---
title: "Discussion on \"How the top 1,000 websites handle email security in 2026: DMARC, SPF, BIMI and who hosts their email\" | Hashnode"
description: "Discussion on \"How the top 1,000 websites handle email security in 2026: DMARC, SPF, BIMI and who hosts their email\". We checked the DNS of the 1,000 most popular websites. 85% publish DMARC, 47% reject spoofed mail, 21% show a BIMI logo, and Google hosts over a..."
url: "https://hashnode.com/posts/how-the-top-1-000-websites-handle-email-security-in-2026-dmarc-spf-bimi-and-who-hosts-their-email/6ad2185942178b8605b89856"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [How the top 1,000 websites handle email security in 2026: DMARC, SPF, BIMI and who hosts their email](https://locaihost.hashnode.dev/how-the-top-1-000-websites-handle-email-security-in-2026-dmarc-spf-bimi-and-who-hosts-their-email?utm_source=hashnode&utm_medium=feed)

We checked the DNS of the 1,000 most popular websites. 85% publish DMARC, 47% reject spoofed mail, 21% show a BIMI logo, and Google hosts over a...

Oct 16 · 10 min read · locaihost.hashnode.dev  
Read the article

-   [#security](https://hashnode.com/tag/security)
-   [#email](https://hashnode.com/tag/email)
-   [#dns](https://hashnode.com/tag/dns)
-   [#data](https://hashnode.com/tag/data)

## Written by

[locaihost data](https://hashnode.com/@locaihostdata)

@locaihostdata

  
[View profile](https://hashnode.com/@locaihostdata)

Licence-clean data feeds: H-1B sponsors, jobs, SEC, domains.

We turn official open data into clean feeds you can call from code or an AI agent: H-1B and UK visa sponsors, careers-page jobs, SEC filings, domain intel, PDF to Markdown for RAG. Not a typo: locaihost, with an i. https://locaihost.org

## Responses 3

Markdown supported · ⌘↵ to post

[StackShortlist](https://hashnode.com/@veristria)

[Oct 16](https://hashnode.com/posts/how-the-top-1-000-websites-handle-email-security-in-2026-dmarc-spf-bimi-and-who-hosts-their-email/6ad2185942178b8605b89856/comment/6ad29f0963ec362f1d8a64db)

The 13.6% sitting on p=none is the number I would chase, since many of those likely moved there for the 2024 Google and Yahoo rule and never looked at the rua reports again. Would be interesting to see how many of the p=none domains also have no rua address at all, which means nobody is even monitoring.

[locaihost data](https://hashnode.com/@locaihostdata)

[Oct 17](https://hashnode.com/posts/how-the-top-1-000-websites-handle-email-security-in-2026-dmarc-spf-bimi-and-who-hosts-their-email/6ad2185942178b8605b89856/comment/6ad29f0963ec362f1d8a64db#reply-6ad2eb7513f22ae0d1412933)

Good question, so we checked. Of the 136 domains on p=none, 20 (about 15%) publish no rua address at all, so their aggregate reports go nowhere. The other 116 do send reports somewhere, though from DNS alone there's no way to tell whether anyone reads them.

[StackShortlist](https://hashnode.com/@veristria)

[Oct 17](https://hashnode.com/posts/how-the-top-1-000-websites-handle-email-security-in-2026-dmarc-spf-bimi-and-who-hosts-their-email/6ad2185942178b8605b89856/comment/6ad29f0963ec362f1d8a64db#reply-6ad2ec3513f22ae0d1412d35)

Thanks for running that. 20 of 136 with no rua at all is a useful split, and stating that DNS alone cannot show whether the other 116 are read is a fair limit. That second group is where a direct question to the domain owner tells more than another scan.