How the top 1,000 websites handle email security in 2026: DMARC, SPF, BIMI and who hosts their email

Good question, so we checked. Of the 136 domains on p=none, 20 (about 15%) publish no rua address at all, so their aggregate reports go nowhere. The other 116 do send reports somewhere, though from DNS alone there's no way to tell whether anyone reads them.

Thanks for running that. 20 of 136 with no rua at all is a useful split, and stating that DNS alone cannot show whether the other 116 are read is a fair limit. That second group is where a direct question to the domain owner tells more than another scan.