email-auth · severity medium
DMARC reporting
Share of DMARC-protected domains that receive no aggregate reports — none requested, or an external destination that never authorised them.
Measured every Monday · last updated
How it is measured
Tier 0. Read the rua= tag from the _dmarc TXT record already fetched for dmarc-policy. Where a destination mailbox sits on another domain, RFC 9990 requires that domain to publish <policy-domain>._report._dmarc.<destination> (or a * wildcard at the same name) before a conforming receiver will send anything. Denominator: domains that have a DMARC record — a domain with no policy has nothing to report on and is excluded rather than counted as receiving nothing.
Why it matters
The reporting half of the p=none story, and the same shape: the record is valid, the checker is green, a reporting address is configured, and not one report has ever arrived. Without the feedback loop nobody ever learns which mail is failing, so the rollout from none to reject — the thing the policy exists to reach — never starts. unauthorised is the quieter of the two: the owner did everything visible correctly and the consent record is on a domain they may not control.
Limits of this measurement
Aggregate (rua) only; ruf uses the same consent mechanism but is rarely honoured and is not counted. Reporting is orthogonal to policy strength — a domain can enforce reject and still be blind, or sit at p=none and receive reports perfectly — so this is not a second reading of dmarc-policy. A destination that authorises the domain but silently drops the mail is indistinguishable from one that delivers it; consent is observable from outside, delivery is not.
The base rate
Two independent populations. The global, domain-anchored figure is unbiased; the company-anchored figures are built by matching company names to domains and skew toward more digitally-mature firms. Both are published, so the gap is visible.
By company size band
Company-anchored cuts (national registries with a size proxy), split by size band. Right-hand figure is the share not meeting the control.
Every segment
Pick one to see the citable answer for a company like yours, with its trend and methodology.
Show the remaining 36 segments
Slices below 100 measured members are withheld rather than shown with a wide interval — an absent country or issuer means too little data, not zero failures. Licensed CC BY 4.0. Machine-readable data per segment: append .json or .csv to its URL.