BounceZero Research - Flagship Report
What 272,446 domains reveal about the state of email authentication. Snapshot, August 2026 - every claim below is independently verifiable with dig.
Two-thirds of the domains businesses actually email are either unprotected or only watching.
Publishing DMARC is now mainstream. Enforcing it is not.
| DMARC policy | Domains | Share |
|---|---|---|
| No DMARC record at all | 102,402 | 37.6% |
| p=none (monitor only) | 81,094 | 29.8% |
| p=quarantine | 52,469 | 19.3% |
| p=reject (enforcing) | 36,440 | 13.4% |
p=none is where domains go to die. Nearly a third of all domains have done the hard part - published a record, pointed a DNS entry - and then stopped before the one step that actually stops spoofing. Contrast with SPF at 83.4% adoption: the industry embraced the easy control and stalled on the one with operational risk. The full funnel reads 83.4% SPF > 62.7% DMARC > 13.4% enforcement.
Footnote on real-world DNS hygiene: 41 domains publish a DMARC policy value so malformed it fits no known syntax - including several misspellings of “quarantine”.
Your mail provider predicts your authentication posture more than your size does.
| Provider | Domains | Has DMARC | Enforcing (p=reject) | MTA-STS |
|---|---|---|---|---|
| Microsoft 365 | 100,536 | 71.0% | 16.3% | 1.53% |
| Google Workspace | 61,456 | 69.2% | 12.2% | 1.51% |
| Gmail (consumer) | 3,504 | 88.6% | 21.9% | 2.00% |
| Zoho | 2,472 | 68.2% | 8.9% | 0.53% |
| IONOS | 1,147 | 88.8% | 3.2% | 0.09% |
| Fastmail | 1,078 | 53.2% | 7.5% | 2.60% |
Microsoft 365 and Google Workspace are statistically twins on adoption (~70%), but M365 domains enforce at a rate a third higher (16.3% vs 12.2%). The sharpest anomaly is IONOS: 88.8% publish DMARC, only 3.2% enforce - the signature of a registrar auto-provisioning records that nobody ever tunes.
36.3% of observed domains resolve to no identifiable provider; that bucket is disclosed here and excluded from the table rather than renormalised away. Providers below n=1,000 are suppressed.
One in five probed domains accepts mail for addresses that do not exist.
Of 239,431 domains where a direct SMTP catch-all probe completed, 47,909 (20.0%) accepted mail for a deliberately nonexistent address. These are per-domain, direct-probe measurements - not inferences.
| Provider | Domains probed | Catch-all rate |
|---|---|---|
| Gmail (consumer) | 1,344 | 37.8% |
| Google Workspace | 57,614 | 33.2% |
| Microsoft 365 | 40,598 | 17.6% |
| Zoho | 1,330 | 7.2% |
The finding worth quoting: Google Workspace domains are ~1.9× more likely to be catch-all than Microsoft 365 domains (33.2% vs 17.6%), on large and comparable samples of 57,614 and 40,598 probed domains. The operational consequence is direct - a list heavy in Google Workspace domains will return far more addresses that no SMTP probe can resolve, and any vendor claiming a clean binary valid/invalid verdict on those addresses is guessing. That includes us: this class of address cannot be resolved by SMTP probing, by us or by anyone.
Definition: a domain counts as catch-all when a direct SMTP probe for a deliberately nonexistent local part was accepted. Rates here are domain-weighted. Volume-weighted (per-email) rates differ substantially because catch-all domains skew small - our companion study The Catch-All Mirage covers that distinction in depth.
New domains are the least protected - the inverse of the legacy-infrastructure assumption.
| Domain age | Domains | Has DMARC | Enforcing |
|---|---|---|---|
| Under 1 year | 4,211 | 40.5% | 7.3% |
| 1-5 years | 26,661 | 45.3% | 5.5% |
| 5-10 years | 35,767 | 61.0% | 10.9% |
| 10+ years | 142,072 | 72.6% | 16.8% |
DMARC adoption climbs monotonically with age, from 40.5% on domains under a year old to 72.6% at ten-plus years. Newly-registered domains are disproportionately used for cold outreach - which means the domains most likely to be mailing you are the least likely to be protected.
Registration age is known for 208,711 of 272,446 domains (76.6% coverage); rows with unknown age are excluded from this table only.
The modern standards have not arrived.
3,488 of 272,446 domains publish an MTA-STS policy. Eight years after RFC 8461, strict transport security for email remains a rounding error.
Barely a third of domains resolve to mail infrastructure with valid forward-confirmed reverse DNS - still a top silent killer of deliverability.
BounceZero currently tracks 195,199 active disposable and throwaway email domains, aggregated from three independent sources. We deliberately do not publish an “X% of your list is disposable” figure - that number is entirely a function of whose list happens to be processed, and any vendor quoting one without that caveat is selling, not measuring.
Collection window: 2026-02-15 to 2026-08-05 (about 5.6 months). Every figure is a point-in-time snapshot as of August 2026, not an annual trend. DNS records are re-checked on a rolling basis.
Sample frame: 272,446 unique domains observed on commercial mailing lists processed by the BounceZero verification platform. This over-represents B2B and commercially-mailed domains and is not a random sample of the DNS - it is a census of the domains senders actually email.
Denominators: authentication percentages use all 272,446 domains. Catch-all percentages use the 239,431 domains where a direct SMTP probe completed with a determinate result. Age percentages use the 208,711 domains with known registration age.
Catch-all definition: a domain is catch-all when a direct SMTP probe addressed to a deliberately nonexistent local part was accepted by the receiving server. No inference, no pattern-matching.
Provider attribution: derived from MX records. 36.3% of domains have no identifiable provider; that bucket is disclosed and excluded from provider tables rather than renormalised. Provider cells below n=1,000 are suppressed throughout.
DMARC normalisation: policy values are lower-cased, trimmed, and bucketed; 41 unparseable values are counted as malformed and excluded from policy shares.
Verify it yourself: every DNS claim in this report can be reproduced for any domain with dig TXT _dmarc.<domain>, dig TXT <domain> (SPF), and dig TXT _mta-sts.<domain> - or with our free DMARC, SPF, and DKIM checkers.
Citation: data and figures are free to cite with attribution to BounceZero and a link to this page (CC BY 4.0).
A fifth of the domains on a typical B2B list accept mail for addresses that do not exist. Verify yours before your next campaign - 100 free checks a month, no card required.
Verify your list freeOr check a single domain with the free email verifier.
Deep-dive guides on how email verification and inbox placement work
10.2M verifications: 12.3% of addresses are dead, and where they hide
826K re-verifications: only 19% of valid addresses survive 90 days
True catch-all is 1.4% - most of what looks catch-all is unprobeable providers
info@ bounces 4.5x more than personal addresses - measured, not guessed
The 3x invalid-rate gap that vanishes when you control for domain size
How the 5-stage pipeline checks a mailbox without sending email
Explore other topics