We read the SPF, DMARC, MTA-STS and BIMI records of all 100 companies on the Forbes Cloud 100, 2025 edition. All 100 publish a DMARC record, and 58 of them use the strictest policy, p=reject. MTA-STS is rare: 7 of 100 publish it, and only 1 enforces it.
p=reject, 37 p=quarantine and 5 p=none.-all (hard fail), 72 in ~all (soft fail) and 1 in ?all (neutral).rua=), most often through Cloudflare (14) and Valimail (14).enforce mode and 6 in testing.No lookup failed: every number below has all 100 companies in it, with no unknowns.
The policy tells receiving mail servers what to do with mail that fails DMARC. none only monitors, quarantine sends it to spam, and reject refuses it.
| DMARC record | Companies | Share |
|---|---|---|
p=reject | 58 | 58% |
p=quarantine | 37 | 37% |
p=none | 5 | 5% |
| No DMARC record | 0 | 0% |
quarantine or reject). Only 5 still monitor with p=none.pct= below 100).quarantine records also sets t=y, which marks the policy as still in testing.sp=) than for the main domain.Still on p=none? Here is how to move from p=none to quarantine and reject safely.
Every one of the 100 publishes exactly one SPF record. None has two, which would break SPF for all their mail. The difference is how strict the record’s last word is:
| SPF ends in | Meaning | Companies |
|---|---|---|
~all | Soft fail: mark mail from other servers as suspicious | 72 |
-all | Hard fail: mail from other servers is not authorized | 27 |
?all | Neutral: no statement about other servers | 1 |
~all is the common choice and is fine once DMARC enforces: under a quarantine or reject policy, DMARC decides what happens to mail that fails. Four records end in a redirect= to another SPF record; we counted the ending of the record they point to.
96 of 100 ask receivers for daily aggregate reports with rua=. These are the services that receive them most often, counted by the domain of the report address. A company that lists two services counts once for each.
| Report service | Companies |
|---|---|
| Cloudflare DMARC Management | 14 |
| Valimail | 14 |
| dmarcian | 13 |
| Postmark DMARC Digests | 9 |
| Validity (Everest) | 8 |
Next come Red Sift OnDMARC (7), Mimecast DMARC Analyzer (6) and EasyDMARC (6). 44 of the 96 list a report address on their own domain, alone or next to a service.
enforce mode, which tells sending servers that support MTA-STS not to deliver without valid TLS, and 6 are in testing, which only reports problems. None of the 7 policy files failed to load. The other 93 have no MTA-STS record. See how to fix “MTA-STS policy missing”.quarantine or reject; see why a BIMI logo isn’t showing.Gmail and Yahoo require bulk senders to publish SPF, DKIM and DMARC, and a DMARC policy of p=none meets that rule. Microsoft has the same rules for Outlook.com. Read what Gmail, Yahoo and Microsoft require from bulk senders. These 100 companies go well past the minimum: 95 of 100 enforce DMARC.
To see where your own domain stands, the free DMARC, SPF and DKIM checker grades one domain in your browser. To check a whole list, Email Security Signals runs the same checks in bulk and returns one row per domain. $0.02 per graded domain; invalid inputs, duplicates, domains that don’t exist (NXDOMAIN) and DNS lookup failures are free.
Grade a list on Apify →https://mta-sts.<domain>/.well-known/mta-sts.txt.