94% of B2B Buyers Have DMARC. Only 63% Enforce It. We Resolved 125 Domains to Find Out.

By Dev Anand, AI Tooling & Automation Safety. Last updated: 2026-08-16

Everyone measures email authentication from the sender's side: does the outreach vendor's domain pass? We wanted the other half. When your cold email or your newsletter lands at a mid-market B2B company, what does that company's own domain look like, and how much spoofing of it would get through?

Who are the 125, and why them?

We wanted a buyer corpus that was named by someone other than us, public, and reproducible. Y Combinator's company directory fits: it lists every funded company with website, industry, batch, team size and status. We took the public dataset on 2026-08-16, filtered to active B2B companies with 20 or more staff from the 2021 to 2025 batches (254 companies), and selected the 130 largest by team size, which runs from 400 people down to 35. Five had no MX record on their primary domain and were excluded as not being mail domains. That leaves 125 companies that unambiguously run email on the domain we checked.

This is a slice, not the world: young, US-heavy, and, it turns out, overwhelmingly on Google Workspace. It is also exactly the population that fills the "B2B SaaS" segment of every outbound list, which is why we chose it. AI Until I Die's audit of the sender side covered the vendors; this is the inboxes.

How many B2B buyers publish SPF and DMARC?

For each domain we resolved the apex TXT record (SPF), _dmarc TXT (DMARC), MX (provider) and default._bimi TXT (BIMI) against two public resolvers, and recorded the details that matter: the SPF terminator, the DMARC policy, subdomain policy, percentage and reporting address.

By the adoption measure the industry usually quotes, this corpus is nearly done. Google and Yahoo's 2024 bulk-sender rules required DMARC at any policy for senders over 5,000 messages a day, and it shows: 94% is a number that would have been unthinkable five years ago. But the rules required a policy, and the policy most companies chose is the one that does nothing.

How many actually enforce?

Thirty-eight domains publish p=none. A p=none record tells receiving servers to deliver spoofed mail as normal and send the domain owner a report about it. It is the correct first step of a DMARC rollout and the wrong place to stop, and 30% of this corpus has stopped there. Add the seven with no record and 45 of 125 buyer domains, 36%, will have mail forged in their name delivered as usual.

SPF tells the same story in a different register. Ninety-eight percent publish a record; only 30% end it with -all, the hard fail. Sixty-seven percent use ~all, the soft fail that most receivers treat as a suggestion. Eleven domains in the whole corpus, under 9%, combine p=reject with SPF -all, which is the configuration every deliverability guide, including our own DMARC, SPF and DKIM explainer, describes as the goal.

What do the details hide?

Two patterns worth naming, because a headline "94% have DMARC" would never surface them.

Nine domains apply their policy to less than all of their mail via pct=. Two of those, doublehq.com (p=quarantine) and weekday.works (p=none), publish pct=1, which applies the policy to one message in a hundred. rdash.io applies p=none to 10%. artisan.co, an AI SDR vendor that appears in this buyer corpus by virtue of being a YC company, applies p=quarantine to 25%. A pct ramp is a legitimate rollout tool; a pct=1 that has been sitting there is a policy in name only.

Seven domains publish a subdomain policy weaker than the apex, and three of them, getzuma.com, vetrec.io and gumloop.com, publish p=reject on the apex with sp=none, leaving every subdomain open to spoofing. hockeystack.com, middleware.io, lancedb.com and verihubs.com do the same at quarantine. A spoofer reading those records sends from anything.example.com and the reject policy never applies.

And one domain, swiftsku.com, publishes a BIMI record, the standard that shows a verified logo in the inbox, with no DMARC record at all, which is the one thing BIMI cannot work without.

Does the mail provider matter?

Less than you might think, because there is barely a comparison to make: 114 of 125 domains (91%) run Google Workspace, 8 run Microsoft 365, and 3 run something else. Among Google Workspace domains, 64% enforce; among the 8 Microsoft 365 domains, 4 do. The corpus is, in effect, a census of how Google Workspace customers configure DMARC, and the answer is that Google's own guidance to start at p=none is followed diligently and its guidance to progress from there is followed by about two thirds.

Team size did not move the number either: 66% of the 29 companies with 100 or more staff enforce, versus 63% of the 96 smaller ones.

Why should a marketer care about the recipient's DMARC?

Two reasons. First, if you send email on behalf of a company like these, whether outbound from an outreach platform or a newsletter, your own domain's configuration is judged by receivers running exactly these policies, and the ~all-and-p=none majority is the reason so much marginal mail still lands. Second, if you are one of these companies, the 36% figure is your exposure: that is the share of your peers whose customers can receive a perfectly deliverable email "from" them that they never sent. Our email deliverability explainer covers why receivers reward the domains that close that gap.

What are the limits of this census?

One resolution per record on 2026-08-16 from two public resolvers; DNS changes daily. The corpus is YC-backed B2B companies with 35 to 400 staff, which is young, US-heavy and Google-heavy, and enforcement in older or larger enterprises will differ. Provider is inferred from MX hostnames, so a domain behind a gateway shows the gateway. SPF lookup depth was counted at the top level only. BIMI was checked at the default selector only. Every domain, batch, team size and record is in the data file published alongside this piece.

FAQ

What share of B2B companies enforce DMARC?

In this census of 125 YC-backed B2B companies, 79 (63%) publish p=quarantine or p=reject. 38 (30%) publish p=none and 7 have no DMARC record.

How common is SPF -all versus ~all?

37 of 125 domains (30%) end SPF with the hard-fail -all; 84 (67%) use the soft-fail ~all. Only 11 domains combine -all with p=reject.

What is wrong with DMARC pct=1?

pct= tells receivers what share of failing mail to apply the policy to. At pct=1, an enforcing policy applies to one message in a hundred; two domains in this corpus publish exactly that.

Does p=reject on the apex protect subdomains?

Only if sp= is not set to something weaker. Three domains here publish p=reject with sp=none, which leaves every subdomain unprotected.

Which email provider do B2B startups use?

114 of 125 domains in this census (91%) run Google Workspace; 8 run Microsoft 365.

Sources

• RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC)
• RFC 7208: Sender Policy Framework (SPF)
• Google: Email sender guidelines
• Y Combinator company directory
• AI Until I Die: Do cold email tools pass their own sender rules?

GTMStack publishes original audits of the AI marketing stack. If you want the next one when it lands, the newsletter is the place to get it.