Short answer: 40.2% of 7,601 US SaaS domains (21-200 employees) have no working DMARC protection: 31.6% are set to p=none, 7.9% have no DMARC record and 0.6% have duplicate records. 11.8%, about 1 in 8, have at least one hard error such as no SPF, two SPF records or no DMARC. Only 55.4% fully enforce DMARC.
Key takeaways
- 40.2% of 7,601 US SaaS domains give inboxes no instruction to block fake email in their name.
- 11.8%, about 1 in 8, have a hard error: no DMARC (7.9%), no SPF (4.4%), no MX (2.5%) or duplicate records.
- Only 55.4% fully enforce DMARC at quarantine or reject.
- Teams using a sales email tool have about half the hard-error rate (6.6% vs 12.7%), but just as many stop at p=none.
- Most fixes take minutes: merge duplicate records, publish DMARC with reports, then move to enforcement.
Contents
- DMARC status across 7,601 US SaaS domains
- Hard setup errors by type
- 1. 40% of SaaS domains don't ask inboxes to block impersonators
- 2. About 1 in 8 has a hard error that inboxes can see
- 3. 4.4% have no SPF at all, and 1.2% have broken SPF
- 4. Up to 11.9% show no DKIM key where most providers put it
- 5. Up to 17% miss the basic SPF + DKIM + DMARC setup
- 6. Companies that already use a sales email tool are cleaner, but not on DMARC
- 7. Many DMARC setups are half-finished
- How to fix it: a checklist for founders and sales leaders
- Methodology
- Cite this study
- Sources
- FAQs
We read the public email records of 7,601 US SaaS companies with 21 to 200 employees. 40% give inboxes no instruction to block fake email sent in their name, and about 1 in 8 has a setup error any inbox provider can see.
Check your own domain the same way with our email DNS checker before you read on: it runs the exact checks behind this study on one domain, with no sign-up.
DMARC status across 7,601 US SaaS domains
Quarantine and reject include 338 domains that apply the policy to only part of their mail; fully enforced at 100%: 55.4%.
Hard setup errors by type
1. 40% of SaaS domains don't ask inboxes to block impersonators
Of 7,601 domains, 3,054 (40.2%) give inboxes no instruction to stop fake mail:
- 2,402 (31.6%) have a DMARC record set to
p=none(monitor only) - 603 (7.9%) have no DMARC record at all
- 49 (0.6%) have two or more DMARC records, which makes receivers ignore DMARC completely
What it means for your sales emails: p=none is a fine first step, and it does satisfy the minimum DMARC rule Gmail and Outlook set for high-volume senders. But anyone can still send email "from" your domain and inboxes are told to let it through. Phishing that uses your name trains filters, and buyers, to distrust mail from your domain.
2. About 1 in 8 has a hard error that inboxes can see
898 of 7,601 domains (11.8%) have at least one hard problem. 637 have one, 150 have two, and 111 have three.
| Hard problem | Domains | Share |
|---|---|---|
| No DMARC record | 603 | 7.9% |
| No SPF record | 332 | 4.4% |
| No MX record | 192 | 2.5% |
| Two or more SPF records | 91 | 1.2% |
| Two or more DMARC records | 49 | 0.6% |
What it means: these are not style choices. Two SPF records is an error under the SPF standard, so SPF fails for every email. A missing DMARC record means Gmail will rate-limit or junk bulk mail from that domain. No MX means replies to that domain bounce.
3. 4.4% have no SPF at all, and 1.2% have broken SPF
332 domains (4.4%) publish no SPF record, so receivers cannot check which servers may send for them. Another 91 (1.2%) publish two SPF records, which counts as a permanent error. Together that is 423 domains (5.6%) where SPF cannot pass.
What it means: Gmail asks every sender, not just bulk senders, to pass SPF or DKIM. Bulk senders need both. If SPF is missing or broken, your mail is resting entirely on DKIM.
4. Up to 11.9% show no DKIM key where most providers put it
We found no DKIM key at any of 16 common selectors for 906 domains (11.9%). Treat this as an upper bound: a company can use a custom selector we did not test. Put the other way, at least 88.1% have DKIM in place.
Among the 4,739 domains whose mail runs on Google Workspace, 84.3% have a key at Google's default "google" selector. Among the 1,840 on Microsoft 365, 72.0% have a key at Microsoft's default selectors.
What it means: DKIM is the signature that survives forwarding. Without it, a forwarded sales email often fails authentication.
5. Up to 17% miss the basic SPF + DKIM + DMARC setup
6,294 domains (82.8%) pass all three basics in our checks: one valid SPF record, a DKIM key at a common selector, and one DMARC record. That leaves up to 1,307 (17.2%) that miss at least one piece. Because of the DKIM limit above, the true share is somewhat lower.
What it means: this baseline is what Gmail, Yahoo and Outlook now expect from anyone sending more than about 5,000 emails a day. Teams running outbound at scale can hit that number quickly across a whole domain.
6. Companies that already use a sales email tool are cleaner, but not on DMARC
We split the sample by whether the company's data shows a sales-engagement or cold email tool in use.
| Group | Domains | Any hard problem | No DMARC | DMARC p=none | DMARC enforced |
|---|---|---|---|---|---|
| Uses a sales email tool | 1,141 | 6.6% | 2.9% | 30.7% | 60.2% |
| No tool detected | 6,460 | 12.7% | 8.8% | 31.8% | 54.5% |
What it means: teams that send outbound are about half as likely to have a hard error, possibly because their sending tools prompt them to set records up. But about 3 in 10 of them still sit at p=none, the same as everyone else. Getting a record in place is common; finishing the job is not.
7. Many DMARC setups are half-finished
- 338 of the 4,547 domains at quarantine or reject (7.4%) apply the policy to only part of their mail (
pctbelow 100). - 1,236 of the 6,949 domains with one DMARC record (17.8%) have no reporting address, so nobody receives the reports that show who is sending as them.
- 155 domains (2.2% of those with one SPF record) already list 8 or more lookup terms in the top level of SPF, before counting nested includes, so they are close to or over the 10-lookup limit.
What it means: a DMARC record without reports is a smoke alarm with no battery. You cannot safely move to enforcement if you cannot see who sends for you.
Are your sending domains on this list?
Book a call with Shawn. We will check your sending domains, show you what inboxes see, and explain how we set up email infrastructure for outbound in the US, UK and Europe, the Middle East and India.
30-minute call · no obligation
How to fix it: a checklist for founders and sales leaders
Run your domain through the email DNS checker (no sign-up) first. Then work down this list:
- One SPF record only. If you see two records starting
v=spf1, merge them into one. - List every sender in SPF. Your mailbox provider plus every tool that sends as you (marketing email, billing, support desk, sales tools). End the record with
~allor-all, and put nothing after it. - Stay under 10 lookups. Each
include:,a,mxandredirect=costs at least one, and nested includes count too. Remove tools you no longer use. - Turn on DKIM in every sending tool, not just your mailbox provider. Each tool gives you a record to publish.
- Publish one DMARC record at
_dmarc.yourdomain.com, starting withv=DMARC1; p=none; rua=mailto:...so you receive reports. - Read the reports for 2 to 4 weeks. Make sure every real sender passes.
- Move to
p=quarantine, thenp=reject, and remove anypctbelow 100 once you are confident. - Check MX. If replies go to this domain, it needs MX records.
- Recheck after every new tool. A common way to end up with two SPF records is adding a new sender as a separate record instead of merging it into the existing one.
Related guides: what DMARC, SPF and DKIM do, how long email warm-up takes, whether cold email is legal in your country, the infrastructure calculator for domains and inboxes, the cold email checker for the email itself, done-for-you sending infrastructure, what outbound lead generation costs, and more in the cold email hub.
Methodology
- Sample. Companies from a database search on 9 October 2026: headquarters in the United States, 21 to 200 employees, tagged "SaaS". One pull was limited to companies with a detected sales-engagement or cold email tool (1,145 domains); a second pull repeated the search with no tool filter and added 6,498 new domains. We removed investment firms, staffing firms, and vendors in the CRM, sales-engagement and email-deliverability space before checking. Every domain appears once.
- Checks. For each company website domain we looked up the root TXT records (SPF),
_dmarcTXT (DMARC), MX records, and DKIM keys at 16 common selectors, through Google's public DNS-over-HTTPS resolver. These are the same checks our email DNS checker runs on a single domain. - Usable results. 7,643 domains were checked. 42 returned DNS errors and are left out of every rate, leaving 7,601.
- Stability. Six days later (15 October 2026) we rechecked 198 of the domains that had a hard problem. 194 (98.0%) still had exactly the same problems; 4 had fixed them.
- Privacy. We report aggregates only. We do not name or list any company or domain.
Limits you should know
- One snapshot. DNS records change. These numbers describe 9 October 2026.
- DKIM is a lower bound. We test 16 common selectors. A key under any other name shows as "not found", so missing-DKIM figures are upper bounds.
- SPF lookups are a lower bound. We counted only the top-level terms in each SPF record and did not expand nested includes, so the real number of domains over the 10-lookup limit is higher than the 3 we found by top-level count alone.
- Not a random sample. The list was built for B2B prospecting from third-party company data (HQ, headcount and "SaaS" tags are estimates). It describes small and mid-size US SaaS companies, not enterprises or all US businesses. We did not store company size per row, so we cannot split results by size.
- Records, not results. We read what each domain publishes. We did not see whether real emails pass, align, or land in the inbox.
- Website domain only. Some companies send from a different domain than their website.
Want sending domains that pass from day one?
We set up sending domains and inboxes with SPF, DKIM and DMARC in place, warm-up and daily health checks, then run the outbound on them. Book a call with Shawn to see how.
30-minute call · no obligation
Cite this study
B2BXclusive (2026). We checked 7,601 US SaaS domains: 40% don't tell inboxes to block fake emails. DNS snapshot of 9 October 2026, 7,601 US-headquartered SaaS companies with 21-200 employees. https://b2bxclusive.com/blog/saas-email-authentication-study/
Journalists and researchers: email shawn@b2bxclusive.com for the aggregate tables. We do not share company-level data.
Sources
- Google, Email sender guidelines (accessed November 2026)
- Yahoo Sender Hub, best practices
- Microsoft, Outlook requirements for high-volume senders (2025)
- RFC 7208, SPF, RFC 6376, DKIM and RFC 7489, DMARC
- Study data: B2BXclusive DNS snapshot of 7,643 company domains, 9 October 2026 (7,601 usable results), recheck of 198 domains on 15 October 2026.
40% of US SaaS Domains Leave the Door Open
Get this guide as a printable PDF cheat sheet: the short answer and key takeaways, 2 comparison tables, 8 quick answers.
Frequently asked questions
What are SPF, DKIM and DMARC, in one line each?
SPF lists the servers allowed to send for your domain. DKIM adds a signature that proves the message was not changed. DMARC tells inboxes what to do when a message fails those checks, and sends you reports.
Is DMARC p=none bad?
It is a starting point, not a finish line. It meets the minimum rule for high-volume senders, but it tells inboxes to deliver mail that fails authentication, so it does not stop impersonation.
Will fixing DNS get my cold emails into the inbox?
It removes a reason to be filtered. Inbox placement also depends on your sending volume, list quality, complaint rate and content. Authentication is the floor, not the whole house.
Why do two SPF or DMARC records matter so much?
The standards allow one of each. With two SPF records, SPF returns an error. With two DMARC records, receivers ignore DMARC for that domain.
Do these rules apply to small teams?
Gmail asks every sender to pass SPF or DKIM. The stricter SPF + DKIM + DMARC rule applies at roughly 5,000 messages a day to Gmail or Outlook.com addresses, counted across the whole domain, including marketing and product email.
How did you check DKIM without knowing each company's selector?
We tried 16 selectors that common mail providers and sending tools use. That finds most keys but not custom ones, so treat our missing-DKIM numbers as an upper bound.
Can I see the list of companies?
No. We publish aggregates only and do not name any company.
Can I use this data?
Yes, with a link to this page (see "Cite this study" on this page).
About the author
Subhendu J Shawn is the founder of B2BXclusive, a B2B outbound sales and lead generation agency, and the creator of Tailr CRM. His experience spans American Express and Amazon, and he has helped 50+ B2B companies build pipeline across the US, Europe, the Middle East and India. All articles by Shawn · Follow on LinkedIn
