Original research
Who actually authenticates their email
We queried the public DNS of 13,635 company domains across 25 industries to find how many publish SPF, publish DMARC, and actually enforce it. Adoption tracks company size far more strongly than it tracks industry: 21% of companies under ten people enforce DMARC, against 80% of those over a thousand. The gap is where cold email goes missing, and it is where most cold email is aimed.
Free to reuse with attribution (CC BY 4.0). We publish aggregate counts only — never the underlying company domains. Every row is reproducible with dig.
Every industry, by company size
Enforce DMARC, weighted by sample size across 25 industries.
21.4% at the smallest companies against 79.5% at the largest — 58 points, and it holds in almost every industry below. Company size predicts this far better than industry does.
| Industry | Sample | |||||
|---|---|---|---|---|---|---|
| Gaming | 11.5% | 21.9% | 41% | 66.7% | 58.5% | 544 |
| Nonprofits | 11.5% | 25.6% | 47.4% | 70.1% | 75% | 572 |
| Hospitality | 15.6% | 23.9% | 38.9% | 48.7% | 73% | 548 |
| Education | 16.3% | 21.1% | 37.6% | 52.6% | 80.2% | 554 |
| Insurance | 16.3% | 33.6% | 59.3% | 67% | 88.4% | 562 |
| SaaS | 16.7% | 42.1% | 57.1% | 72.2% | 80.9% | 559 |
| Agencies | 16.8% | 26.3% | 34.2% | 50.9% | 55.4% | 558 |
| Marketplaces | 17.3% | 19.8% | — | — | — | 179 |
| Healthcare | 18.3% | 35.7% | 48.7% | 59.6% | 78.3% | 567 |
| Professional services | 18.3% | 32.7% | 35.7% | 56% | 86.1% | 565 |
| Construction | 19.2% | 23.7% | 43.1% | 60% | 73% | 564 |
| E-commerce | 19.6% | 31.4% | 51.3% | 65% | 67.5% | 578 |
| Recruiting | 20.2% | 31% | 39.5% | 56.9% | 75% | 562 |
| Energy | 21.6% | 26.5% | 43.1% | 46.9% | 85.8% | 550 |
| Logistics | 22.3% | 30.3% | 48.1% | 54.7% | 83.3% | 549 |
| Media & publishing | 24.2% | 29.7% | 45.1% | 50% | 82.9% | 563 |
| Legal tech | 24.3% | 43.5% | 49.2% | 62.3% | 82.6% | 569 |
| Manufacturing | 24.3% | 33% | 45.5% | 57.8% | 83.1% | 552 |
| Real estate | 25.2% | 30.4% | 54.3% | 72.8% | 83.6% | 562 |
| AI & machine learning | 26.3% | 38.5% | 47.8% | 66.4% | 86.2% | 561 |
| Biotech | 27% | 37.7% | 47% | 60.3% | 84.3% | 573 |
| Proptech | 27% | 32.7% | 49.1% | 54.7% | 55.6% | 518 |
| Developer tools | 27.4% | 44.1% | 58% | 77.3% | 94.9% | 587 |
| Cybersecurity | 30.3% | 39.7% | 44.3% | 60.5% | 91.3% | 569 |
| Fintech | 34.3% | 43.6% | 65.8% | 75.6% | 92.2% | 570 |
Percentages are of the measured sample in each cell, not of the whole industry. Cells with fewer than 60 domains are not published and show as —.
Method and limits
- How was this measured?
- Company domains were sampled within employee-count bands for each industry, then queried over public DNS: a TXT lookup at the apex for SPF, a TXT lookup at _dmarc.<domain> for DMARC, and an MX lookup. One domain per company, deduplicated. Every individual row can be reproduced with dig.
- Why is DKIM not included?
- A DKIM key is published at <selector>._domainkey.<domain>, and selectors cannot be enumerated from outside the domain — they can only be guessed. A company with flawless DKIM under a selector we did not guess would be recorded as having none, so the figure would describe our guess list rather than the industry. Only records published at fixed, discoverable names are measured here.
- What does "enforced" mean?
- A DMARC record with a policy of quarantine or reject, meaning the domain asks receiving servers to act when a message fails authentication. A policy of p=none is counted as publishing DMARC but not as enforcing it: it reports failures and stops nothing.
- Why exclude domains with no MX record?
- A domain with no MX cannot receive mail, so it is usually parked, a redirect, or a brand defensive registration rather than a company that sends and receives email. Counting those as authentication failures would drag every percentage down and make the result an artefact of the sample rather than a fact about the industry.
- Can I reuse these numbers?
- Yes, under CC BY 4.0 — cite SoloRiff and link to this page. We publish only aggregate counts and never the underlying company domains.
- How often is it refreshed?
- Monthly. Each figure carries the date it was measured, because a statistic without a date is not a statistic anyone can check.
Check your own domain
The same three lookups, run against your sending domain, with the specific record to fix if one is missing.
Run the check →