How we graded
No curve. No bonus points. Either you have SPF, DKIM, and DMARC configured and enforcing, or you don't.
| Grade | What it means |
|---|---|
| A | SPF + DKIM + DMARC enforcing (quarantine or reject) |
| B | All three records present, but DMARC not enforcing (policy=none) |
| C | Missing one of the three core records |
| D | Missing two of the three core records |
| F | Missing all three, or critical failure like SPF +all |
The results
200 domains scanned. 6 days after Demo Day. These companies are actively emailing investors, customers, and partners.
89% use Google Workspace
Google makes DKIM and DMARC setup easy. A few clicks in the Admin console, two DNS records, done.
Most just never turned it on.
DMARC policy breakdown
DMARC tells receiving servers what to do with emails that fail authentication. Without it, or with policy=none, spoofed emails get delivered like normal.
| Policy | Count | % |
|---|---|---|
| No DMARC record | 75 | 38% |
| p=none (monitor only) | 64 | 32% |
| p=quarantine | 45 | 23% |
| p=reject (full enforcement) | 16 | 8% |
Why policy=none provides zero protection, and how to get to reject.
So what?
Without DMARC enforcement, a spoofed email from your domain won't get blocked by the receiving server. It might still land in spam depending on the provider's own heuristics, but there's no policy telling it to reject. That's the gap.
The less obvious cost is to your own deliverability. Google and Yahoo now factor DMARC, DKIM, and SPF into inbox placement decisions. A domain with no enforcement doesn't just fail to block spoofing. It also makes your real emails look less trustworthy.
Check your grade
Free and open source. Same grading system used in this audit.
Methodology
Tool: npx mail-audit (open source, public DNS queries only)
Source: YC W26 batch via ycombinator.com and extruct.ai (200 domains)
Date: March 30, 2026 (6 days after Demo Day)
Grading: Auth triad-based. A = all 3 + DMARC enforcing. B = all 3 present. C = missing 1. D = missing 2. F = missing all.
Flags: --quick --skip-blacklists --skip-tls for batch speed. Full audits check additional signals.
Valid results: 200/200 (100%)