45% of Startups Have DMARC That Protects Nothing (We Checked 705 of Them)

If your company sends email — invoices, password resets, anything with your name on it — there is a setting that decides whether a stranger can send mail that looks exactly like it came from you. It's called DMARC, and we wanted to know how many startups actually have it working. So we checked.

We passively scanned 705 US-based B2B SaaS companies (YC-seed stage, 5–50 employees) using only public data. Here's what we found about DMARC:

Nearly half — 45% — publish a DMARC policy that protects nothing. 7.9% have no DMARC record at all, and another 37.2% have one stuck on p=none: monitor-only mode, which watches spoofed mail sail through and does nothing to stop it. Only about 55% were actually enforcing.

Why "monitor-only" is the trap

Here's the part that catches good teams. Turning DMARC on for the first time, you're supposed to start at p=none — it reports problems without blocking anything, so you can see who legitimately sends mail as you before you start rejecting. It's the correct first step. The trouble is that it's also the most common place to stall. On a compliance checklist it reads as "DMARC: yes." In reality it enforces nothing, and it tends to sit there for years.

Worse, 20.3% of the companies we scanned collect no DMARC reports at all (no rua address). Without those reports you can't see who's sending as you, which means you can't safely move off monitor-only even if you wanted to. You're flying blind.

Why this matters for a small company

An unprotected sending domain is a practical, everyday risk — not a theoretical one. Anyone on the internet can send email that appears to come from your domain: a fake invoice to your customer, a "reset your password" to your staff, a wire-transfer request to your finance person. Because the mail really does look like it's from you, it gets trusted by default. For a startup trying to close deals with bigger customers, it's also the first thing an enterprise security questionnaire asks about — and "we're on p=none" is not an answer that passes.

What to actually do about it

• Add a reporting address first. Put a rua= tag on your DMARC record pointing at a mailbox or a DMARC reporting service you'll actually read. This is how you find out who sends mail as you.
• Watch the reports for a few weeks until every legitimate sender (your mail provider, marketing tool, ticketing system, invoicing app) is passing.
• Then move the policy up: p=none → p=quarantine → p=reject. Reject is the goal — it's the setting that actually stops a forgery.
• Fix SPF and DKIM alongside it — DMARC only enforces if at least one of those passes and aligns, and a broken SPF record is the usual reason a "reject" policy starts bouncing your own mail.

How we know this

These numbers come from a passive external scan of 705 companies fitting the profile above, run in August 2026. We read only public information — public DNS records, public certificate-transparency logs, and one ordinary request to each public homepage. No scanning, probing, or logins, and no individual company is identified in the dataset. Aggregates are reported only where at least five companies share a result, so no single company can be picked out. It's the same passive check we run as the first step of an external security posture assessment.

Curious where your own domain stands? Our External Security Posture Assessment checks your DMARC, SPF, and the rest of what an attacker — or an enterprise customer's security reviewer — can already see from the outside, and hands you a plain-English report with the fixes. It's passive and external-only; we never touch your systems.