Two-Thirds of the Top Million Domains Can Still Be Spoofed
A measurement study of the internet's email spoofing surface: who actually enforces DMARC across the Tranco top-1M, and what two years of mailbox-provider mandates changed.
TL;DR: We analyse daily DNS snapshots of the Tranco top-1M domain list. As of July 17, 2026, 659,259 of these domains receive email, and for 67.4% of them — roughly 444,000 domains — no enforced DMARC policy stands between an attacker and a forged From: header. 458,467 domains do publish DMARC, but only 46.9% enforce it (p=quarantine or p=reject at pct=100), and that share is falling — down 0.44 percentage points in 30 days. Roughly 96,000 domains publish a monitoring-only policy with no reporting address at all: a record that neither blocks spoofing nor tells anyone it is happening. We argue this is a predictable artefact of the 2024–2025 bulk-sender mandates, which made the compliance floor (p=none) the de facto ceiling.
1. The question
Email...
Copyright of this story solely belongs to hackernoon.com. To see the full text click HERE
