Email Authentication Report 2026: We Checked 186 Domains

Published June 2026 · By The InboxGreen Team · Methodology

Key Findings

SPF Results

SPF was the strongest of the three. Most domains have an SPF record, but softfail (~all) instead of hard fail (-all) is common, which reduces protection without breaking delivery.

DKIM Results

DKIM had the widest gap. 14% of domains had no DKIM record detectable on standard selectors. It is worth noting that some of these domains may use non-standard DKIM selectors not included in our probe list; see Methodology for details. Even accounting for this, a meaningful number of domains appear to lack DKIM entirely.

DMARC Results

DMARC showed the most variation. Having a DMARC record at p=none means the domain owner receives reports but mail providers take no action against spoofed messages. It offers zero protection.

Findings by Category

Shopify stores and WordPress hosting platforms showed the highest rates of weak or missing DMARC. Developer tool companies (Cloudflare, DigitalOcean, Netlify, Vercel, etc.) had the strongest overall authentication hygiene.

Notable Individual Findings

The following observations are based on publicly available DNS records queried in June 2026. All DNS records are intentionally public. They are read by every mail server that processes incoming email.

All Domains with Issues

The table below shows every domain from our scan that had at least one SPF, DKIM, or DMARC problem. Domains where all three passed are excluded. All data is from public DNS records queried June 3, 2026.

Why This Matters in 2026

In February 2024, Google and Yahoo introduced sender authentication requirements for bulk email: SPF or DKIM authentication is mandatory, and DMARC at minimum p=none is required for senders sending more than 5,000 messages per day to Gmail. These requirements have tightened further throughout 2024 and 2025.

Despite these requirements being public and widely covered, a significant portion of well-known domains have not moved beyond p=none or have gaps in DKIM coverage. The risk is real: domains with weak DMARC are easier to spoof, and spoofed email damages both sender reputation and recipient trust.

The compound finding is stark: only 69.4% of the domains we checked had all three records (SPF, DKIM, DMARC) fully configured and passing. If this rate holds across the broader web (and there is no reason to think well-known companies perform worse than average), the actual exposure across all email-sending domains is significant.

Check and Fix Your Own Domain

If this report made you wonder about your own domain's authentication, these tools check it in seconds.

Related Guides

For step-by-step setup instructions per provider, see the Email Authentication Guides: Google Workspace, Microsoft 365, SendGrid, Mailgun, Brevo, Shopify, and more.

---

Methodology

Data collection: All checks were performed using InboxGreen's DNS-based SPF, DKIM, and DMARC checker in June 2026. The tool queries public DNS records using PHP's DNS resolution functions. No emails were sent. No private systems were accessed.

Domain selection: 186 domains were selected across nine categories: email service providers, SaaS platforms, Shopify stores, WordPress hosting providers, SEO and marketing tools, developer tools, e-commerce brands, content and publishing sites, and small SaaS tools. Domains were selected based on public recognition within their category, not performance on any metric.

SPF: A domain passes SPF if it has exactly one valid SPF TXT record starting with v=spf1. A warning is issued for ~all (softfail) instead of -all (hardfail). Failure is recorded for missing, malformed, or multiple SPF records.

DKIM: DKIM is checked by probing a predefined list of common DKIM selectors including: selector1, selector2, default, google, mail, smtp, amazonses, sendgrid, mailgun, postmark, sparkpost, zoho, mailjet, sendinblue, mandrill, protonmail, protonmail2, protonmail3, brevo1, brevo2, and others. A DKIM "fail" in this report means no valid DKIM record was found on any of these selectors. It does not guarantee DKIM is absent. Domains using custom or provider-specific selectors not in our list may be falsely reported as failing.

DMARC: A domain passes DMARC if it has a valid _dmarc TXT record with p=quarantine or p=reject. A warning is issued for p=none. Failure is recorded for missing or malformed records.

Date of scan: June 3, 2026. DNS records change over time. Domains that failed at the time of scanning may have since corrected their configuration.

Raw data: The full CSV dataset is available for download. Download the raw CSV (186 domains). You can also run your own domain check to verify current status.

---

mail_lock

Stay in the loop

Short, tactical updates on email deliverability.

mark_email_read Join newsletter

1-2 emails per week. Unsubscribe anytime.