BounceZero Research · Flagship Report
What 272,446 domains reveal about the state of email authentication. Snapshot, August 2026 — every claim below is independently verifiable with dig.
Two-thirds of the domains businesses actually email are either unprotected or only watching.
Publishing DMARC is now mainstream. Enforcing it is not.
| DMARC policy | Domains | Share |
|---|---|---|
| No DMARC record at all | 102,402 | 37.6% |
| p=none (monitor only) | 81,094 | 29.8% |
| p=quarantine | 52,469 | 19.3% |
| p=reject (enforcing) | 36,440 | 13.4% |
p=none is where domains go to die. Nearly a third of all domains have done the hard part — published a record, pointed a DNS entry — and then stopped before the one step that actually stops spoofing. Contrast with SPF at 83.4% adoption: the industry embraced the easy control and stalled on the one with operational risk. The full funnel reads 83.4% SPF → 62.7% DMARC → 13.4% enforcement.
Footnote on real-world DNS hygiene: 41 domains publish a DMARC policy value so malformed it fits no known syntax — including several misspellings of “quarantine”.
Your mail provider predicts your authentication posture more than your size does.
| Provider | Domains | Has DMARC | Enforcing (p=reject) | MTA-STS |
|---|---|---|---|---|
| Microsoft 365 | 100,536 | 71.0% | 16.3% | 1.53% |
| Google Workspace | 61,456 | 69.2% | 12.2% | 1.51% |
| Gmail (consumer) | 3,504 | 88.6% | 21.9% | 2.00% |
| Zoho | 2,472 | 68.2% | 8.9% | 0.53% |
| IONOS | 1,147 | 88.8% | 3.2% | 0.09% |
| Fastmail | 1,078 | 53.2% | 7.5% | 2.60% |
Microsoft 365 and Google Workspace are statistically twins on adoption (~70%), but M365 domains enforce at a rate a third higher (16.3% vs 12.2%). The sharpest anomaly is IONOS: 88.8% publish DMARC, only 3.2% enforce — the signature of a registrar auto-provisioning records that nobody ever tunes.
36.3% of observed domains resolve to no identifiable provider; that bucket is disclosed here and excluded from the table rather than renormalised away. Providers below n=1,000 are suppressed.
One in five probed domains accepts mail for addresses that do not exist.
Of 239,431 domains where a direct SMTP catch-all probe completed, 47,909 (20.0%) accepted mail for a deliberately nonexistent address. These are per-domain, direct-probe measurements — not inferences.
| Provider | Domains probed | Catch-all rate |
|---|---|---|
| Gmail (consumer) | 1,344 | 37.8% |
| Google Workspace | 57,614 | 33.2% |
| Microsoft 365 | 40,598 | 17.6% |
| Zoho | 1,330 | 7.2% |
The finding worth quoting: Google Workspace domains are ~1.9× more likely to be catch-all than Microsoft 365 domains (33.2% vs 17.6%), on large and comparable samples of 57,614 and 40,598 probed domains. The operational consequence is direct — a list heavy in Google Workspace domains will return far more addresses that no SMTP probe can resolve, and any vendor claiming a clean binary valid/invalid verdict on those addresses is guessing. That includes us: this class of address cannot be resolved by SMTP probing, by us or by anyone.
Definition: a domain counts as catch-all when a direct SMTP probe for a deliberately nonexistent local part was accepted. Rates here are domain-weighted. Volume-weighted (per-email) rates differ substantially because catch-all domains skew small — our companion study The Catch-All Mirage covers that distinction in depth.
New domains are the least protected — the inverse of the legacy-infrastructure assumption.
| Domain age | Domains | Has DMARC | Enforcing |
|---|---|---|---|
| Under 1 year | 4,211 | 40.5% | 7.3% |
| 1–5 years | 26,661 | 45.3% | 5.5% |
| 5–10 years | 35,767 | 61.0% | 10.9% |
| 10+ years | 142,072 | 72.6% | 16.8% |
DMARC adoption climbs monotonically with age, from 40.5% on domains under a year old to 72.6% at ten-plus years. Newly-registered domains are disproportionately used for cold outreach — which means the domains most likely to be mailing you are the least likely to be protected.
Registration age is known for 208,711 of 272,446 domains (76.6% coverage); rows with unknown age are excluded from this table only.
The modern standards have not arrived.
3,488 of 272,446 domains publish an MTA-STS policy. Eight years after RFC 8461, strict transport security for email remains a rounding error.
Barely a third of domains resolve to mail infrastructure with valid forward-confirmed reverse DNS — still a top silent killer of deliverability.
BounceZero currently tracks 195,199 active disposable and throwaway email domains, aggregated from three independent sources. We deliberately do not publish an “X% of your list is disposable” figure — that number is entirely a function of whose list happens to be processed, and any vendor quoting one without that caveat is selling, not measuring.
Collection window: 2026-02-15 to 2026-08-05 (about 5.6 months). Every figure is a point-in-time snapshot as of August 2026, not an annual trend. DNS records are re-checked on a rolling basis.
Sample frame: 272,446 unique domains observed on commercial mailing lists processed by the BounceZero verification platform. This over-represents B2B and commercially-mailed domains and is not a random sample of the DNS — it is a census of the domains senders actually email.
Denominators: authentication percentages use all 272,446 domains. Catch-all percentages use the 239,431 domains where a direct SMTP probe completed with a determinate result. Age percentages use the 208,711 domains with known registration age.
Catch-all definition: a domain is catch-all when a direct SMTP probe addressed to a deliberately nonexistent local part was accepted by the receiving server. No inference, no pattern-matching.
Provider attribution: derived from MX records. 36.3% of domains have no identifiable provider; that bucket is disclosed and excluded from provider tables rather than renormalised. Provider cells below n=1,000 are suppressed throughout.
DMARC normalisation: policy values are lower-cased, trimmed, and bucketed; 41 unparseable values are counted as malformed and excluded from policy shares.
Verify it yourself: every DNS claim in this report can be reproduced for any domain with dig TXT _dmarc.<domain>, dig TXT <domain> (SPF), and dig TXT _mta-sts.<domain> — or with our free DMARC, SPF, and DKIM checkers.
Citation: data and figures are free to cite with attribution to BounceZero and a link to this page (CC BY 4.0).
A fifth of the domains on a typical B2B list accept mail for addresses that do not exist. Verify yours before your next campaign — 100 free checks a month, no card required.
Verify your list freeOr check a single domain with the free email verifier.
Deep-dive guides on how email verification and inbox placement work
How the 5-stage pipeline checks a mailbox without sending email
The RCPT TO handshake explained — codes, catch-alls, limits
Why domains accept everything and how ML classifies deliverability
Temp addresses, how to detect them, and why they matter
Hard vs soft bounces, SMTP codes, and how to fix them
Get from 5-15% to under 0.5% in 6 steps
Explore other topics