SPF, DMARC, MTA-STS and DNSSEC at 51 Mailbox Providers (2026 DNS Study)

Every one of the 51 big consumer mailbox providers we looked at publishes an SPF record and a DMARC record, but enforcement is thinner than the headline suggests. On 23 October 2026 we read the public DNS of all 51: 12 published DMARC p=reject, 19 published p=quarantine and 20 (39%) still published p=none, which only asks receivers to send reports. That includes gmail.com and all four of Microsoft's consumer domains. MTA-STS, which forces encrypted delivery, was published by 18 of 51 (35%), and 11 (22%) were signed with DNSSEC.

This is the second data study in our mailbox-provider series. The first one asked the same 51 providers whether a made-up address exists. This one uses only public DNS, no mail connections at all, and joins the two so you can see whether strong authentication says anything about how a provider answers a verifier. It does not. It then adds a different question from our disposable domains study: which mail servers do disposable domains actually run on?

Method

We queried public DNS for each of the 51 domains from the first study and recorded what the domains publish. No mail server was contacted and no email was sent.

• Records read. For each domain: the SPF record (v=spf1) and its closing mechanism, the DMARC record at _dmarc.<domain> with its policy (p=) and whether it names a reporting address (rua=), an MTA-STS record at _mta-sts.<domain>, a TLS-RPT record at _smtp._tls.<domain>, a BIMI record at default._bimi.<domain>, a DS record at the domain (the sign that DNSSEC is switched on), and the number of MX records.
• Resolvers. Cloudflare (1.1.1.1), Google (8.8.8.8) and Quad9 (9.9.9.9), with up to three attempts per query. All 357 queries returned a definite answer, with no lookup left unresolved.
• When. 23 October 2026, UTC. The CSV has the time on every row.
• Domains. The same 51 consumer mailbox domains as the mailbox provider study, chosen for size and geographic spread. They are not a random sample of all mail providers.
• Disposable section. The disposable figures reuse the MX lookups from our 8,740-domain disposable study, taken on 2 October 2026. We grouped each live domain's primary MX host by the provider that operates it. Nothing new was looked up for that section.

Results: what 51 providers publish

Record	Providers publishing it	Share of 51
SPF	51	100%
DMARC	51	100%
DMARC reporting address (rua)	45	88%
TLS-RPT	19	37%
MTA-STS	18	35%
DNSSEC (DS record)	11	22%
BIMI	8	16%

DMARC policy	Providers	Share of 51
p=reject	12	24%
p=quarantine	19	37%
p=none	20	39%

The two biggest consumer brands are in the weakest column. gmail.com publishes p=none with sp=quarantine for subdomains. outlook.com, hotmail.com, live.com and msn.com all publish p=none. Both pair it with reporting, so they are collecting data, but a p=none policy does not tell receivers to reject spoofed mail from those domains. The p=reject list is Yahoo, ymail.com, AOL, Zoho, Mail.ru, La Poste, SFR, Comcast, sbcglobal.net, BT, Sky and Bigpond.

SPF endings

SPF records end with a mechanism that says what to do with senders not listed. Of the 51: 14 use -all (hard fail), 22 use ~all (soft fail), 2 use ?all (neutral: seznam.cz and cox.net) and 13 do not end in a plain all because they delegate to another domain with redirect=, including gmail.com. None publishes the permissive +all.

Transport security

MTA-STS and DNSSEC are the records that protect mail in transit and the domain's own DNS answers. Only seven domains had MTA-STS, DNSSEC and an enforcing DMARC policy at once: proton.me, protonmail.com, tuta.com, gmx.com, web.de, mail.com and comcast.net. Eleven had DNSSEC: outlook.com, live.com, the two Proton domains, Tuta, GMX (gmx.com and gmx.de), Web.de, mail.com, seznam.cz and comcast.net. BIMI, the record that lets a brand logo show in the inbox, appeared on 8 domains: icloud.com, me.com, the two Proton domains, sfr.fr, libero.it, sky.com and rediffmail.com.

Does strong authentication predict an honest mailbox check?

We joined the DNS results to how each provider answered a made-up address in the first study.

How the provider answered our mailbox check	Providers	DMARC p=reject	DMARC enforcing (reject or quarantine)	MTA-STS	DNSSEC
Said the mailbox does not exist	27	4	16	8	4
Accepted every address	10	6	7	2	0
Refused our check	7	2	6	5	5
Not probed (Microsoft, Apple)	6	0	2	3	2
Deferred our check	1	0	0	0	0

Strict authentication and honest mailbox answers are different things. The providers that accept every address are the most likely to publish p=reject (6 of 10), and none has DNSSEC. But look at why: eight of those ten domains (yahoo.com, ymail.com, aol.com, att.net, sbcglobal.net, cox.net, sky.com, rogers.com) have mail hosted by Yahoo, so their settings follow one provider's choices. Take Yahoo's family out and the pattern disappears into two domains. We would not draw a trend from this, only the plain conclusion that a provider's DMARC policy tells you nothing about whether its server will confirm a mailbox. For that you have to ask the server, which is what a mailbox check does.

What does matter for your own deliverability is the authentication on your sending domain. See SPF, DKIM and DMARC for cold email for what to publish on your own domain, and check any domain with the free DMARC checker.

Where disposable email is hosted

Disposable domains rarely run on the big providers' servers. Of the 8,740 domains on our disposable list on 2 October 2026, 5,805 had live mail servers with a named primary host. We grouped those hosts:

Mail host	Disposable domains	Share of 5,805
Cloudflare Email Routing	280	4.8%
Google (Gmail and Workspace)	88	1.5%
Namecheap (PrivateEmail)	50	0.9%
Microsoft 365	17	0.3%
Zoho	13	0.2%
Yandex	10	0.2%
Proton	9	0.2%
ImprovMX	6	0.1%
Forward Email	3	0.1%
Mail.ru and Mimecast or Proofpoint	2	under 0.1%
Everything else: own or small hosts	5,327	91.8%

Fewer than one in 40 live disposable domains uses a major mailbox provider. Google, Microsoft, Zoho, Yandex, Proton and Mail.ru together host 138 (2.4%). Most of the rest run on a small number of dedicated throwaway servers: the single largest host name alone serves 478 domains. Two things follow for signup forms:

1. Provider-level blocking does not work. You cannot block disposable email by blocking Gmail or Microsoft hosts, because those are where real customers are. The 88 disposable domains on Google are mixed in with millions of real Workspace domains.
2. Host-based detection works, but only against the shared throwaway servers. If a domain's MX is a known throwaway server, that is a strong signal. For the 4.8% on Cloudflare Email Routing and the few on forwarding services, the host says nothing, so you need a list of the domains themselves. Our disposable email checker combines both, and how to block disposable emails at signup shows the setup.

What this means for your list

1. A domain's DMARC policy is not a quality signal for its recipients. Gmail's p=none does not make gmail.com addresses riskier. The recipient-side check is whether the mailbox exists, and Gmail answers that honestly; see the first study.
2. Publish an enforcing DMARC policy on your own sending domain. Almost two thirds of the big providers do, and mailbox providers increasingly expect it. Start at p=quarantine once your reports are clean.
3. Do not use the mail host as your only disposable check. 92% of live disposable domains sit on their own servers. Use a maintained list plus an MX check.
4. Still verify mailboxes before sending. Authentication keeps your mail from being spoofed; it does not remove addresses that bounce.

Limitations

• One day, three resolvers. DNS records change. The measurement date is in every CSV row.
• Consumer domains only. 51 domains chosen for size and spread, not a random sample, so the shares describe this list, not all mail providers.
• Presence is not correctness. We recorded that a record exists and its policy, not whether it is configured well. An MTA-STS record can sit in testing mode, and a p=reject policy can be undermined by a loose SPF record.
• A DS record is a proxy for DNSSEC. It shows the domain is signed, not that every resolver validates it.
• DNS only for the provider table. The "accepted every address" column comes from the earlier study; this study connected to no mail server.
• Disposable data is from 2 October 2026. Hosting groups are based on the primary MX host's domain name, so a small number of domains could be misgrouped where a host sits behind a rebranded name.

Check your own list

Upload a CSV on the verify page: the first 100 email checks are free with a Google sign-in, no card. Every address comes back valid, risky or invalid with the reason, and risky is kept for anything a provider will not confirm. See bulk email verification and pricing; developers can use the API or the MCP server.

Full results

Raw data: download the provider DNS dataset as CSV and the disposable mail host shares as CSV. Both are free to reuse with a link back to this page.