69.1% of mail-enabled domains in the Top 1M can be spoofed.

SecLens.ONE checks SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DANE and DNSSEC for one domain, scores it from 0 to 100 and gives you the DNS records that close each gap.

Source: SecLens.ONE Top-1M study, October 2026 (measured 7 October 2026). n = 723,885 mail-enabled domains.

Free. No account required.

Published and enforced, October 2026

SPF published89.5%
SPF enforced (-all)33.9%
DMARC published65.0%
DMARC enforced30.8%
MTA-STS enforce0.62%

Grey bars are published. Blue bars are enforced. Source: SecLens.ONE Top-1M study, October 2026. n = 723,885 mail-enabled domains.

Global Pulse

Live results from domains people assessed on SecLens.ONE.

Global Pulse

vs Top-1M study, Oct 2026

Average score

Mean score of the domains in the Pulse.

/ 100

Adoption radar

Seven protocols. Dashed: record published. Filled: configured to protect.

Published Effective

Adoption by protocol

Baseline: Top-1M study, Oct 2026

Published is present in DNS. Effective is configured to protect (for SPF: enforced, the record ends in -all). The dashed marker is the Top-1M study: its effective share of mail-enabled domains, or its published share where the study reports no effective share (a different sample).

Pulse (live) Top 1M study

SPF

… published… enforcedTop 1M 89.5% / 33.9%

DMARC

… published… effectiveTop 1M 65.0% / 30.8%

DKIM

… published… effectiveTop 1M 57.1% published

MTA-STS

… published… effectiveTop 1M 1.36% / 0.62%

DNSSEC

… published… effectiveTop 1M 6.9% published

DANE

… published… effectiveTop 1M 4.81% / 1.26%

TLS-RPT

… published… effectiveTop 1M 1.59% published

Last assessed domains

Most recent assessments, newest first.

Assess a domain

What the Top-1M study measured

15.1%

of mail-enabled domains enforce DMARC with p=reject

0.62%

of mail-enabled domains enforce MTA-STS

27.9

mean score of mail-enabled domains, out of 100

Source: SecLens.ONE Top-1M study, October 2026. n = 723,885 mail-enabled domains. Read the study.

How the score is calculated

Seven protocols, 100 points. Domains without mail are scored on a separate Null MX profile.

Methodology Source on GitHub

Core protection · 60 pts

DMARC

SPF

MTA-STS

Plus transport & integrity · 40 pts

DKIM

DNSSEC

DANE

TLS-RPT

Excellent 90-100 Good 70-89 Fair 40-69 Poor under 40

Each gap comes with the record that fixes it

The remediation pack lists the DNS records and policy files for your domain, in the order that gains the most points.

Each failed check names the DNS record: the host, the type, and the value.

Policy files, including MTA-STS, are generated for the assessed domain.

DMARC moves in three steps: none, then quarantine, then reject.

TXT _dmarc.example.comStep 1 of 3

v=DMARC1; p=none; rua=mailto:dmarc@example.com

File .well-known/mta-sts.txt

version: STSv1
mode: testing

Sources

We do not invent testimonials.

Top-1M study, October 2026
1,000,000 domains measured on 7 October 2026 in one window of 1 hour 37 minutes.
Assessments on SecLens.ONE
Domains assessed by visitors. The count is on the pulse above.
Scoring methodology
Every check and weight is documented.
Source code on GitHub
Assessment engine and scoring.