Research, 28 September 2026

1 in 4 US agencies and IT firms publish no DMARC record.

We ran SenderCheck over the domains of 1,362 US marketing agencies and IT firms, the kind of business other companies ask to look after their websites and email. 332 of them (24%) publish no DMARC record, and 818 (60%) don’t ask receivers to block mail that fails it. How we counted is at the bottom of the page.

24%
publish no DMARC record at all
332 of 1,362 domains
60%
don't ask receivers to block mail that fails DMARC
818 of 1,362 domains
11%
have no SPF record, or one that fails outright
152 of 1,362 domains
32%
have at least one problem our checker rates high or critical
435 of 1,362 domains

DMARC: what receivers are told to do with fake mail

DMARC tells Gmail, Outlook and other receivers what to do with mail that uses your domain and fails the checks. Only 544 of 1,362 domains (40%) ask for that mail to be held back, and 230 (17%) ask for it to be rejected outright.

DMARC setting on each domain
What we found	Domains	Share
No DMARC record	332	24.4%
A record receivers can't use (a syntax error, or more than one record)	17	1.2%
p=none: watch only, block nothing	469	34.4%
p=quarantine or p=reject: failing mail is held back	544	39.9%

639 domains (47%) receive no DMARC reports at all: 332 have no record, and 307 publish one that asks for none. Without reports, nobody can see which services send as the domain, which is what you need before blocking anything.

SPF: the list of servers allowed to send

SPF is in better shape, but 152 domains (11%) have none, or have one that fails outright. The last three rows below are permanent errors: receivers stop reading the record, and SPF fails for all of the domain’s mail, genuine or not.

SPF problems found
What we found	Domains	Share
No SPF record	81	5.9%
More than one SPF record	20	1.5%
More than 10 DNS lookups	46	3.4%
A syntax error	6	0.4%

What each problem means for the sender

No DMARC record (24%)
Receivers get no instruction about mail that claims to be from you and fails the checks, so anyone can put your domain in the From line with nothing standing in the way. You also get no reports on who is sending as you. Google, Yahoo and Microsoft require bulk senders to publish at least p=none.
How to fix it
p=none (34%)
A sensible first step, not a fault on its own: the domain is watching before it blocks. It only helps if someone reads the reports and moves on to quarantine or reject once every real sender passes. Left there, fake mail in your name is delivered the same as it would be with no record.
How to fix it
More than one SPF record (1%)
Receivers treat two SPF records as a permanent error, so SPF fails for every message the domain sends, including the legitimate ones. It usually happens when a second service adds its own record instead of joining the existing one.
How to fix it
More than 10 SPF lookups (3%)
SPF allows ten DNS lookups. Past that, the check stops with a permanent error and SPF fails. Each service added to the record costs lookups, so a record that worked last year can tip over when one more tool is connected.
How to fix it

Check your own domain

The same check we ran for this page. Free, no account. You’ll see what’s wrong, what it means, and the exact record to change.

Looking after client domains? SenderCheck for agencies checks every one each hour and emails you when one breaks. And if your domain is on p=none, free sender reports show every service sending as you, so you can tell when it’s safe to block the rest.

How we counted

Who. Businesses in OpenStreetMap tagged as an advertising agency or an IT office, with a website, in 25 states: Arizona, California, Colorado, Florida, Georgia, Illinois, Indiana, Maryland, Massachusetts, Michigan, Minnesota, Missouri, Nevada, New York, North Carolina, Ohio, Oregon, Pennsylvania, South Carolina, Tennessee, Texas, Utah, Virginia, Washington, Wisconsin. Sites on a website builder’s own address (such as wixsite.com) were left out, because their owners don’t control that domain’s DNS. That gave 1,485 domains.

What we left out. 123 domains: 38 that no longer exist, 24 whose DNS didn’t answer in full, 58 that receive no email, and 3 that turned out to share a domain already counted. Every figure on this page is out of the remaining 1,362.

How. One run of SenderCheck’s own checker, the one behind the free check above, on 28 September 2026. It reads public DNS records only and sends no email. Each row is built from what the checker reports, under the same rules as a normal check.

What it can’t tell you. DNS settings, not whether any particular email reached an inbox. DKIM isn’t counted, because a domain’s DKIM keys can only be found if you know their names, and a missing guess proves nothing. OpenStreetMap lists the businesses its contributors have mapped, so this is a large sample, not a census; a few listings are bigger companies rather than small agencies. We name no business and no domain from the scan. See also what we do not claim.