---
title: "Comment by StackShortlist on \"How the top 1,000 websites handle email security in 2026: DMARC, SPF, BIMI and who hosts their email\" | Hashnode"
description: "The 13.6% sitting on p=none is the number I would chase, since many of those likely moved there for the 2024 Google and Yahoo rule and never looked at the rua r"
url: "https://hashnode.com/posts/how-the-top-1-000-websites-handle-email-security-in-2026-dmarc-spf-bimi-and-who-hosts-their-email/6ad2185942178b8605b89856/comment/6ad29f0963ec362f1d8a64db"
---

[Discussion](https://hashnode.com/posts/how-the-top-1-000-websites-handle-email-security-in-2026-dmarc-spf-bimi-and-who-hosts-their-email/6ad2185942178b8605b89856)

Comment [How the top 1,000 websites handle email security in 2026: DMARC, SPF, BIMI and who hosts their email](https://hashnode.com/posts/how-the-top-1-000-websites-handle-email-security-in-2026-dmarc-spf-bimi-and-who-hosts-their-email/6ad2185942178b8605b89856)

[StackShortlist](https://hashnode.com/@veristria)

[Oct 16](https://hashnode.com/posts/how-the-top-1-000-websites-handle-email-security-in-2026-dmarc-spf-bimi-and-who-hosts-their-email/6ad2185942178b8605b89856/comment/6ad29f0963ec362f1d8a64db)

The 13.6% sitting on p=none is the number I would chase, since many of those likely moved there for the 2024 Google and Yahoo rule and never looked at the rua reports again. Would be interesting to see how many of the p=none domains also have no rua address at all, which means nobody is even monitoring.

[locaihost data](https://hashnode.com/@locaihostdata)

[Oct 17](https://hashnode.com/posts/how-the-top-1-000-websites-handle-email-security-in-2026-dmarc-spf-bimi-and-who-hosts-their-email/6ad2185942178b8605b89856/comment/6ad29f0963ec362f1d8a64db#reply-6ad2eb7513f22ae0d1412933)

Good question, so we checked. Of the 136 domains on p=none, 20 (about 15%) publish no rua address at all, so their aggregate reports go nowhere. The other 116 do send reports somewhere, though from DNS alone there's no way to tell whether anyone reads them.

[StackShortlist](https://hashnode.com/@veristria)

[Oct 17](https://hashnode.com/posts/how-the-top-1-000-websites-handle-email-security-in-2026-dmarc-spf-bimi-and-who-hosts-their-email/6ad2185942178b8605b89856/comment/6ad29f0963ec362f1d8a64db#reply-6ad2ec3513f22ae0d1412d35)

Thanks for running that. 20 of 136 with no rua at all is a useful split, and stating that DNS alone cannot show whether the other 116 are read is a fair limit. That second group is where a direct question to the domain owner tells more than another scan.