By Adam & the FaultyPacket Internet Mail Security Observatory (28 Oct 2026). Live rolling Observatory total: 3,678,611+ audited domains (vendor table below sampled at N = 2,650,611 audited domains).
rua=) to an external collector.p=none (monitor only, no spoofing blocked).Method note: DNS shows where rua= reports are routed, not whether a domain pays or which plan it uses. The customer, not the vendor, sets the DMARC policy. Some domains stay on p=none deliberately during rollout.
| Collector | Domains routing rua= | On p=none | On p=reject |
|---|---|---|---|
Valimail (vali.email) | 21,109 | 12,451 (59.0%) | 4,933 (23.4%) |
MxToolBox (mxtoolbox.dmarc-report.com) | 3,083 | 1,826 (59.2%) | 510 (16.5%) |
| DMARCly | 1,719 | 603 (35.1%) | 539 (31.4%) |
| URIports | 3,376 | 1,082 (32.0%) | 1,183 (35.0%) |
| Mimecast DMARC Analyzer | 6,074 | 1,813 (29.8%) | 3,102 (51.1%) |
| dmarcian | 5,899 | 1,593 (27.0%) | 3,243 (55.0%) |
EasyDMARC (rua.easydmarc.eu) | 2,781 | 611 (22.0%) | 1,515 (54.5%) |
| PowerDMARC | 3,106 | 581 (18.7%) | 1,561 (50.3%) |
| Proofpoint | 7,929 | 1,353 (17.1%) | 6,065 (76.5%) |
| Red Sift OnDMARC | 2,469 | 403 (16.3%) | 1,855 (75.1%) |
| Collector | Domains | Policy share |
|---|---|---|
Brevo (dmarc.brevo.com) | 60,241 | 92.8% p=none |
Cloudflare (dmarc-reports.cloudflare.net) | 19,372 | 59.5% p=none |
| UK NCSC Mail Check | 2,324 | 17.8% p=none |
Simply.com (robot.simply.com) | 4,369 | 99.9% p=reject |
That's true, and continuous monitoring is valuable if your senders change often. But watching and fixing are different jobs: between 16% and 59% of domains routing reports to the dedicated platforms above are still on p=none, and almost none have MTA-STS. Our packs cover the fix itself. You can re-scan for free whenever you like, and a subscription is worth keeping if you need the ongoing service.
As a rollout stage, yes. A snapshot can't show how long a domain has been on p=none, so we don't claim to know intent. Our packs give a staged p=none → pct-limited p=quarantine → p=reject route for domains that want to move forward.
Never point rua= at a person's inbox. Use a dedicated alias such as dmarc-rua@yourdomain with an archive rule, and parse the reports locally when you audit. For very high-volume senders, a hosted service may honestly suit better.
Agreed. It is not an automatic breach, and we never say it is. It's a governance item for your DPO (Art. 28 processor terms, Chapter V transfers) that doesn't come up when rua= stays first-party.
£5 Quick-Fix / £24 DMARC Pack£39 Complete 4-Pack BundleFree MSP 100-Domain Toolkit
We report public DNS observations and don't rank vendor quality. Any vendor listed can send corrections or context to [email protected], and we'll publish fair responses.
© 2026 FaultyPacket · Data: FaultyPacket Internet Mail Security Observatory, public DNS snapshot 28 Oct 2026.