← All insights · Thu, 02 Jul 2026

Who actually enforces DMARC? Reject rates by email provider

Enforcement isn't uniform, where a domain is hosted predicts whether it's protected.

DMARC enforcement isn't spread evenly, it tracks who hosts the mail. Share of each provider's domains that reach p=reject (and SPF -all):

Other / self-hosted, 18.6% on p=reject, 42% on SPF -all
Google Workspace / Gmail, 26.8% on p=reject, 25.8% on SPF -all
Microsoft 365 / Outlook, 31.2% on p=reject, 60.9% on SPF -all
Proofpoint, 61.7% on p=reject, 44% on SPF -all
Mimecast, 35.8% on p=reject, 41.9% on SPF -all
Tencent QQ, 2.5% on p=reject, 6.3% on SPF -all
Namecheap, 1% on p=reject, 1.4% on SPF -all

Proofpoint leads on enforcement (61.7% reject). Managed security gateways pull their customers toward strict policy by default, while self-hosted / other lags (18.6% reject), enforcement is a config someone has to choose, and manageds choose it for you. The practical read: the reputation and policy of an address depends heavily on its provider, which is exactly why testing against the real receiving server beats guessing from the domain alone.

Free deliverability tools → Check any domain (MX, SPF, DMARC), test your own inbox placement scored out of 100, generate SPF and DMARC records, or run a blocklist check, all free with no signup and nothing stored, at deliverability.mailtester.ninja/tools.

Verify a real address → This is aggregate DNS data. To check whether a specific email address exists and is deliverable, use MailTester Ninja , real-time, nothing stored.

Data: MailTester Ninja Email Infrastructure Index, 50,000 domains, snapshot Thu, 16 Jul 2026 04:18:23 GMT. Reuse freely under CC BY 4.0.

FAQ

Which email provider enforces DMARC the most?

In this sample, Proofpoint has the highest p=reject rate at 61.7% of its hosted domains.

Data · Email checker · Email verifier · Blocklist checker · Blocklists explained · Widget

Built & updated automatically by MailTester Ninja, the email verifier that stores nothing. DNS-only, aggregate data, no personal information. · JSON API · RSS