How AI companies set up SPF, DKIM and DMARC

Of 1033 AI companies checked on 2026-10-31, 46.1% publish a DMARC policy that rejects or quarantines spoofed mail.

Findings

DMARC is published on 83.3% of those companies and missing on 16.7%. 0 domains returned no DMARC answer and are left out of that split.

Where a DMARC record is published, 44.6% set p=none, 33.2% set quarantine, and 22.1% set reject. 1 record used some other p= value.

77.8% of the published DMARC records list a reporting address, and 22 set pct below 100.

88.3% publish an SPF record. Of the 899 domains with exactly one, 20% end in -all, 79.2% end in ~all, 0.6% end in ?all, and 0 records end in +all. 2 records do not end in an all term. 0 SPF queries failed.

13 domains publish more than one SPF record, and 4 need more than 10 DNS lookups to evaluate SPF.

A signing key showed up at a common selector on 76.1% of the companies whose DKIM queries finished. 1 domain had a selector query that failed before the list was finished.

Of the 1033 companies whose MX query answered, 36 publish no MX record. Of the 997 that do, 90.2% point at Google, 4.9% point at Microsoft 365, and 4.9% point at another host.

BIMI is published on 3% of the companies whose BIMI query answered, and MTA-STS on 1.2% of those whose MTA-STS query answered.

Method

The company list is the Y Combinator company directory, public API mirror, fetched on 2026-10-31 from https://yc-oss.github.io/api/tags/artificial-intelligence.json (https://github.com/yc-oss/api). The filter was: tag = Artificial Intelligence; website host with www removed; registrable domain; one row per domain. The directory file sha256 is 9c0ef66a6266b71855d084843ab061f2157d71fb000d83fbbb897f25f6a6ed8b. The directory had 1054 rows.

Before any DNS query, 5 rows had no website, 1 had a website that is not a domain name, 0 used a hosted-page suffix, and 0 repeated a domain already kept. DNS then dropped 3 names that do not exist, 3 names whose nameservers are parking services, and 9 names that did not answer. 1033 domains are in the table.

MX is the mail host, grouped by the host suffix. SPF is the TXT record that starts with v=spf1: whether it is there, whether it is the only one, whether it ends in -all, ~all, ?all or +all, and how many DNS lookups the include, a, mx, ptr, exists and redirect terms need. More than 10 is past the limit in RFC 7208. DMARC is the TXT record at _dmarc: whether it is there, the p= value, whether rua is set, and whether pct is below 100. BIMI is a TXT record at default._bimi that starts with v=BIMI1. MTA-STS is a TXT record at _mta-sts that contains v=STSv1. Each check is a public DNS query for MX, SPF, DMARC, BIMI, MTA-STS, or a DKIM selector. No mailbox was contacted and no customer data was used.

DKIM cannot be listed without a selector. This run queried 15 common selectors: google, selector1, selector2, k1, s1, default, resend, k2, s2, mail, cm, pic, mandrill, zoho, protonmail. A hit is reported as found at a common selector. A domain that signs with any other name is counted as not found, so the share is a lower bound.

Re-run it with node scripts/research/email-auth-study.mjs from the repository. The script writes the CSV and the aggregate file under apps/landing/public/research/email-auth-2026/.

Cite this

AgentiSend. How AI companies set up SPF, DKIM and DMARC. 2026-10-31. https://agentisend.com/research/email-authentication-ai-companies-2026.

The row-level results, one domain per row, are in domains.csv.

Check a domain

The DNS check reads the records on a domain you name, and Domains and DNS lists what each record is for. For a domain you add, AgentiSend returns the records to publish, including a signing key and a bounce path.