DNS scan of 152 top domains: SPF and DMARC near-universal, MTA-STS at 9%

A live measurement of DNS records across 152 of the most-used domains on the web puts concrete numbers on email spoofing defenses: sender authentication with SPF and DMARC is close to universal among them, most domains enforce rather than merely monitor, and MTA-STS — the newer standard that protects mail while it travels between servers — is deployed by fewer than one in ten.

The scan was published on dev.to by Lucian, having first appeared on LK Forge. It queried live DNS rather than a cached or historical dataset, so the figures reflect what a receiver checking today would actually find.

What was measured

The domain list covers tech, retail, media, finance, government and education. Of the 152 domains, 146 accept mail at all, in the sense that they publish an MX record. Among the results:

• SPF coverage is 100% among the 146 mail-receiving domains.
• 99.3% of that group publish a DMARC record.
• 92% of all 152 domains enforce DMARC with a quarantine or reject policy.
• 9.2% publish an MTA-STS record.

The method was deliberately simple: plain TXT lookups against the domains themselves and their _dmarc and _mta-sts subdomains, run against a fixed, documented list with no authentication or proprietary data involved. The author notes that DNS shifts over time, so repeating the scan could move a point or two in either direction.

Publishing DMARC is not the same as enforcing it

As the write-up explains, a DMARC record does nothing on its own — the policy inside it determines what a receiving server does with mail that fails authentication. A p=none policy only collects reports and still delivers that mail, offering almost no protection; p=quarantine treats it as suspicious and sends it to the spam folder; p=reject drops it entirely, the hardest line against spoofing.

On that measure the top of the web performs well. Of the 152 domains, 114 run p=reject, 26 run p=quarantine, and only 10 remain at monitor-only p=none. That is 75% on the strictest policy, and 93% of the domains that publish DMARC at all are enforcing it. The habit of publishing a record but never tightening the policy is rare among the biggest domains.

The MTA-STS gap

SPF and DMARC establish who sent a message. Neither says anything about how the message moves between mail servers. MTA-STS covers that second half: a domain publishes a policy instructing senders to deliver only over TLS and never fall back to plaintext, which closes off downgrade attacks in which someone on the network path pushes the connection back to unencrypted SMTP.

Only 9.2% of the surveyed domains have done this. The author attributes the shortfall to friction rather than disagreement: SPF and DMARC each amount to a single TXT record, whereas MTA-STS requires hosting a policy file on an mta-sts subdomain alongside the DNS entry. The extra moving parts have kept even well-run domains away. For anyone whose DMARC rollout is finished, the write-up positions MTA-STS as the next meaningful step — and one where adopters would currently be joining a small minority rather than following the crowd.

A skewed sample, read carefully

These figures describe the most sophisticated corner of the web, not the internet as a whole. The domains chosen are high-traffic and well-resourced, and the author is explicit that DMARC adoption across the general web is considerably lower. What the measurement offers is the overall pattern: at the very top, authentication is both deployed and enforced, while protection of the transport layer is still the exception.

Why it matters

Spoofed email remains a foundational technique for phishing and business email compromise, and the distance between publishing DMARC and enforcing it is the distance between looking protected and being protected. This scan suggests the largest domains have largely closed that distance, with 92% enforcement indicating that p=none functions as a transitional stage rather than a resting state.

The 9.2% MTA-STS figure is the more actionable result. It marks the point where even top-tier operators have stopped, and it gives smaller organisations an unusual opening: with DMARC already enforced, adding MTA-STS means being early to a standard instead of scrambling to catch up with everyone else.