Skip to content
emailrules.today

The Index · measured daily from public DNS

94% of the best-known senders enforce DMARC.

Read from public DNS on 4 Aug 2026 across 98 domains in seven sectors. Every percentage on this page carries the number it was calculated from, the roster is published in full, and each domain’s own reading is printed below so the aggregate can be checked rather than believed.

At quarantine or reject

94%

92 of 98

Still at p=none

4%

4 of 98 publish a policy that enforces nothing

No DMARC at all

2%

2 of 98

Collecting rua reports

97%

95 of 98 would find out if something broke

One reading so far. The series begins once there are two — this page will not draw a trend through a single point.

By sector

SectornEnforcingp=noneNo DMARCrua
Ecommerce & DTCDirect-to-consumer brands, the heaviest lifecycle senders in the index.1872%22%6%94%
FinanceThe category with the strongest regulatory pressure on authentication.12100%0%0%100%
MarketplacesPlatforms sending on behalf of third parties, the hardest alignment problem.1292%0%8%92%
Media & publishingNewsletter-first businesses, where the list is the product.12100%0%0%100%
RetailLarge multi-channel retailers with long-lived legacy sending estates.14100%0%0%100%
SoftwareProduct and transactional senders, usually the most technically staffed.18100%0%0%94%
Travel & hospitalityHigh transactional volume, and the most phished category in the index.12100%0%0%100%

What this does not claim

An unreadable SPF is not a failure. 31 of 98 publish a macro record or delegate their sender list to a hosted manager. Those cannot be expanded by reading DNS — not by us, not by anyone — so they are excluded from every statistic about who authorises whom rather than counted as broken. This site shipped that mistake once, publicly, against three named brands.

We do not publish a “misconfigured” rate, and here is why. 26 of the 67 readable domains publish DKIM keys for a platform their SPF does not name. That is a real count, and it is not a fault rate. SPF is evaluated against the envelope domain, and every major platform sends with its own bounce domain by default — so on those messages the sender’s SPF is never consulted and DMARC passes on DKIM alignment alone, exactly as intended. Stripe, Shopify and Figma all look like this. A benchmark that counted them as broken would be wrong about the best-run senders in the index, so this one does not.

DNS is not deliverability. A domain at p=reject with perfect records can still be sending mail nobody asked for. This measures what a sender has published, which is the floor, not the ceiling.

No sender is ranked. There is no leaderboard and no score. The roster was fixed before the first reading and does not change because a number moves.

Every domain, as measured

The aggregate above is calculated from exactly these rows. Check our arithmetic.

DomainDMARCSPFDKIMNotes
aesop.comp=reject-all2
allbirds.comp=quarantine~all7SPF not readable from DNS
away.comabsent~all1
bombas.comp=reject~all2
brooklinen.comp=quarantine~all1
casper.comp=reject~all5signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
chubbies.comp=none~all3
everlane.comp=reject~all4
glossier.comp=reject~all6SPF not readable from DNS
gymshark.comp=reject~all5SPF not readable from DNS
harrys.comp=quarantine~all5
lush.comp=none~all3
oatly.comp=reject-all5
patagonia.comp=none~all6signs with 2 platforms its SPF does not name — normal if that platform sends with its own return path
peloton.comp=quarantine-all4
represent.comp=quarantineabsent0
ruggable.comp=noneno all4
warbyparker.comp=reject~all3
americanexpress.comp=reject-all0
barclays.co.ukp=reject-all0SPF not readable from DNS
chase.comp=reject-all0SPF not readable from DNS
coinbase.comp=reject-all2
hsbc.co.ukp=reject~all0SPF not readable from DNS
klarna.comp=reject-all3SPF not readable from DNS
monzo.comp=reject-all3signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
n26.comp=reject~all4
paypal.comp=reject~all2
revolut.comp=quarantine~all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
vanguard.comp=reject~all2SPF not readable from DNS
wise.comp=reject~all5signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
amazon.comp=quarantine-all0
asos.comp=reject-all3
deliveroo.co.ukp=reject~all3
depop.comp=reject~all4
doordash.comp=reject~all6SPF not readable from DNS
ebay.comp=reject~all6
etsy.comp=reject-all4
justeat.co.ukabsentabsent0
uber.comp=quarantine~all6SPF not readable from DNS
vinted.comp=quarantine-all3signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
wayfair.comp=quarantine-all6signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
zalando.comp=reject-all1
bbc.co.ukp=reject~all0
bloomberg.comp=reject-all0
economist.comp=quarantine~all5signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
ft.comp=reject-all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
medium.comp=reject~all4
npr.orgp=reject-all5SPF not readable from DNS
nytimes.comp=reject~all5SPF not readable from DNS
substack.comp=reject~all1
theatlantic.comp=reject-all3signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
theguardian.comp=reject-all2
vox.comp=reject~all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
wired.comp=reject~all5signs with 2 platforms its SPF does not name — normal if that platform sends with its own return path
adidas.comp=reject-all5signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
costco.comp=reject-all4SPF not readable from DNS
decathlon.comp=reject-all9SPF not readable from DNS
hm.comp=reject~all4SPF not readable from DNS
ikea.comp=reject-all2
johnlewis.comp=quarantine-all0SPF not readable from DNS
lego.comp=reject-all5signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
marksandspencer.comp=reject-all2SPF not readable from DNS
nike.comp=reject~all3SPF not readable from DNS
sephora.comp=reject-all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
target.comp=reject~all6SPF not readable from DNS
uniqlo.comp=reject~all7signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
walmart.comp=reject~all5SPF not readable from DNS
zara.comp=reject-all0SPF not readable from DNS
1password.comp=quarantine~all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
asana.comp=quarantine-all1SPF not readable from DNS
atlassian.comp=reject~all4SPF not readable from DNS
canva.comp=reject-all6signs with 2 platforms its SPF does not name — normal if that platform sends with its own return path
cloudflare.comp=reject-all3
dropbox.comp=reject~all0SPF not readable from DNS
figma.comp=quarantine-all5signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
github.comp=quarantine~all6
hubspot.comp=rejectno all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
klaviyo.comp=reject~all4
linear.appp=reject~all1
mailchimp.comp=reject~all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
notion.sop=quarantine~all0
shopify.comp=reject~all5signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
slack.comp=reject-all0
stripe.comp=reject~all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
vercel.comp=quarantine~all4
zoom.usp=reject~all5SPF not readable from DNS
airbnb.comp=reject-all2
booking.comp=reject-all3SPF not readable from DNS
britishairways.comp=reject~all1SPF not readable from DNS
delta.comp=reject-all4SPF not readable from DNS
easyjet.comp=reject~all4SPF not readable from DNS
expedia.comp=reject-all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
hilton.comp=quarantine-all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
lufthansa.comp=reject-all0
marriott.comp=reject-all5signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
ryanair.comp=reject~all0SPF not readable from DNS
trainline.comp=reject-all2
united.comp=reject~all2SPF not readable from DNS

The whole index as JSON →The blocklist censusHow we measureTell us we are wrong

FAQ

Awkward questions

Who is this actually for?

People who ship email and are too busy to re-read every PDF: week-one marketers, lifecycle/CRM, deliverability, multi-country ops, DTC brands, agencies — on Klaviyo, Mailchimp, Braze, HubSpot, SFMC, or something else. Pick your tool and geos so product-specific pages only appear when they match. EU and UK are first-class filters. Not for people who sell tools about email and need a fake score to demo.

Why only ~40 rules? Isn’t that… thin?

On purpose. A wall of 400 undated “best practices” is how you look busy and still get burned. Every page needs a primary source we actually read. Thin and checkable beats fat and folklore. Europe, bulk inbox rules, measurement honesty, and protocol topics like BIMI/DMARC policy are on the shelf when we can cite them — not every Member State and not every vendor myth. Coverage map lists what we still refuse to invent.

Is this legal advice?

No. If it were, you’d have a billable hour and a longer PDF. This is a dated operator reference written by an email geek. Confirm anything high-stakes with counsel who knows your facts. Same for “will this make me compliant?” — no tool does that. Lawyers and judges do. We say what the sources say and what to do first on Monday.

Why no trust score out of 100?

Because we refuse to invent a number you can’t audit. Fake scores sell seed tests and panic. You get findings, dates, and links. If that feels less exciting than a red dial, good — you’re not the red-dial customer.

Why should I trust you more than my ESP’s blog?

ESPs sell seats. Seed-score vendors sell fear. AI invents citations when nobody watches. We sell nothing today — no pixels, no placement scores, no affiliate — so we can say when a tool is the problem. A human verifies, dates, and corrects in public. Tools may help draft; they do not ship unsourced claims. Check the primary links. Fail that test and leave.

Do I need an account?

No. Filters live in this browser and the URL. Share the link. That’s it. Accounts come later only if they earn it — not so we can nurture you about email.

I’m an agency. Where’s multi-client mode?

We tried a client-name CRM on the setup card. It made the product feel like work before it felt useful. Role filters + copy link + one-page brief (optional PDF title) is enough for now. Complexity comes back when the free shelf is habit, not before.

Is the quiet changelog a bug?

No. Quiet means nothing material moved. We don’t invent urgency so the homepage looks “alive.” Sticky risks still show what usually needs a person when the market is still.