| Category | Domains | SPF | DMARC | SPF–DMARC Gap |
|---|---|---|---|---|
| Email Security Proxy | 4,111 | 97.3% | 75.7% | 21.6pp |
| Enterprise Cloud Email | 19,190 | 93.2% | 60.4% | 32.8pp |
| Gov/Ed Self-hosted | 563 | 90.2% | 55.1% | 35.1pp |
| Mid-tier Cloud Email | 72 | 100.0% | 50.0% | 50.0pp |
| Other / Self-hosted | 3,607 | 84.0% | 25.9% | 58.1pp |
| Budget / Hosting Email | 1,522 | 51.3% | 23.8% | 27.5pp |
| Gateway Service | Domains | SPF | DMARC |
|---|---|---|---|
| Cisco IronPort | 211 | 100.0% | 89.6% |
| Mimecast | 456 | 98.7% | 84.2% |
| Barracuda | 1,368 | 98.0% | 79.3% |
| Sophos | 133 | 98.5% | 78.2% |
| Proofpoint | 1,091 | 99.0% | 73.1% |
| SpamTitan/TitanHQ | 87 | 100.0% | 73.6% |
| AppRiver/Zix | 454 | 88.3% | 66.5% |
| Cloudflare Email | 74 | 100.0% | 60.8% |
The self-hosted gap problem: Entities running their own email infrastructure (Other/Self-hosted category) have only 25.9% DMARC adoption — the lowest of any provider category, with the widest SPF-DMARC gap (58.1pp). This represents 3,607 public entities that have SPF records but have not taken the final policy enforcement step. Budget hosting providers like GoDaddy (3.3% DMARC) add another 717 at-risk entities.
| Provider | Domains | SPF | DMARC | Gap |
|---|---|---|---|---|
| Microsoft 365 | 9,202 | 99.1% | 62.0% | 37.1pp |
| Google Workspace | 9,988 | 87.7% | 58.9% | 28.8pp |
| GoDaddy | 717 | 7.3% | 3.3% | 4.0pp |
| Metric | Proxied (4,111) | Non-Proxied (24,954) | Uplift |
|---|---|---|---|
| MX Records | 100.0% | 100.0% | — |
| SPF Adoption | 97.3% | 89.2% | +8.1pp |
| DMARC Adoption | 75.7% | 53.0% | +22.7pp |