How 254 cold email companies set up DMARC on their own domain

Scan date: 8 November 2026. DNS records only.

Key findings

  • 158 of 254 companies (62.2%) publish no DMARC record (48) or a policy of p=none (110).
  • 13 of the 83 companies that enforce DMARC in full (15.7%) publish no report address, so there is nowhere for aggregate reports to arrive.
  • 68 of the 202 companies with one readable DMARC record (33.7%) still carry a tag that RFC 9989 lists as removed (pct 66, ri 24, rf 7).

On this page, "enforce DMARC in full" means a policy of quarantine or reject, with no pct below 100. It is the same definition as in our scan of Y Combinator B2B startups.

ResultCompaniesShare of 254
No DMARC record4818.9%
p=none, or no p tag11043.3%
Quarantine or reject, no pct below 1008332.7%
Quarantine or reject, with pct below 10093.5%
More than one DMARC record31.2%
Could not be determined10.4%

Why this list is worth a page

These are companies whose product is outbound email. The scan reads their main domain, the one on their website, and nothing else.

Enforcing, but blind

A policy of quarantine or reject is half the job. The reports that show who sends mail as your domain only arrive if you ask for them. RFC 9989 section 4.7, on the rua tag:

If the tag is not provided, Mail Receivers MUST NOT generate aggregate feedback reports for the domain.

13 of the 83 companies that enforce DMARC in full publish no rua tag.

Tags the new standard removed

RFC 9989 appendix C.5.2, "Tags Removed", lists pct, rf and ri. 68 of the 202 companies with one readable DMARC record still use at least one of them: pct 66, ri 24, rf 7.

Companies with no DMARC record, more than one record, or a result we could not determine are not part of this count.

What we did not measure

Some outbound teams send cold email from separate domains, not from their main one. This scan reads the main domain only. It says nothing about how their sending domains are set up, and nothing about where any message lands.

Check your own domain

Our DMARC checker reads your record against live DNS and shows your policy level, your reporting setup, and the exact DNS record to publish if something is missing or weak.

How this was measured

  • The list: 287 company domains from a commercial B2B company database: companies tagged with cold email keywords, headquartered in the United States or the United Kingdom, with 1 to 50 employees, read on 8 November 2026. Each website was reduced to its domain.
  • Excluded: 10 domains that do not exist in DNS, and 23 that publish no MX record, which we treat as not in use for mail. A domain was excluded only when both resolvers below agreed. 254 remain.
  • What was queried: DNS only. The DMARC record, the report authorisation record for report addresses on another domain, and each domain's SPF and MX records. No web requests, no mail sent.
  • Checks: every domain was read twice on 8 November 2026, once through Google Public DNS (8.8.8.8) and once through Quad9 (9.9.9.10). Only results both agreed on were counted; the rest are counted as "could not be determined". Every result count adds up to 254.
  • Limits: one list, one day, DNS only. Main domain only, not sending domains. Whether any report was ever sent, delivered or read was not measured.
  • No company is named on this page, and none will be.

Company list: a commercial B2B company database, read on 8 November 2026. If you have a concern about this page, write to hello@humerly.com.