How 1,939 Y Combinator B2B startups set up DMARC

Scan date: 24 September 2026. DNS records only.

Key findings

902 of 1,939 companies (46.5%) publish no DMARC record (231) or a policy of p=none (671).
109 of the 964 companies that enforce DMARC in full (11.3%) have nowhere for aggregate reports to arrive: no report address at all (108), or an address that cannot receive mail (1).
616 of the 1,687 companies with one readable DMARC record (36.5%) still carry a tag that RFC 9989 lists as removed (pct, rf or ri).

On this page, "enforce DMARC in full" means a policy of quarantine or reject, with no pct below 100.

Why p=none matters

RFC 9989 section 4.7 defines the value none as:

none: The Domain Owner offers no expression of preference.

A record with no p tag counts the same way:

If this tag is not present in an otherwise syntactically valid DMARC Policy Record, then the record is treated as if it included "p=none"

Result	Companies	Share of 1,939
No DMARC record	231	11.9%
p=none, or no p tag	671	34.6%
Quarantine or reject, no pct below 100	964	49.7%
Quarantine or reject, with pct below 100	50	2.6%
More than one DMARC record	17	0.9%
Invalid policy value	1	0.1%
Could not be determined	5	0.3%

Enforcing, but blind

A policy of quarantine or reject is half the job. The reports that show who sends mail as your domain only arrive if you ask for them. RFC 9989 section 4.7, on the rua tag:

If the tag is not provided, Mail Receivers MUST NOT generate aggregate feedback reports for the domain.

The smaller the team, the more often this happens:

Team size	Blind / enforcing in full	Share
1	9 / 36	25.0%
2 to 10	74 / 541	13.7%
11 to 50	19 / 222	8.6%
51 to 200	6 / 103	5.8%
201 and over	0 / 43	0.0%
Not listed	1 / 19	5.3%

Team size is the figure each company lists in the Y Combinator directory.

Tags the new standard removed

RFC 9989 appendix C.5.2, "Tags Removed", lists pct, rf and ri. Its section 9.3 marks all three "historic", meaning:

the tag is considered deprecated and is not expected to be in use in any current implementation

616 of the 1,687 companies with one readable DMARC record still use at least one of them: pct 602, ri 133, rf 36.

Companies with no DMARC record, more than one record, or a failed lookup are not part of this count.

Check your own domain

Our free DMARC checker reads your live record and shows your policy, your report addresses, and the exact record to publish.

How this was measured

The list: Y Combinator's public company directory, retrieved through the open yc-oss/api mirror on 20 September 2026. Included: active companies tagged B2B, in the United States, the United Kingdom or Europe, not headquartered in India. Each website was reduced to its registrable domain. Websites shared by several companies were dropped.
What was queried: DNS only. The DMARC record, the report-address authorisation record defined in RFC 9990 section 4, and each domain's MX and SPF records, to tell a live sender from a parked name. No web requests, no mail sent.
Checks: every domain in a failing result was checked again against a second public resolver, and only results both agreed on were kept; the rest are counted as "could not be determined". The first scan on 20 September was re-run on 24 September. Every result count adds up to 1,939.
Limits: one list, one day, DNS only. Whether any report was ever sent, delivered or read was not measured. Parked domains are not counted as failures. The public suffix list used is dated 1 October 2023.
No company is named on this page, and none will be.

Company list: Y Combinator public directory, via yc-oss/api. Humerly is not affiliated with Y Combinator. If you maintain the source data and have a concern, write to support@humerly.com.