Skip to content
emailrules.today

The Index · measured daily from public DNS

96% of the best-known senders enforce DMARC.

Read from public DNS on 3 Oct 2026 across 98 domains in seven sectors. Every percentage on this page carries the number it was calculated from, the roster is published in full, and each domain’s own reading is printed below so the aggregate can be checked rather than believed.

At quarantine or reject

96%

94 of 98

Still at p=none

2%

2 of 98 publish a policy that enforces nothing

No DMARC at all

2%

2 of 98

Collecting rua reports

97%

95 of 98 would find out if something broke

Enforcement over time

Share of the roster at quarantine or reject, one point per day measured. Nobody can backfill this — it starts the day it starts.

0%25%50%75%100%4 Aug 2026 — 94%5 Aug 2026 — 94%6 Aug 2026 — 94%7 Aug 2026 — 94%8 Aug 2026 — 94%9 Aug 2026 — 94%10 Aug 2026 — 94%11 Aug 2026 — 94%12 Aug 2026 — 94%13 Aug 2026 — 94%14 Aug 2026 — 94%15 Aug 2026 — 94%16 Aug 2026 — 94%17 Aug 2026 — 94%18 Aug 2026 — 94%19 Aug 2026 — 94%20 Aug 2026 — 94%21 Aug 2026 — 94%22 Aug 2026 — 94%23 Aug 2026 — 94%24 Aug 2026 — 94%25 Aug 2026 — 94%26 Aug 2026 — 94%27 Aug 2026 — 94%28 Aug 2026 — 94%29 Aug 2026 — 94%30 Aug 2026 — 94%31 Aug 2026 — 94%1 Sep 2026 — 94%2 Sep 2026 — 94%3 Sep 2026 — 94%4 Sep 2026 — 94%5 Sep 2026 — 94%6 Sep 2026 — 94%7 Sep 2026 — 94%8 Sep 2026 — 94%9 Sep 2026 — 94%10 Sep 2026 — 94%11 Sep 2026 — 94%12 Sep 2026 — 94%13 Sep 2026 — 94%14 Sep 2026 — 94%15 Sep 2026 — 94%16 Sep 2026 — 94%17 Sep 2026 — 94%18 Sep 2026 — 95%19 Sep 2026 — 96%20 Sep 2026 — 96%21 Sep 2026 — 96%22 Sep 2026 — 96%23 Sep 2026 — 96%24 Sep 2026 — 96%25 Sep 2026 — 96%26 Sep 2026 — 96%27 Sep 2026 — 96%28 Sep 2026 — 96%29 Sep 2026 — 96%30 Sep 2026 — 96%1 Oct 2026 — 96%2 Oct 2026 — 96%3 Oct 2026 — 96%
4 Aug 202661 daily readings · no smoothing, no interpolation3 Oct 2026

What moved since 2 Oct 2026

  • aesop.comDKIM keys02
  • airbnb.comDKIM keys20
  • allbirds.comDKIM keys70
  • bombas.comDKIM keys02
  • booking.comDKIM keys03
  • brooklinen.comDKIM keys01
  • decathlon.comDKIM keys90
  • deliveroo.co.ukDKIM keys30
  • delta.comDKIM keys40
  • doordash.comDKIM keys60
  • easyjet.comDKIM keys40
  • ebay.comDKIM keys60
  • etsy.comDKIM keys40
  • everlane.comDKIM keys40
  • lego.comDKIM keys05
  • linear.appDKIM keys01
  • mailchimp.comDKIM keys04
  • marksandspencer.comDKIM keys02
  • nike.comDKIM keys03
  • npr.orgDKIM keys05
  • nytimes.comDKIM keys05
  • patagonia.comDKIM keys06
  • paypal.comDKIM keys02
  • peloton.comDKIM keys03
  • stripe.comDKIM keys04
  • substack.comDKIM keys01
  • theatlantic.comDKIM keys30
  • uber.comDKIM keys60
  • united.comDKIM keys20
  • vercel.comDKIM keys04
  • vinted.comDKIM keys03
  • vox.comDKIM keys04
  • walmart.comDKIM keys05
  • warbyparker.comDKIM keys03

By sector

SectornEnforcingp=noneNo DMARCrua
Ecommerce & DTCDirect-to-consumer brands, the heaviest lifecycle senders in the index.1883%11%6%94%
FinanceThe category with the strongest regulatory pressure on authentication.12100%0%0%100%
MarketplacesPlatforms sending on behalf of third parties, the hardest alignment problem.1292%0%8%92%
Media & publishingNewsletter-first businesses, where the list is the product.12100%0%0%100%
RetailLarge multi-channel retailers with long-lived legacy sending estates.14100%0%0%100%
SoftwareProduct and transactional senders, usually the most technically staffed.18100%0%0%94%
Travel & hospitalityHigh transactional volume, and the most phished category in the index.12100%0%0%100%

What this does not claim

An unreadable SPF is not a failure. 31 of 98 publish a macro record or delegate their sender list to a hosted manager. Those cannot be expanded by reading DNS — not by us, not by anyone — so they are excluded from every statistic about who authorises whom rather than counted as broken. This site shipped that mistake once, publicly, against three named brands.

We do not publish a “misconfigured” rate, and here is why. 21 of the 67 readable domains publish DKIM keys for a platform their SPF does not name. That is a real count, and it is not a fault rate. SPF is evaluated against the envelope domain, and every major platform sends with its own bounce domain by default — so on those messages the sender’s SPF is never consulted and DMARC passes on DKIM alignment alone, exactly as intended. Stripe, Shopify and Figma all look like this. A benchmark that counted them as broken would be wrong about the best-run senders in the index, so this one does not.

DNS is not deliverability. A domain at p=reject with perfect records can still be sending mail nobody asked for. This measures what a sender has published, which is the floor, not the ceiling.

No sender is ranked. There is no leaderboard and no score. The roster was fixed before the first reading and does not change because a number moves.

Every domain, as measured

The aggregate above is calculated from exactly these rows. Check our arithmetic.

DomainDMARCSPFDKIMNotes
aesop.comp=reject-all2
allbirds.comp=quarantine~all0SPF not readable from DNS
away.comabsent~all1
bombas.comp=reject~all2
brooklinen.comp=quarantine~all1
casper.comp=reject~all5signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
chubbies.comp=none~all3
everlane.comp=reject~all0
glossier.comp=reject~all6SPF not readable from DNS
gymshark.comp=reject~all5SPF not readable from DNS
harrys.comp=quarantine~all5
lush.comp=quarantine-all3
oatly.comp=reject-all5
patagonia.comp=none~all6signs with 2 platforms its SPF does not name — normal if that platform sends with its own return path
peloton.comp=quarantine-all3
represent.comp=quarantineabsent0
ruggable.comp=quarantineno all4
warbyparker.comp=reject~all3
americanexpress.comp=reject-all0
barclays.co.ukp=reject-all0SPF not readable from DNS
chase.comp=reject-all0SPF not readable from DNS
coinbase.comp=reject-all2
hsbc.co.ukp=reject~all0SPF not readable from DNS
klarna.comp=reject-all3SPF not readable from DNS
monzo.comp=reject-all0
n26.comp=reject~all4
paypal.comp=reject~all2
revolut.comp=quarantine~all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
vanguard.comp=reject~all2SPF not readable from DNS
wise.comp=reject~all5signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
amazon.comp=quarantine-all0
asos.comp=reject-all3
deliveroo.co.ukp=reject~all0
depop.comp=reject~all4
doordash.comp=reject~all0SPF not readable from DNS
ebay.comp=reject~all0
etsy.comp=reject-all0
justeat.co.ukabsentabsent0
uber.comp=quarantine~all0SPF not readable from DNS
vinted.comp=quarantine-all3signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
wayfair.comp=quarantine-all6signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
zalando.comp=reject-all1
bbc.co.ukp=reject~all0
bloomberg.comp=reject-all0
economist.comp=quarantine~all5signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
ft.comp=reject-all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
medium.comp=reject~all0
npr.orgp=reject-all5SPF not readable from DNS
nytimes.comp=reject~all5SPF not readable from DNS
substack.comp=reject~all1
theatlantic.comp=reject-all0
theguardian.comp=reject-all2
vox.comp=reject~all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
wired.comp=reject~all5signs with 2 platforms its SPF does not name — normal if that platform sends with its own return path
adidas.comp=reject-all0
costco.comp=reject-all4SPF not readable from DNS
decathlon.comp=reject-all0SPF not readable from DNS
hm.comp=reject~all4SPF not readable from DNS
ikea.comp=reject-all2
johnlewis.comp=quarantine-all0SPF not readable from DNS
lego.comp=reject-all5signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
marksandspencer.comp=reject-all2SPF not readable from DNS
nike.comp=reject~all3SPF not readable from DNS
sephora.comp=reject-all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
target.comp=reject~all6SPF not readable from DNS
uniqlo.comp=reject~all7signs with 2 platforms its SPF does not name — normal if that platform sends with its own return path
walmart.comp=reject~all5SPF not readable from DNS
zara.comp=reject-all0SPF not readable from DNS
1password.comp=quarantine~all0
asana.comp=quarantine-all1SPF not readable from DNS
atlassian.comp=reject~all4SPF not readable from DNS
canva.comp=reject-all6signs with 2 platforms its SPF does not name — normal if that platform sends with its own return path
cloudflare.comp=reject-all3
dropbox.comp=reject~all0SPF not readable from DNS
figma.comp=quarantine-all5signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
github.comp=quarantine~all6
hubspot.comp=rejectno all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
klaviyo.comp=reject~all4
linear.appp=reject~all1
mailchimp.comp=reject~all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
notion.sop=quarantine~all0
shopify.comp=reject~all5signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
slack.comp=reject-all0
stripe.comp=reject~all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
vercel.comp=quarantine~all4
zoom.usp=reject~all5SPF not readable from DNS
airbnb.comp=reject-all0
booking.comp=reject-all3SPF not readable from DNS
britishairways.comp=reject~all1SPF not readable from DNS
delta.comp=reject-all0SPF not readable from DNS
easyjet.comp=reject~all0SPF not readable from DNS
expedia.comp=reject-all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
hilton.comp=quarantine-all4signs with 1 platform its SPF does not name — normal if that platform sends with its own return path
lufthansa.comp=reject-all0
marriott.comp=reject-all0
ryanair.comp=reject~all0SPF not readable from DNS
trainline.comp=reject-all2
united.comp=reject~all0SPF not readable from DNS

The whole index as JSON →The blocklist censusHow we measureTell us we are wrong