Do the Top Domains Actually Protect Their Email?
By Lucian — builder & engineer, LK Forge
SPF, DMARC and MTA-STS are the DNS records that stop someone spoofing mail from your domain. Everyone says to set them — so we queried live DNS for 152 of the most-used domains to see who actually has. The short version: the basics are essentially solved at the top of the web, most domains enforce and don't just monitor — and one newer standard is still almost entirely missing.
The email-security funnel
Of the 152 domains, 146 actually receive mail (they publish an MX record). Among those, the authentication basics are effectively universal — but each further step of protection sheds some adopters, and the last one falls off a cliff.
Key finding: among the 146 mail-receiving domains, SPF is on 100% and DMARC on 99.3% — and it's not decorative: 92.1% of all 152 domains actively enforce DMARC (quarantine or reject). But MTA-STS is on just 9.2%.
Publishing DMARC isn't the story — enforcing it is
A DMARC record can be all bark and no bite. The p= policy decides what a receiver does with
mail that fails: p=none is monitor-only (deliver it anyway), p=quarantine
sends it to spam, and p=reject drops it. A domain on p=none has DMARC in the
technical sense but gains almost no protection. So the meaningful question isn't "do they publish DMARC"
but "do they enforce it."
At the top, they do. Of the 152 domains, 114 are on p=reject — the strictest setting — 26 on p=quarantine, and only 10 sit at monitor-only p=none. That's 75% on the strictest policy, and 93.3% of everyone who publishes DMARC is actually enforcing it. "Publish but don't enforce" — the common half-measure — is rare among the biggest domains.
The open frontier: MTA-STS at 9.2%
SPF and DMARC authenticate who sent a message. They do nothing about how it travels. MTA-STS closes that gap: it publishes a policy saying "always deliver to me over TLS, and don't fall back to plaintext," defeating a downgrade attacker sitting between mail servers. It's the natural next step after DMARC — and among these top domains only 9.2% have it.
The reason is friction: MTA-STS needs a hosted policy file on a mta-sts. subdomain plus a DNS
record, where SPF and DMARC are each a single TXT line. That extra setup is the whole gap. If you've already
done DMARC and want the next real win, this is it — and you'd be joining the 9.2%, not following the
crowd.
About the sample
These are 152 of the most-used global domains across tech, retail, media, finance, government and education — which means they skew sophisticated. Read the numbers as "what the best-run domains do," not the general web, where SPF and especially DMARC adoption is far lower. The value here is the shape: at the very top, authentication is solved and enforced, while transport security (MTA-STS) is still the exception.
Reproduce this
Everything comes from scripts/crawl-email-security.mjs — plain DNS lookups against a fixed,
documented domain list, no auth and no proprietary data. DNS changes over time, so a re-run may move a
point or two; that's expected. The core of each check is one call:
import { promises as dns } from 'node:dns'
const spf = (await dns.resolveTxt(domain)).flat()
.some(t => t.toLowerCase().startsWith('v=spf1'))
const dmarc = (await dns.resolveTxt('_dmarc.' + domain)).flat()
.find(t => t.toLowerCase().includes('v=dmarc1')) // read p= for policy
const sts = (await dns.resolveTxt('_mta-sts.' + domain)).flat()
.some(t => t.toLowerCase().includes('v=stsv1'))Run it against your own list and you'll get the same shape of result.
Check your own domain
See what a mail server sees: the SMTP test checks whether a mail host answers and speaks the protocol, and the DNS lookup pulls the raw MX and TXT records — SPF and DMARC included — for any domain. Both run from the browser.
More network tools
- DNS Lookup — MX, TXT, A, CNAME and more for any domain.
- What's My IP — your public address and what it reveals.
- All the network tools — DNS, SMTP, ping, subnet and IP.