Do the Top Domains Actually Protect Their Email? SPF, DMARC and MTA-STS, Measured

SPF, DMARC and MTA-STS are the DNS records that stop someone spoofing mail from your domain. Everyone says to set them - so I queried live DNS for 152 of the most-used domains to see who actually has. The short version: the basics are solved at the top of the web, most domains enforce rather than just monitor, and one newer standard is still almost entirely missing. The funnel Of the 152 domains, 146 actually receive mail (they publish an MX record). Among those: | Signal | Adoption | |---|---| | SPF | 100% | | DMARC published | 99.3% | | DMARC enforced (quarantine/reject) | 92% (of all 152) | | MTA-STS | 9.2% | The first three are effectively universal. The last one falls off a cliff. Publishing DMARC isn't the story - enforcing it is A DMARC record can be decorative. The p= policy decides what a receiver does with mail that fails authentication: - p=none - monitor only; deliver the failing (possibly spoofed) mail anyway. Almost no protection. - p=quarantine - treat it as suspicious (spam folder). - p=reject - drop it outright. The strongest anti-spoofing stance. So the real question isn't "do they publish DMARC" but "do they enforce it." At the top, they do: 114 of 152 are on p=reject - the strictest setting - 26 on p=quarantine, and only 10 sit at monitor-only p=none. That's 75% on the strictest policy, and 93% of everyone who publishes DMARC is actually enforcing it. The common half-measure - publish a record, leave it on p=none forever - is rare among the biggest domains. The open frontier: MTA-STS at 9.2% SPF and DMARC authenticate who sent a message. They do nothing about how it travels between mail servers. MTA-STS closes that: it publishes a policy saying "always deliver to me over TLS, and don't fall back to plaintext," defeating a downgrade attacker sitting on the wire. It's the natural next step after DMARC - and among these top domains, only 9.2% have it. The reason is friction. SPF and DMARC are each a single TXT record. MTA-STS needs a hosted policy file on an mta-sts. subdomain plus a DNS record - more moving parts, so most haven't bothered. That's the entire gap. If you've already done DMARC and want the next genuine win, MTA-STS is it, and you'd be joining the 9%, not following the crowd. About the sample These are 152 of the most-used global domains across tech, retail, media, finance, government and education - which means they skew sophisticated. Read the numbers as "what the best-run domains do," not the general web, where SPF and especially DMARC adoption is far lower. The value is the shape: at the very top, authentication is solved and enforced, while transport security is still the exception. Reproduce it Plain DNS lookups against a fixed, documented domain list - no auth, no proprietary data: import { promises as dns } from 'node:dns' const spf = (await dns.resolveTxt(domain)).flat().some(t => t.toLowerCase().startsWith('v=spf1')) const dmarc = (await dns.resolveTxt('_dmarc.' + domain)).flat().find(t => t.toLowerCase().includes('v=dmarc1')) const sts = (await dns.resolveTxt('_mta-sts.' + domain)).flat().some(t => t.toLowerCase().includes('v=stsv1')) DNS changes over time, so a re-run may move a point or two - that's expected. To check your own domain, the DNS lookup pulls its raw MX and TXT records, and the SMTP test checks whether its mail host answers - both from the browser. Originally published on LK Forge. Top comments (0)