager. Those cannot be expanded by reading DNS — not by us, not by anyone — so they are excluded from every statistic about who authorises whom rather than counted as broken. This site shipped that mistake once, publicly, against three named brands.

We do not publish a “misconfigured” rate, and here is why. 20 of the 67 readable domains publish DKIM keys for a platform their SPF does not name. That is a real count, and it is not a fault rate. SPF is evaluated against the envelope domain, and every major platform sends with its own bounce domain by default — so on those messages the sender’s SPF is never consulted and DMARC passes on DKIM alignment alone, exactly as intended. Stripe, Shopify and Figma all look like this. A benchmark that counted them as broken would be wrong about the best-run senders in the index, so this one does not.

DNS is not deliverability. A domain at p=reject with perfect records can still be sending mail nobody asked for. This measures what a sender has published, which is the floor, not the ceiling.

No sender is ranked. There is no leaderboard and no score. The roster was fixed before the first reading and does not change because a number moves.

Every domain, as measured

The aggregate above is calculated from exactly these rows. Check our arithmetic.

DomainDMARCSPFDKIMNotes
aesop.comp=reject-all0
allbirds.comp=quarantine~all0SPF not readable from DNS
away.comabsent~all1
bombas.comp=reject~all0
brooklinen.comp=quarantine~all1
casper.comp=reject~all5signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
chubbies.comp=none~all3
everlane.comp=reject~all4
glossier.comp=reject~all6SPF not readable from DNS
gymshark.comp=reject~all5SPF not readable from DNS
harrys.comp=quarantine~all5signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
lush.comp=quarantine-all3
oatly.comp=reject-all5
patagonia.comp=none~all6signs with 2 platforms its SPF does not name — normal if that platform sends with its own return path
peloton.comp=quarantine-all4
represent.comp=quarantineabsent0
ruggable.comp=quarantineno all4
warbyparker.comp=reject~all0
americanexpress.comp=reject-all0
barclays.co.ukp=reject-all0SPF not readable from DNS
chase.comp=reject-all0SPF not readable from DNS
coinbase.comp=reject-all2
hsbc.co.ukp=reject~all0SPF not readable from DNS
klarna.comp=reject-all0SPF not readable from DNS
monzo.comp=reject-all3signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
n26.comp=reject~all0
paypal.comp=reject~all2
revolut.comp=quarantine~all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
vanguard.comp=reject~all0SPF not readable from DNS
wise.comp=reject~all5signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
amazon.comp=quarantine-all0
asos.comp=reject-all3
deliveroo.co.ukp=reject~all0
depop.comp=reject~all4
doordash.comp=reject~all0SPF not readable from DNS
ebay.comp=reject~all6
etsy.comp=reject-all4
justeat.co.ukabsentabsent0
uber.comp=quarantine~all0SPF not readable from DNS
vinted.comp=quarantine-all0
wayfair.comp=quarantine-all6signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
zalando.comp=reject-all1
bbc.co.ukp=reject~all0
bloomberg.comp=reject-all0
economist.comp=quarantine~all5signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
ft.comp=reject-all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
medium.comp=reject~all0
npr.orgp=reject-all5SPF not readable from DNS
nytimes.comp=reject~all5SPF not readable from DNS
substack.comp=reject~all1
theatlantic.comp=reject-all0
theguardian.comp=reject-all0
vox.comp=reject~all0
wired.comp=reject~all5signs with 2 platforms its SPF does not name — normal if that platform sends with its own return path
adidas.comp=reject-all0
costco.comp=reject-all0SPF not readable from DNS
decathlon.comp=reject-all9SPF not readable from DNS
hm.comp=reject~all0SPF not readable from DNS
ikea.comp=reject-all0
johnlewis.comp=quarantine-all0SPF not readable from DNS
lego.comp=reject-all5signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
marksandspencer.comp=reject-all2SPF not readable from DNS
nike.comp=reject~all0SPF not readable from DNS
sephora.comp=reject-all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
target.comp=reject~all6SPF not readable from DNS
uniqlo.comp=reject~all7signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
walmart.comp=reject~all0SPF not readable from DNS
zara.comp=reject-all0SPF not readable from DNS
1password.comp=quarantine~all0
asana.comp=quarantine-all1SPF not readable from DNS
atlassian.comp=reject~all0SPF not readable from DNS
canva.comp=reject-all6signs with 2 platforms its SPF does not name — normal if that platform sends with its own return path
cloudflare.comp=reject-all3
dropbox.comp=reject~all0SPF not readable from DNS
figma.comp=quarantine-all5signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
github.comp=quarantine~all6
hubspot.comp=rejectno all1
klaviyo.comp=reject~all4
linear.appp=reject~all1
mailchimp.comp=reject~all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
notion.sop=quarantine~all0
shopify.comp=reject~all5signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
slack.comp=reject-all0
stripe.comp=reject~all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
vercel.comp=quarantine~all4
zoom.usp=reject~all5SPF not readable from DNS
airbnb.comp=reject-all2
booking.comp=reject-all3SPF not readable from DNS
britishairways.comp=reject~all0SPF not readable from DNS
delta.comp=reject-all0SPF not readable from DNS
easyjet.comp=reject~all4SPF not readable from DNS
expedia.comp=reject-all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
hilton.comp=quarantine-all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
lufthansa.comp=reject-all0
marriott.comp=reject-all0
ryanair.comp=reject~all0SPF not readable from DNS
trainline.comp=reject-all0
united.comp=reject~all0SPF not readable from DNS

The whole index as JSON →The blocklist censusHow we measureTell us we are wrong