We checked the public email security records of 500 US ecommerce and direct-to-consumer brands on November 3, 2026. Of the 494 domains that receive email, 97% publish a DMARC record, but only 51% enforce it with quarantine or reject. Large brands enforce at 87%. Small brands enforce at 19%.
That gap is the story. Since Google, Yahoo and Microsoft started requiring DMARC from bulk senders, nearly every brand has added a record. Most smaller brands stopped at p=none, which satisfies the mailbox providers but does nothing to stop someone from sending email that pretends to be them.
Everything below comes from public DNS only. No brand is named here, and we do not publish the domain list.
Key findings
- 97.2% of ecommerce domains publish a DMARC record. Only 2.8% have none at all.
- 50.8% enforce it: 23.1% at p=quarantine and 27.7% at p=reject.
- 45.5% sit at p=none, which monitors but blocks nothing.
- Size matters: 86.6% of large brands enforce, against 47.5% of mid-size and 19.0% of small brands.
- 74.1% of small brands are at p=none.
- 22.1% publish DMARC with no reporting address, so nobody receives the reports.
- Of brands whose SPF names a marketing or transactional email platform, 44.8% have no DMARC or only p=none. Among small brands it is 74.5%.
- 3.2% have two SPF records, which breaks SPF entirely, and 6.9% exceed the 10-lookup limit.
- DKIM keys turned up for 90.5% of domains on 40 documented selectors. But a third of Microsoft 365 users, and most brands sending through Mailchimp or Zendesk, show no key on that platform's own selector.
How many ecommerce brands enforce DMARC?
About half. Here is the full split, as a share of the 494 domains with mail records:
| DMARC status | All brands | Large | Mid | Small |
|---|---|---|---|---|
| No DMARC record | 2.8% | 0.0% | 3.0% | 5.4% |
| Record present but invalid | 0.8% | 0.7% | 0.5% | 1.4% |
| p=none (monitor only) | 45.5% | 12.8% | 49.0% | 74.1% |
| p=quarantine | 23.1% | 23.5% | 32.8% | 9.5% |
| p=reject | 27.7% | 63.1% | 14.6% | 9.5% |
| Enforcing (quarantine or reject) | 50.8% | 86.6% | 47.5% | 19.0% |
Large means well-known national brands, mid means 20 or more employees and small means fewer than 20. The method section below has the details.
Our read: the large brands have security teams and DMARC vendors. Mid-size brands are split down the middle. Small brands added a record to keep Gmail happy and never came back to it.
Is p=none enough to meet Google and Microsoft's rules?
For delivery, yes. Google's sender guidelines require bulk senders, meaning 5,000 or more messages a day to Gmail, to publish DMARC, and p=none is accepted. Microsoft's Outlook.com rules for senders over the same 5,000-a-day line took effect on May 5, 2025, and also accept p=none.
For protection, no. At p=none, receiving servers are told to deliver failing mail anyway. A scammer can send a fake order confirmation or refund email from your exact domain, and your policy asks inboxes to let it through.
That is the trade most of the brands we checked have made, often without knowing it.
Who is reading the reports?
22.1% of domains publish DMARC with no rua address, so aggregate reports go nowhere. Among small brands it is 39.5%.
A missing rua is not always a mistake. We removed ours once our own domains were stable at enforcement, because the daily reports were noise. But a domain at p=none with no reports is a monitoring policy with nobody monitoring.
Among domains that do collect reports, most send them to an in-house address or a smaller provider. The named services we could identify were Valimail (8.4%), Postmark (4.1%), EasyDMARC (3.8%), dmarcian (3.5%) and Red Sift (2.5%).
Are email marketing platforms the weak spot?
They are where the risk concentrates. 39.3% of domains name at least one email platform in their SPF record, such as Klaviyo, Mailchimp, SendGrid, Shopify, Amazon SES, HubSpot or Salesforce.
Of those, 44.8% have no DMARC or only p=none. By size:
| Brands with an email platform in SPF | No DMARC or p=none |
|---|---|
| Large | 13.2% |
| Mid | 46.7% |
| Small | 74.5% |
These are the brands sending the most email, often promotional, to the most customers. They are also the most attractive brands to impersonate.
Klaviyo deserves a note. 37.0% of domains show a Klaviyo signal in SPF or in Klaviyo's standard DKIM selector names. Among small brands it is 51.0%, and 42.2% of small brands show that signal with no DMARC or only p=none.
What else is broken in SPF?
Fewer brands than we expected, but the failures are hard ones:
| SPF finding | All brands |
|---|---|
| No SPF record | 2.0% |
| Two or more SPF records (SPF fails for every message) | 3.2% |
| Ends in +all or ?all (allows anyone) | 1.4% |
| Estimated over 10 DNS lookups (SPF fails) | 6.9% |
| Ends in ~all (soft fail) | 66.6% |
| Ends in -all (hard fail) | 26.3% |
Two SPF records usually happens when a new email platform's setup screen says "add this TXT record" and someone does, without merging it into the existing one.
The most common services referenced in SPF were Google (45.1%), Microsoft's Outlook servers (34.4%), Mailgun (20.0%), SendGrid (15.4%), Shopify (11.5%), Zendesk (10.9%) and Mailchimp (9.7%).
How many ecommerce brands use DKIM?
At least 90.5%. We found a DKIM key for 447 of 494 domains on at least one of 40 selectors documented by the major mail and email platforms, up from 88.7% on our first pass with 15 common selectors.
That is a floor, not a ceiling. DKIM keys sit under a name the sender chooses, and DNS has no way to list them, so a brand can sign mail with a name we did not test. Amazon SES, Shopify, Salesforce and Postmark, for example, use random or account-specific names that no outside check can guess.
Keys found on each platform's documented selector, as a share of the 494 domains:
| Platform | All brands | Large | Mid | Small |
|---|---|---|---|---|
| SendGrid | 50.4% | 63.8% | 54.0% | 32.0% |
| Google Workspace | 41.7% | 21.5% | 56.1% | 42.9% |
| Klaviyo | 37.2% | 8.1% | 49.5% | 50.3% |
| Microsoft 365 | 27.7% | 55.0% | 20.2% | 10.2% |
| Mailchimp | 12.6% | 22.8% | 9.1% | 6.8% |
| Gorgias | 11.7% | 2.0% | 14.6% | 17.7% |
| HubSpot | 9.7% | 14.1% | 10.6% | 4.1% |
| Zendesk | 6.3% | 9.4% | 8.6% | 0.0% |
Short selector names such as s1 or k2 are not unique to one vendor, so read this as "a key exists where that platform says it should be," not proof of who signs the mail.
Where DKIM looks missing
The more useful number is the gap. For brands whose SPF record authorizes a platform, here is the share with no key on that platform's documented selector:
| Platform in SPF | Brands | No key on its selector |
|---|---|---|
| Google Workspace | 211 | 22.7% |
| Microsoft 365 | 150 | 32.0% |
| SendGrid | 73 | 28.8% |
| Mailchimp | 46 | 60.9% |
| Zendesk | 53 | 62.3% |
Some of those brands sign on a subdomain or a custom selector we cannot see. But Google Workspace and Microsoft 365 DKIM are off until someone turns them on, so a missing key there usually means it was never set up. If that is you, your mail is passing DMARC on SPF alone, which breaks as soon as a message is forwarded.
16 of the 251 brands enforcing DMARC (6.4%) showed no DKIM key on any of the 40 selectors. Those are the brands most worth a second look.
BIMI and MTA-STS
- BIMI, the record that can show your logo in supporting inboxes: 15.8% overall, 32.2% of large brands, 2.0% of small brands. BIMI requires an enforcing DMARC policy, which explains most of that gap.
- MTA-STS, which forces encrypted delivery of mail to you: 2.8%.
Mailbox providers, from MX records: Google Workspace runs mail for 52.4% of domains and Microsoft 365 for 25.5%. Among small brands, Google Workspace is 75.5%.
What should an ecommerce brand do with this?
If you are in the p=none majority, the path to enforcement is not complicated, but it has to be done in order:
- Add a reporting address and read two to four weeks of reports.
- Make every legitimate sender pass: your mailbox provider, your email platform, your store, your helpdesk. Fix SPF so there is one record under 10 lookups, and turn on DKIM in each platform.
- Move to p=quarantine, watch the reports, then p=reject.
Our guide to SPF, DKIM and DMARC explains each record, and how to read DMARC reports covers step 1. We do this as part of our email and domain security work.
Method
- Run date: November 3, 2026. Resolver: Cloudflare 1.1.1.1 over DNS over HTTPS, rate limited, with one retry per failed lookup. Failures were recorded as errors, not estimated.
- Sample: 500 US ecommerce and DTC brand domains. 150 large brands from public lists of top US retailers and large consumer companies. 350 mid and small brands from Inc. 5000 consumer product and retail companies, split at 20 employees using self-reported headcount. Marketplaces, parked domains and domains that did not resolve were excluded.
- 6 domains had no MX record and were excluded from every email figure, leaving 494.
- Checks: MX, SPF (record count, all mechanism, recursive lookup estimate, named senders), DMARC (validity, p, sp, pct, rua, ruf), DKIM on 40 selectors taken from each platform's own documentation, BIMI and MTA-STS.
- Read-only public DNS. No email was sent, no mail server or website was contacted, and no company was contacted.
Limitations
- The sample is not random. It comes from lists of notable or fast-growing companies.
- DKIM detection is partial. We tested 40 documented selectors, but platforms that use random or account-specific names cannot be checked from outside, and short names are shared across vendors.
- Email platform use is inferred from SPF, which undercounts platforms that send from their own domains. Platform figures are a floor.
- Mailbox provider is inferred from MX, so domains behind a filtering gateway count as other.
- This is a snapshot of one day. Records change.
Frequently asked questions
What percentage of ecommerce brands use DMARC?
In our November 2026 check of 494 US ecommerce domains with mail records, 97.2% publish a DMARC record, but only 50.8% enforce it with p=quarantine or p=reject. The rest are at p=none, invalid or missing.
Is DMARC p=none safe?
It is safe for delivery and it meets the Google and Microsoft bulk sender rules, but it does not protect your domain. At p=none, mail that fails authentication is still delivered, so anyone can spoof your domain. Treat it as a short monitoring stage, not a destination.
How long does it take to move from p=none to p=reject?
For a typical ecommerce brand with a handful of senders, a few weeks of reading reports and fixing senders, then a gradual move through quarantine. The long pole is usually finding every service that sends as your domain.
Do small ecommerce brands need DMARC enforcement?
Yes. Small brands send the same order, shipping and promotional email that scammers copy, and in our data 74% of them are at p=none. Enforcement costs nothing in DNS. The work is making sure your real senders pass first.
Can I see the list of brands you checked?
No. We publish aggregate figures only and do not name brands. If you want your own domain checked, our free email deliverability check covers the same records.