DMARC adoption: what 2026 shows

v=DMARC1; p=none; rua=mailto:dmarc@example.com
v=DMARC1; p=reject; rua=mailto:dmarc@example.com; sp=reject; np=reject

What the barometer series shows, sector by sector

The dmarc.com sector barometers survey entire corpora of domains every month, in the public DNS. Without copying out any month's figures, three relative positions stand out clearly.

Banking leads. The most impersonated sector, the most dependent on trust and the most regulated — DORA sees to that — it combines resources with external pressure. The barometer devoted to French banks treats it as the protocol's test bed: if any sector can reach p=reject across its whole perimeter, it is this one, and its position measures the ceiling of what others can aim for.

Local government lags. The cities and local-authority barometer documents a landscape of small teams, scattered vendors and weak deliverability pressure — a town hall sends little bulk mail, so the Gmail mandates barely constrained it. The paradox is cruel: impersonating a local authority reaches residents directly, on subjects — taxes, civil records, school enrolment — where trust in the sender is at its highest.

Healthcare illustrates the split between criticality and means: mail that genuinely matters — appointments, results, care coordination — IT teams under permanent strain, and an estate of domains that is rarely inventoried. The healthcare sector barometer finds the same head-and-tail profile as the other corpora, shifted downward.

Beyond relative positions, the structural patterns repeat from one sector to the next: a distribution that is never uniform — a head settled at reject for years, a middle that advances in fits and starts, rarely without external pressure, a tail that has not begun; primary domains better kept than secondary brands and subsidiaries; dormant domains forgotten by everyone except fraudsters. A sector's average says little; the shape of its distribution says everything.

The maturity stages of an organization

Mapped onto a single organization, the typical trajectory reads as five stages, and each barometer photographs how a sector distributes across them.

Stage zero: nothing, or an invalid record — one syntax error is enough to strip a policy of any effect. Stage one: p=none published, reports unexploited; this is the minimal-compliance plateau, where a large share of equipped domains sits parked. Stage two: the reports get read and the work begins — source inventory, SPF and DKIM alignment vendor by vendor. Stage three: hardening in steps toward quarantine then reject, now properly tooled by the t=y test mode. Stage four: enforcement covers the full perimeter — subdomains (sp=, np=), secondary brands, dormant domains locked down — with BIMI as an optional finishing marker. Moving from stage one to stage four is a project of a few months for a simple ecosystem, longer for a group; the 2026 compliance checklist walks through every step.

This grid clarifies how the measurements should be read: a sector only genuinely progresses when domains cross stages two and three. A stage one that keeps filling up lifts the presence curve — not the protection.

What DMARCbis changes for 2027

The publication of DMARCbis demands no urgent migration — v=DMARC1 remains backward compatible — but it reshuffles three cards for 2027.

First, policy discovery now follows the DNS Tree Walk: the organizational domain is determined by walking up the DNS tree itself, no longer via the Public Suffix List, that external list the standard had dragged along like a crutch. For groups with deep domain trees, the applicable policy becomes more predictable; the psd= tag accompanies the mechanism.

Second, the pct tag is gone. Gradual ramp-up is now expressed through the t=y test mode, with far more legible effects — pct never truly guaranteed the proportion it promised. Records still carrying a pct= deserve a review as receivers converge on the new text.

Third, the np= tag settles explicitly the fate of non-existent subdomains — a favourite target of technical impersonation, precisely because no legitimate mail ever originates from them. An np=reject ranks among the least risky hardening moves in the protocol. The full walkthrough of DMARCbis details the complete set of changes and what they imply depending on the starting point.

For adoption measurement, the new standard adds observable maturity markers: the presence of an np=, use of the test mode, the gradual disappearance of legacy pct tags. The 2027 surveys will have new columns to track.

Where the measurement lives on

A synthesis has a date; adoption moves every month. That is the point of the DMARC Observatory: monthly editions by sector and by country, surveyed in the public DNS — presence, validity, effective policy, subdomain handling, SPF, DKIM and BIMI signals — with a named ranking and a history. Nothing intrusive in the method: it reads what any resolver sees, because a domain's DMARC posture is a public declaration, verifiable by anyone.

The monthly rhythm delivers what no annual study can. Regressions become visible — a record broken by a DNS migration, a reject demoted back to none after a misdiagnosed deliverability incident. The effect of regulatory deadlines can be watched almost live. And trajectories — who advances, who stalls — matter more than snapshots: a study is a photograph, an observatory is a film.

A cautious projection

What the 2024–2026 dynamic allows to be said, without venturing a single figure, fits in three trend lines.

Record presence will keep climbing: it costs nothing and the mandates pull it mechanically. The curve that deserves attention is the other one — the share of policies actually enforced. Three forces push it: inbox requirements, which tighten ratchet by ratchet, thresholds lowered and exceptions closed; regulation, which gradually turns a prolonged p=none into an audit finding; and tooling, which DMARCbis simplifies. Pulling the other way, the long tail — small structures, dormant domains, local authorities without a dedicated team — will take years to absorb.

The direction is therefore certain; the pace is not. Which is exactly why an honest projection defers to measurement: the real speed reads out in the monthly editions, survey after survey, rather than in forecasts.

In summary

2026 marks a tipping point for DMARC: three forces — the Gmail, Yahoo and then Microsoft mandates, the pressure of NIS2 and DORA, the publication of DMARCbis — compressed into three years an adoption that promised to take ten. But the curve rising fastest is the one counting records, not protections: everywhere, the compliance p=none dominates among equipped domains, and only an enforced policy — quarantine, then reject — closes the door on impersonation. The sector barometers draw sharp gaps, banking ahead, local government and healthcare trailing, with the same structural patterns throughout. DMARCbis sets up 2027: Tree Walk, test mode, np=, the end of pct. The continuous measurement, meanwhile, lives in the Observatory — by sector, by country, month after month.

To place a domain on that same scale, a pass through the online analyzer shows its real position in seconds: presence, validity, effective policy, subdomains. And creating an account opens the logical next step — aggregate reports, source inventory and a staged climb toward p=reject, at whatever pace the sending ecosystem allows.