email-auth · severity high
DMARC policy
Share of email-active domains whose DMARC policy is absent or monitor-only (p=none).
Measured every Monday · last updated
How it is measured
Tier 0. TXT lookup at _dmarc.<domain>; parse the p= tag. Denominator: has_mx.
Why it matters
The flagship quiet failure. p=none is monitor mode — it publishes a record, generates reports, and instructs receivers to deliver forged mail anyway. It looks like DMARC in every compliance checklist and questionnaire while providing no protection. malformed is the same failure by accident.
Limits of this measurement
A domain may be mid-rollout in none deliberately; we measure the state, not intent.
The base rate
Two independent populations. The global, domain-anchored figure is unbiased; the company-anchored figures are built by matching company names to domains and skew toward more digitally-mature firms. Both are published, so the gap is visible.
By company size band
Company-anchored cuts (national registries with a size proxy), split by size band. Right-hand figure is the share not meeting the control.
Every segment
Pick one to see the citable answer for a company like yours, with its trend and methodology.
Show the remaining 62 segments
From the newsletter
Where this base rate turned up as a real, fixable exposure.
Slices below 100 measured members are withheld rather than shown with a wide interval — an absent country or issuer means too little data, not zero failures. Licensed CC BY 4.0. Machine-readable data per segment: append .json or .csv to its URL.