Published Is Not Protected

A published DMARC record reads, to most procurement checklists, as a solved problem. The domain has a policy. The box is ticked.

Publishing a policy and enforcing one are separate acts, and the distance between them is where most email-capable domains currently sit.

The Finding

Research published by HackerNoon in July 2026, under the title Two-Thirds of the Top Million Domains Can Still Be Spoofed, measured DNS records across the million most-trafficked domains and isolated the subset actually configured to receive mail.

Roughly 444,000 domains, by that measurement, have nothing standing between an attacker and a forged sender header.

Adoption And Enforcement Are Different Curves

The figure is not measuring whether domains have heard of DMARC. Adoption is considerably higher than enforcement, and the two are routinely reported as though they were the same thing.

Of the domains in that survey that do publish a DMARC record, HackerNoon reports fewer than half enforce it — the policy set to quarantine or reject rather than left in monitor-only mode.

Monitor mode exists for a reason. It is the correct first step, and it is where a careful rollout begins. The problem is that it is also where a great many rollouts end — the record goes up, the reports arrive, nobody moves to enforcement, and the domain sits indefinitely in a state that looks configured and behaves as though it isn’t.

A subset of these are stranger still. HackerNoon counts roughly 96,000 domains publishing a record that neither enforces a policy nor requests reports — monitor mode with no monitoring. Those domains have completed a configuration step that accomplishes nothing at all, and nothing about the record itself says so.

Why This Is Invisible

Nothing about a monitor-mode record signals incompleteness from the inside. The DNS lookup succeeds. Vendor dashboards show a policy present. An auditor checking whether DMARC exists gets a yes.

The only way to see the difference is to read what the policy actually instructs receiving systems to do, and that is a different question from whether a policy is there.

This is the same shape as most domain-level trust failures. The configuration is present, the check passes, and the protection is absent — not because anyone chose that, but because the intermediate state is comfortable and nothing forces the next step.

What This Does Not Establish

The measurement covers the top million domains by traffic. It says nothing about the long tail, which is larger and has no reason to be better configured.

It is also a snapshot. HackerNoon reports enforcement declining slightly over the preceding month, which suggests the figure moves, and a number that moves is a number worth re-checking rather than citing indefinitely.

And enforcement is not the same as correctness. A domain can enforce a policy that fails legitimate mail, which is its own problem and not one this measurement addresses.

What It Means

Email authentication is the cheapest trust signal a domain owner controls. It requires no content, no authority, no relationship with anyone — only that someone finish the configuration.

Two-thirds of well-trafficked, email-capable domains have not. These are not obscure sites. They are the most-visited million on the internet, and the majority of the ones that handle mail can still be impersonated by anyone who cares to.

The gap is not knowledge. Every one of these organizations has heard of DMARC, and many have published a record. The gap is between having done something and having finished it — and nothing in the ordinary operating picture distinguishes the two.

Source: HackerNoon, Two-Thirds of the Top Million Domains Can Still Be Spoofed, July 17, 2026.