Sixty-Nine Percent Spoofable: Email Authentication and Transport Security Across the Top One Million Domains

Abstract#

We assessed 1,000,000 domains from the Cloudflare Radar Top 1 Million list against the same email security stack as the July 2026 edition: SPF (RFC 7208), DKIM (RFC 6376), DMARC (RFC 7489), MTA-STS (RFC 8461), TLS-RPT (RFC 8460), DANE (RFC 7672), DNSSEC, and Null MX (RFC 7505). The scan ran on 7 October 2026 in a single window of 1 hour 37 minutes. This is a fresh popularity snapshot, not a remeasurement of the same domains. Every comparison below is a population comparison against the published July figures.

Three months later, the headline barely moved. 69.1% of mail-enabled domains are spoofable, against 70.9% in July. DMARC enforcement rose from 29.0% to 30.8% of mail-enabled domains. Strict SPF rose from 32.3% to 33.9%. Enforced transport protection rose from 1.67% to 1.80%. The full defensive stack is still 0.34% of mail-enabled domains (2,457 now, 2,398 in July).

Most of the enforcement gain is one parked-domain portfolio entering the list. 14,295 mail-enabled domains in this snapshot point their MX at the parking hosts of one domain-parking operator, and 99.9% of them publish an enforcing DMARC policy. Set that portfolio aside and mail-enabled enforcement is 29.4%, against 29.0% in July. The spoofable share without it is 70.5%, against 70.9%. Most of the measured change is parked domains that ship with a reject policy entering the popularity ranking.

The rest of the July picture is intact. SPF is present on 89.5% of mail-enabled domains. DMARC is present on 65.0%, and more than half of those records are still p=none. Of domains with a live discoverable DKIM RSA key, 53.9% still publish a 1024-bit or weaker key, against 55.5% in July. We again found 19 Ed25519 keys in the whole corpus. Provider choice still dominates: Proofpoint customers enforce at 73.0%, Namecheap customers at 1.2%, the same factor of about sixty as in July.

Key findings at a glance#

• 1,000,000 domains assessed on 7 October 2026. 72.4% are mail-enabled, against 70.2% in July.
• 69.1% of mail-enabled domains are spoofable (no DMARC or p=none), against 70.9% in July. 15.1% reach p=reject, against 13.4%.
• Holding out that parked portfolio, enforcement is 29.4% and the spoofable share is 70.5%. July was 29.0% and 70.9%.
• SPF is present on 89.5% of mail-enabled domains. 33.9% publish -all, against 32.3% in July. 411 mail-enabled domains still publish +all.
• DKIM is discoverable on 57.1% of mail-enabled domains, against 58.8%. The absolute count is almost unchanged (413,633 against 412,946). The rate fell mainly because the mail-enabled denominator grew. Part of the gap may come from assessor changes since July (Section 2.2). 53.9% of domains with a live key still expose a 1024-bit or weaker RSA key.
• Transport protection is still under 2%: MTA-STS enforce 0.62%, fully valid DANE 1.26%, either 1.80% of mail-enabled domains. July was 0.64%, 1.11%, and 1.67%.
• 78.9% of all domains score below 40/100. 1,050 domains reach the 90+ band. 427 score 100. July was 79.8%, 1,012, and 428. The all-domain band also moves because domains with no MX changed rubric (Section 2.3).
• The full defensive stack is 2,457 domains, 0.34% of mail-enabled, the same rate as July.
• NIS2 basic cyber hygiene is fully met by 4.1% of applicable mail-enabled domains. The cryptography controls are fully met by 0.08%, unchanged from July.

1. Introduction#

The July 2026 edition measured the joint state of the email security stack across the Cloudflare Radar Top 1 Million and found a wide, shallow deployment: records everywhere, enforcement rare, transport security almost absent, and the outcome predicted by who operates the MX. This edition repeats that measurement on the Radar week of 28 September to 5 October 2026 and reads every result against the July baseline.

The point of a second census is to see whether the numbers move. They mostly do not. Where they do, the move is small, or it is a change in who is popular enough to be on the list.

Our contributions, on top of the July study:

1. A second complete-stack census, 1,000,000 domains, one measurement window, same definitions.
2. A point-by-point comparison with the July edition, using the same aggregator on both evidence files.
3. A composition check: how much of the apparent improvement is one parked-domain portfolio newly prominent in the ranking.
4. Updated provider and TLD tables, including the .de share of the corpus, which grew by three quarters.

The protocol set, the spoofable definition, the transport-protected definition, and the full-stack definition are unchanged. They are restated in Section 2 so this paper can be read on its own.

2. Dataset and methodology#

2.1 Corpus#

We used the Cloudflare Radar Top 1 Million export for the week of 28 September to 5 October 2026. The file is an alphabetical listing. It has no rank column. It contained 1,000,235 data rows plus a header. Two rows were bare labels (web, ws) and failed the assessor's domain-shape gate. That left 1,000,233 valid names. We assessed the first 1,000,000 of those, in file order, and did not assess the last 233 (zzhuangli.com through zzzzzzzzzz.vip). The cut is alphabetical, not by popularity, and it drops 0.023% of the valid export.

The July edition assessed 1,000,050 names from the week of 15 to 22 June 2026, after rejecting four malformed rows from a file of 1,000,054. The two corpora are different popularity snapshots. A domain can enter or leave the top million without changing a single DNS record. Deltas in this paper are not the change in a fixed panel.

The scan ran from 10:19:38Z to 11:56:38Z on 7 October 2026. 6,994 assessments (0.70%) recorded at least one error. 4,942 of those are the 15-second deadline. July used a 25-second deadline and recorded 721 errors (0.07%). Error rows are kept, with whatever partial evidence the assessor had written. 4,799 of the error rows are mail-enabled, and 4,784 of those fall in the spoofable bucket. If every one of those DMARC results were a missed lookup rather than a true absence, the spoofable share would be about 0.7 points lower than we report. We do not know how many were misses. Any such bias makes this edition look slightly worse, not better, and it is smaller than the 1.8 point gap versus July.

2.2 Measurement tool#

All measurements used the SecLens.ONE assessor built from the private tree current on 7 October 2026. The public CLI export at github.com/seclens-one/seclens was last synced on 21 September 2026. Its history starts on 13 July 2026, so the 10 July and 17 August changes below are not separate commits there. The July paper describes the checks. The settings for this run, which differ from July where noted:

• DNS-over-HTTPS against Cloudflare only. July used the same resolver.
• Per-domain timeout 15 seconds. The July edition used 25 seconds.
• Concurrency 256. A trial at 512 and at 1,024 on this host finished fewer domains per second and raised timeouts, so 256 is the rate we kept.
• SPF include and redirect chains, DMARC tag parsing, capped DKIM selector probes, MTA-STS policy fetch with no redirects, TLS-RPT, DANE TLSA at _25._tcp.<mx>, DNSSEC DS and AD bit, and RFC 7505 Null MX, including mixed-MX detection.
• No SMTP connections. The only direct HTTP request is the MTA-STS policy file when the domain advertises one.

The assessor changed after the July scan. On 10 July 2026, DKIM probing added an ENT classifier for the _domainkey subtree and tighter wildcard detection. On 17 August 2026, mail-profile scoring started scaling DMARC points by pct, and DKIM points require a production key (syntax OK, not revoked, not t=y). The SPF score awards its lookup points when the effective lookup count is at most 20. That ceiling is the score's budget. It is not the RFC 7208 evaluation limit of 10 used in Section 3.2. July figures in this paper are the published July values unless marked as recomputed.

One visible consequence sits outside the mail-enabled slice. Corpus-wide DKIM fell from 422,872 domains to 413,702, while the mail-enabled count rose by 687 (412,946 to 413,633). Domains without a real MX account for more than the whole drop (9,926 in July, 69 now). The count of domains whose discovered DKIM keys are all revoked is 490 here and was 4,408 in the July paper. We treat both gaps as assessor effects, not as a change in the internet. Key-size figures come from the decoded modulus and are the DKIM numbers we compare.

2.3 Profiles and scoring#

Scores in this edition use the rubric in Appendix A, which is the public rubric as of the scan (see /methodology/). It differs from the July rubric in DMARC pct scaling, the SPF lookup-budget points, the DKIM production-key rule, and the profile used for domains with no MX. Those domains were scored on the mail rubric in July and are scored on the Null MX rubric now. Score bands and means are therefore not strictly comparable across editions. Protocol-state findings are unaffected. The October records carry three profiles. The July scan predates the no_mx profile. It reached the public CLI export on 14 July 2026 and the assessor used for this edition on 22 July 2026. July folded domains with no MX into the mail profile.

• mail (725,894 domains): every mail-profile check applies. 723,885 are mail-enabled. The other 2,009 are MX lookup failures. A failed lookup is not stored as no_mx.
• no_mx (271,563 domains): no MX published. Scored with the Null MX rubric in Appendix A, not the mail rubric.
• null_mx (2,543 domains): a valid RFC 7505 Null MX. Same rubric as no_mx.

The 0-100 score is a hygiene summary. Headline findings are protocol state, not score.

2.4 Definitions#

Same definitions as July.

• Mail-enabled: at least one non-null MX (723,885 domains, 72.4% of the corpus). July: 702,397, 70.2%.
• Spoofable: mail-enabled, and either no DMARC or p=none. A p=quarantine record with pct=1 still counts as enforcing. Domains whose DMARC record has a non-standard p= value (564 mail-enabled domains) are counted as neither spoofable nor enforcing, as in July. Counting them as spoofable would raise the share to 69.2%.
• Transport-protected: MTA-STS fetched and in enforce, or DANE with every MX covered, valid TLSA, and DNSSEC validation.
• Full stack: SPF -all, DMARC p=reject, discoverable DKIM, and transport-protected.

3. Results#

3.1 Population overview#

The mail-enabled share rose by 2.2 points and the no-MX share fell by the same amount. The mail-enabled count rose by 21,488. The parked portfolio rose from 18 domains in the July evidence to 14,295, which is 14,277 of that increase (66.4%). Section 3.3 takes it back out. No MX found includes 2,009 domains whose MX lookup failed during the scan (Section 2.3). 271,563 domains returned no MX. Null MX adoption did not absorb those domains. 2,543 valid Null MX records are 0.92% of the 276,115 domains with no MX found or a Null MX. July was 0.84%.

Read the DKIM row as a denominator effect. The count of mail-enabled domains with a discoverable key rose by 687. The mail-enabled population rose by 21,488. The rate fell.

3.2 SPF: present on 89.5%, hard fail still the minority#

675,893 domains publish SPF (67.6% of the corpus, 89.5% of mail-enabled). July was 65.4% of the corpus and 89.1% of mail-enabled.

Hard fail gained 1.7 points of publishers. Soft fail is still the majority. Among mail-enabled domains, -all is 33.9% (245,727 / 723,885), against 32.3% in July. Set the parked portfolio aside and -all is 32.6% of the remaining mail-enabled domains (231,433 / 709,590), against 32.3% in July.

411 mail-enabled domains publish +all, against 431 in July. The record still affirmatively authorizes every host on the internet. 16,843 records (2.5% of publishers) exceed the RFC 7208 limit of 10 DNS-querying mechanisms after include and redirect expansion, against 16,316 in July. Those records permerror at the receiver. 14,417 records (2.1%) use redirect=, against 14,161.

3.3 DMARC: enforcement up 1.8 points, mostly one parked portfolio#

497,245 domains publish DMARC (49.7% of the corpus, 65.0% of mail-enabled). July was 47.2% and 63.5%.

p=reject gained share among publishers. p=none is still more than half of all DMARC records. On the mail-enabled population the spoofable share is 69.1%, down 1.8 points from 70.9%.

That 1.8 points does not survive a composition check. This snapshot contains 14,295 mail-enabled domains whose MX hosts are the parking servers of a single domain-parking operator: 12,879 on its numbered parking hosts and 1,416 on its parking master host. Every one of them is delegated to the same pair of nameservers. 14,294 publish v=spf1 a:<parking-host> -all, and 14,285 publish p=reject (99.9%). The July evidence contains 18 such domains. The July rates above are not adjusted for them. On the July mail-enabled base that is under 0.01 points. The parking operator is not a mailbox provider in this table. The row is one parking template.

Remove those 14,295 domains from the mail-enabled denominator and the 14,285 enforced domains from the numerator. Enforcement becomes 208,805 / 709,590 = 29.4%. July was 29.0%. The 10 domains that do not enforce, treated as spoofable, leave a spoofable share of 70.5%, against 70.9% in July. The same hold-out puts p=reject at 13.3% (94,702 / 709,590), against 13.4% in July. Without the portfolio, enforcement and reject rates are within 0.4 points of July.

Secondary weaknesses, among DMARC publishers:

• 12,708 records (2.6%) set pct below 100, against 14,012 (3.0%) in July.
• 16,205 enforcing records set sp=none, against 16,260. Subdomains stay spoofable while the organizational domain is not.
• 913 records fail syntax validation, against 955.
• 60.3% of publishers set rua=, against 63.1% in July. A smaller share of deployments ask for the reports DMARC rollout depends on.
• 600 non-standard p= values (aggregate count), against 632 in July (hand-classified). Appendix B lists the frequent ones from this snapshot.

3.4 DKIM: the weak-key floor moved less than two points#

The July measurement note still applies. Selectors are not enumerable. Counts are a floor, and the key census skews toward providers whose selectors are on the probe list.

We discovered DKIM on 413,633 mail-enabled domains (57.1%) and 413,702 domains corpus-wide. July was 412,946 mail-enabled (58.8%) and 422,872 corpus-wide. The corpus-wide drop is larger than the mail-enabled drop and should be read with the assessor change noted in Section 2.2. The comparison we trust is key size among live RSA keys we could decode.

Per domain, the weakest live RSA key is the floor, because a receiver will accept a signature from any published selector. Denominator: 411,723 domains with at least one decoded live RSA key. July's denominator was 416,879.

1024-bit or weaker, the July headline bucket, is 53.9% of these domains, against 55.5% in July. The July paper's headline of 55.3% counted the 1024-bit class only. Including keys of 512 bits or fewer, the July figure was 55.5%, which is the baseline we use here. 1.6 points in three months, in the direction RFC 8301 asked for in 2018. Ed25519 is still 19 keys. 3,511 domains carry a t=y test flag on at least one discovered key. July reported 3,624.

3.5 Transport security: still the undeployed layer#

MTA-STS enforce is slightly down in rate and in count (4,459 against 4,487 in July). Of domains that advertise MTA-STS, 18.0% serve no fetchable policy, against 17.5% in July. Of fetched policies, 42.7% are testing, against 42.3%. 432 fetched policies do not cover the domain's MX set, against 451.

DANE is the one transport number that moved. Any TLSA rose from 4.23% to 4.81% of mail-enabled domains, and the fully valid state from 1.11% to 1.26%. The conversion rate is unchanged: about 26% of domains with any TLSA reach the fully valid state, because the rest lack DNSSEC. DNSSEC DS at the parent is 68,571 domains (6.9%), against 63,592 (6.4%) in July. 5,602 domains sit under a TLD that does not support DNSSEC delegation, against 5,774.

Combined enforced transport protection gained 0.12 points. It is still under 2%.

3.6 Null MX#

273,572 domains had no MX found, including 2,009 failed lookups, against 295,141 in July. 271,563 returned no MX. 2,543 publish a valid Null MX, against 2,512. All of those records are the RFC 7505 shape the assessor accepts. 21 additional domains mix a null MX with real MX hosts, against 25. Fully compliant Null MX posture (record, strict SPF, DMARC, and DNSSEC where the TLD allows it) is 259 domains, against 279 in July. The fully compliant count fell by 20.

3.7 Composite posture#

The July paper published a mail-enabled median of 25 but no mail-enabled 90th percentile. The all-domain median and 90th percentile are unchanged at 20 and 45. The mail-enabled median is 25, the same as July, and the mail-enabled 90th percentile is 50. The mean rose by 0.7 points corpus-wide (21.24 against 20.55) and 0.3 points on mail-enabled domains (27.87 against 27.54). The all-domain figures also move because 271,563 domains with no MX are now scored on the Null MX rubric instead of the mail rubric. That switch does not affect the mail-enabled column. The mail-enabled means remain subject to the scoring changes in Section 2.2.

427 domains score 100, against 428 in July. The excellent band grew by 38 domains. The full stack, which is stricter than a high score, grew by 59 domains and stayed at 0.34% of mail-enabled domains.

3.8 The provider effect#

DMARC enforcement among mail-enabled domains, grouped by the registrable domain of the MX host. July rates are from the same grouping in the July aggregate.

Microsoft's rate is unchanged at 45.0%. Yandex is unchanged at 15.4%. Namecheap is unchanged at 1.2%. Proofpoint to Namecheap is still a factor of about sixty (73.0 / 1.2), measured on the policies customer domains publish. GoDaddy is the largest move among the July rows, from 17.7% to 22.4%, on a slightly smaller customer count in this snapshot (6,133 against 6,359). Hostinger moved from 3.1% to 3.8%. Both remain far below the security-gateway operators (Proofpoint 73.0%, Mimecast 64.8%, Barracuda 52.2%).

The domain-parking row is not a mailbox provider. Its MX hosts are one operator's parking servers for a portfolio of parked names, so this row is one parking template. We keep it in the figure and the table for scale, marked as parking, and leave it out of the comparison above. It is large enough to explain the global enforcement delta, as Section 3.3 shows. Open-Xchange (hostedemail.com) fell out of this table: 2,443 mail domains at 5.7% enforced, against 3,684 at 4.0% in July. Cloudflare remains the authoritative DNS operator for 36.9% of the corpus, against 37.0% in July.

3.9 TLD concentration#

.com is 44.9% of this corpus, against 48.3% in July. The top of the list moved. .de went from 23,078 domains (2.3%) to 40,373 (4.0%). Mail-enabled .de went from 20,383 to 38,057, and DMARC enforcement inside that slice went from 32.5% to 56.5%. DNSSEC inside .de mail fell from 6.0% to 3.5% because the denominator grew faster than the DS count: 1,218 records in July, 1,336 now.

Outside .de, large TLDs still cluster. .com enforcement moved from 29.2% to 30.0%. .uk is 33.2% against 33.0%. .ru is 20.9% against 20.6%, and still has 0.8% DNSSEC.

.nl is still the DNSSEC outlier, at 48.4% of mail-enabled domains against 51.5% in July, and its DMARC enforcement fell from 44.5% to 38.7% while the .nl count in the corpus rose from 8,182 to 10,487. The Dutch registry effect described in the July paper is still visible. A larger .nl slice of this snapshot enforces less often than the smaller July slice.

The .de jump is the parked portfolio in Section 3.8. 13,932 of those 14,295 domains are .de names (97.5%). The rest are mostly .at (161), .ch (115), and .eu (70). Mail-enabled .de grew by 17,674 domains, from 20,383 to 38,057, and 13,917 of that growth is this portfolio (13,932 .de names now, against 15 in the July evidence). Hold those .de names out and .de enforcement is 31.5% (7,589 / 24,125), against 32.5% in July. .jp fell out of this table on a flat count: 8,331 domains, 16.7% of mail-enabled enforced, against 8,338 and 16.4% in July.

3.10 Policy compliance mapping#

The mapping is the same state machine as the product UI and as the July paper. Met means every applicable check is fully adopted. Partial means some points and not a full pass. Gap means nothing in place. Shares below are of mail-enabled domains for which the row applies. A row that is not applicable is left out of the percentage, which is why the three shares sum to 100% on a base slightly smaller than 723,885. July shares used all 702,397 mail-enabled domains as the base. This edition excludes rows where a control does not apply, so small differences in Met are within the base change.

The July shape is unchanged. Authentication controls are mostly partial. Cryptography and transport controls are a gap for about nine in ten mail-enabled domains. NIS2 Art. 21(2)(h) is fully met by 576 mail-enabled domains. July's paper put that control under 0.1%, and so does this one.

4. Discussion#

Enforcement: 30.8%, 29.4% without the portfolio. Spoofable mail-enabled domains went from 70.9% to 69.1%. Strip out the parked portfolio and the remainder is 70.5%. Strict SPF rose from 32.3% to 33.9%, and p=reject from 13.4% to 15.1%. Set the portfolio aside and strict SPF is 32.6%, against 32.3%, and p=reject is 13.3%, against 13.4%. Those headline gains come from the portfolio.

Ranking composition. The Radar list is a popularity ranking. About 14,000 parked domains with a strict template moved the global enforcement rate by about three and a half times as much as every other change in the quarter combined (1.4 of the 1.8 points). Future editions should publish the global rate and the rate with the largest new portfolio removed, or the comparison will keep crediting the ranking for one parking template.

Transport security is still below 2%. 1.80% enforced coverage, against 1.67% in July. MTA-STS enforce ticked down. DANE's fully valid state ticked up and is still about one domain in eighty. The failure modes are the July failure modes: policies that do not fetch, testing left on, MX patterns that miss the live hosts, TLSA without DNSSEC.

DKIM key size: 53.9% of domains with a live RSA key are at 1024 bits or fewer. The share of domains whose weakest live key is 1024-bit or smaller fell from 55.5% to 53.9%, more than eight years after RFC 8301 told signers to move. Two snapshots of different populations do not make a trend, so we do not project a date. Nothing in deliverability forces the rotation. Ed25519 remains 19 keys, the same count as July.

Misconfiguration counts are close to July. SPF over the lookup limit: 16,843 against 16,316. Dead DMARC syntax: 913 against 955. Non-standard p= values: 600 (aggregate count), against 632 in July (hand-classified). MTA-STS advertisers with no fetchable policy: about 18%, against 17.5%. Operators are still shipping records that evaluate as if they had published nothing.

5. Implications for security teams#

The October numbers add two checks: look for portfolio effects before crediting a program, and read the .de rate without the parked portfolio.

• Treat 69.1% as the current base rate, and remember it was 70.9% in July. A counterparty domain is still spoofable until its DMARC policy says otherwise. A 1.8-point change does not justify relaxing any control.
• When a portfolio or a country slice improves sharply, check whether a single registrant, parking service, or MX operator explains the move before crediting a program. The .de enforcement rate in this snapshot is 56.5%, against 32.5% in July, and one parked portfolio at 99.9% is large enough to produce a move of that size. Hold the .de names in that portfolio out and the .de rate is 31.5%.
• p=none is still not a control. It is 51.2% of DMARC publishers, against 52.8% in July.
• A live DKIM key of 1024 bits or fewer is still the floor for 53.9% of domains with a decodable live RSA key. Questionnaires that stop at "DKIM: yes" miss it.
• Enforced transport is 1.80%. Mail to an arbitrary domain is still downgradeable. Sensitive content needs protection above SMTP.
• Parked and brand domains without Null MX, v=spf1 -all, and a reject DMARC can still be spoofed. There are 273,572 domains in this corpus with no MX found (including 2,009 failed lookups), and 2,543 Null MX records.
• The compliance sentence is unchanged. "We are in the 88% gap for NIS2 Art. 21(2)(h)" was true in July. The gap in this edition is 87.6%.

6. Limitations#

• Not a panel. July and October are different Radar weeks. A delta is a change in two populations. Section 3.3 is the correction we can make without paired domains. It is not a substitute for following the same names.
• Alphabetical cap. 233 valid names at the end of the alphabet were not assessed, so the input would be exactly 1,000,000. That is 0.023% of the valid export.
• Shorter timeout, more errors. 15 seconds and a 0.70% error rate, against 25 seconds and 0.07% in July. Partial rows can understate protection.
• DKIM floor, and a changed parser. Selector discovery is a lower bound, as in July. The all-revoked count and the corpus-wide DKIM count are not comparable across the assessor changes of 10 July and 17 August 2026 (Section 2.2). Key-size shares are the DKIM comparison we stand behind.
• Mail-enabled is not mail-sending. A domain counts as mail-enabled if it has any non-null MX, including a parking MX. The parked portfolio is mail-enabled by this definition. Its MX hosts are parking servers, and this measurement does not show those domains sending mail.
• Single resolver, one window. Cloudflare DoH only, one vantage point. Split-horizon DNS and transient failures are inside the results.
• Published policy, not receiver behavior. We do not send mail. A p=reject that receivers ignore is outside the measurement. So is TLS that a server enforces without advertising MTA-STS or DANE.
• Corpus bias. Radar ranks domains that resolvers see. The long tail of registered domains is not this population.
• Provider grouping. The MX operator is a registrable-domain approximation. It merges some products and splits some brands. co.uk and com.br rows in the raw aggregate are grouping artifacts and are left out of the table in Section 3.8. We measure the policies customer domains publish. We do not observe each provider's onboarding defaults. The .de join in Section 3.9 is a count for the parked portfolio, not a general MX-by-TLD table.

7. Recommendations#

For domain owners, the July order of work is unchanged:

1. Move DMARC from p=none to p=quarantine, then p=reject, with rua= on the whole way. Half of publishers are still on the first step, and fewer of them request reports than in July.
2. Publish Null MX, v=spf1 -all, and a reject DMARC on domains that do not send mail. This corpus has 271,563 domains that returned no MX, plus 2,009 whose MX lookup failed.
3. Rotate DKIM to 2048-bit and remove the older selector. The weakest published key is the key that matters. 53.9% of domains with a live key have not done this.
4. Repair SPF chains over 10 lookups and DMARC records that fail to parse. They read as deployed and evaluate as absent.
5. Where DNSSEC already exists, finish DANE. Where it does not, MTA-STS in testing with TLS-RPT is the path that produces the telemetry for enforce. The enforced share is 0.62%.

For providers, the recommendation is the same sentence as July. Make enforcement the default. A parking template that writes p=reject on parked names shows how cheap a strict default is. Hosting bundles that already write the MX and the SPF record can write p=quarantine in the same transaction. This quarter's broad change without the portfolio was 0.4 points of enforcement. One hosting default can move more than that. Microsoft's rate is unchanged at 45.0% across both snapshots.

8. Conclusion#

From July to October 2026, the top million domains got 1.8 points less spoofable, and about 1.4 of those points are one parked-domain portfolio. Strict SPF rose from 32.3% to 33.9%, and p=reject from 13.4% to 15.1%. Set that portfolio aside and those rates are 32.6% and 13.3%, against 32.3% and 13.4% in July. Fully valid DANE rose from 1.11% to 1.26%. MTA-STS enforce did not improve. The full stack is still one mail-enabled domain in three hundred. Weak DKIM keys are still the majority of domains with a decodable live RSA key. As in July, records are widely published but rarely enforced, and enforcement rates depend on the mail provider. This edition adds only that a single parking template, newly weighted by the popularity list, can look like a global trend if the comparison does not take it out.

9. Reproducibility and data availability#

The measurement uses a Cloudflare Radar Top 1 Million snapshot, the SecLens.ONE assessor, DNS-over-HTTPS to Cloudflare, a 15-second per-domain timeout, and concurrency 256. This pass ran from 10:19:38Z to 11:56:38Z on 7 October 2026 and wrote 1,000,000 JSON evidence records (about 4.5 GB JSONL).

The July edition is the baseline: Radar week of 15 to 22 June 2026, assessed at the beginning of July 2026, 1,000,050 records, 25-second timeout, as published in the July 2026 edition. Both aggregates are deterministic single-pass computations. The compliance mapping is the same state logic as the public report UI.

The evidence and the aggregate statistics are retained by the authors and are available on reasonable request for research verification. We expect to repeat the measurement on later Radar snapshots. Comparisons should keep the portfolio check in Section 3.3, or an equivalent one, so a change in the ranking is not reported as a change in practice.

10. Ethical considerations#

This is the same passive measurement as the July edition. The assessor opens no SMTP connection, sends no mail, and scans no ports. It issues DNS queries through a public recursive resolver and, where a domain advertises MTA-STS, fetches the policy file from the well-known HTTPS path in RFC 8461. Per-domain load is a bounded set of DNS lookups and at most one small HTTPS request, once, in the window above. The dataset is domain names from a public ranking plus the DNS records and policies those domains publish. Those records can contain contact addresses that domain owners publish in DNS, such as DMARC reporting addresses. We do not publish the per-domain evidence. We share it on reasonable request for research verification. We treat the measurement as within the norms for passive internet measurement described in the Menlo Report.

References#

1. RFC 7208, Sender Policy Framework (SPF), 2014.
2. RFC 6376, DomainKeys Identified Mail (DKIM) Signatures, 2011.
3. RFC 7489, Domain-based Message Authentication, Reporting, and Conformance (DMARC), 2015.
4. RFC 7505, A "Null MX" Resource Record for Domains That Accept No Mail, 2015.
5. RFC 7672, SMTP Security via Opportunistic DANE TLS, 2015.
6. RFC 8301, Cryptographic Algorithm and Key Usage Update to DKIM, 2018.
7. RFC 8460, SMTP TLS Reporting, 2018.
8. RFC 8461, SMTP MTA Strict Transport Security (MTA-STS), 2018.
9. RFC 8463, A New Cryptographic Signature Method for DKIM (Ed25519-SHA256), 2018.
10. RFC 4033, RFC 4034, RFC 4035, and RFC 9364, DNS Security, 2005 and 2023.
11. Cloudflare Radar, Top 1 Million Domains dataset. Weeks of 15 to 22 June 2026 (July edition) and 28 September to 5 October 2026 (this edition).
12. Directive (EU) 2022/2555 (NIS2), Art. 21(2)(g) and Art. 21(2)(h).
13. ISO/IEC 27001:2022, Annex A controls 5.14, 8.16, and 8.24.
14. CIS Critical Security Controls v8, Safeguards 3.10 and 9.5.
15. BSI IT-Grundschutz-Kompendium, Baustein APP.5.3.
16. SecLens.ONE, the assessor used for both editions. July 2026 edition.
17. The Menlo Report: Ethical Principles Guiding Information and Communication Technology Research, U.S. Department of Homeland Security, 2012.

Appendix A: Scoring rubric#

The scores in this edition were produced by the assessor current on 7 October 2026. This is the public rubric on /methodology/. It is not the July rubric. July awarded DMARC points from p= alone, SPF lookup points for a count "within the limit," and DKIM points for any discovered selector that was not a wildcard. This edition scales DMARC points by pct, awards the SPF lookup points when the effective lookup count is at most 20, and awards DKIM points only for a production key.

Mail profile (max 100):

Null MX profile (max 100): Null MX record 25, strict SPF 25, DMARC 35, DNSSEC 15. Weights are redistributed when the TLD does not support DNSSEC. Domains with profile no_mx use this rubric too. A domain with no MX does not earn the Null MX record points, so the ceiling is 75 when DNSSEC applies and 70 when it does not.

Appendix B: Non-standard DMARC p= values (600 records)#

The July edition classified 632 non-standard p= values by hand. This edition's aggregate counts 600 records whose stored policy is outside none, quarantine, and reject, across 124 distinct strings, plus 913 records that fail syntax validation. The frequent strings, counted from the October evidence:

The long tail is singletons: ignore, pass, rejectv, an email address used as the policy, and further rua= values glued on because the semicolon was missing. Every one of these evaluates as no enforcement. The missing-semicolon rows are the same failure the July appendix called the most regrettable. The operator picked a real policy and lost it to one character.

October figures come from the 7 October 2026 assessment of 1,000,000 domains. July figures are the published July 2026 edition, recomputed where a point-change needed the same aggregator. No external statistics are cited.