SPF, DKIM and DMARC in 2026: only 41 % of domains with email have all three
SPF, DKIM and DMARC in 2026: only 41 % of domains with email have all three
Email authentication is not a classic SEO factor, but it is part of how a domain earns trust. Since 2024 Gmail and Yahoo require SPF, DKIM and DMARC from bulk senders, and a domain without them is easy to spoof in phishing mails that carry your name. Every LANGR SEO audit checks the DNS records behind this, so we looked at the numbers.
Of the 122,859 domains where the DNS check ran, 102,183 have MX records, meaning they actually receive email. The figures below are for those domains.
How many publish each record
| Record | Share of domains with email |
|---|---|
| SPF | 93.4 % |
| DMARC | 72.3 % |
| DKIM (found on a common selector) | 48.4 % |
| All three | 41.0 % |
SPF is close to universal, mostly because email providers add it during setup. DMARC is far less common, and only 41 % have the full set.
A caveat on DKIM: a DKIM key lives under a selector name that only the sender knows. We test the common selectors used by the big providers, so the real DKIM share is somewhat higher than 48.4 %. SPF and DMARC have fixed names, so those numbers are exact.
Most DMARC records do not protect anything
| DMARC policy | Domains | Share |
|---|---|---|
| p=none (monitor only) | 42,893 | 42.0 % |
| No DMARC record | 28,492 | 27.9 % |
| p=quarantine | 17,378 | 17.0 % |
| p=reject | 13,420 | 13.1 % |
A DMARC record with p=none tells receiving servers to report spoofed mail, not to stop it. Add the domains with no record at all, and 69.9 % of domains that use email give receivers no instruction to block a forged message. Only 30.1 % enforce a policy.
Why it matters for your website
- Deliverability. Order confirmations, password resets and newsletters land in spam more often without DMARC alignment.
- Brand trust. A spoofed invoice from your domain hurts the brand that your SEO work is building.
- Brand signals. BIMI, the logo next to your name in Gmail, requires DMARC with quarantine or reject.
How to get to enforcement in three steps
- Check SPF. One TXT record, ending in
~allor-all, and under the limit of 10 DNS lookups. - Turn on DKIM in your email provider's admin panel and publish the key it gives you.
- Publish DMARC with p=none and a rua address, read the reports for two to four weeks, and then move to p=quarantine and later p=reject.
The free LANGR SEO audit checks SPF, DKIM, DMARC and MX for any domain in a few seconds, next to the classic SEO checks. Terms like SPF and DMARC are explained in the SEO A to Z.
Method: latest complete audit per domain, 122,859 domains with a DNS result, of which 102,183 have MX records. Collected April to October 2026, mostly newly registered and small business domains in 15 country markets. No individual domain is named.