We ran live email-authentication checks (SPF, DKIM, DMARC) on 130 real B2B companies. Half of them are quietly leaking — sending mail that mailbox providers don't fully trust, while their dashboards report "opens."
p=none) — monitoring spoofing, not blocking it.p=noneThe single most common finding wasn't a missing record — it was a record that looks done but isn't doing anything. 37% of companies publish a DMARC record set to p=none, which tells mailbox providers: "watch for spoofing, but don't actually do anything about it."
Most teams set p=none on day one to start collecting reports — and then never move to p=quarantine or p=reject. The result: you get the false comfort of "we have DMARC" with none of the protection. As you scale outbound, an unenforced domain slowly bleeds sender reputation, and anyone can impersonate you.
Nearly 1 in 5 (18.5%) had no DKIM signature we could detect on the common selectors. Unsigned mail is the fastest way to get filtered — and it's invisible from inside your own sending tool.
This is the mechanism behind the most expensive lie in outbound: your tool reports "opens" while your pipeline never materializes. The opens are often spam-filter prefetches and bots; the real prospects never saw the email because half of it landed in spam. You can send 10,000 emails from a broken domain and the dashboard will look fine the whole time.
p=none → published but unenforced; spoofable; reputation erodes. 37%.Deliverability isn't the exciting part of outbound. It's just the part that decides whether anyone reads the email you spent an hour writing. Before you scale sending — or pay a vendor to scale it for you — fix the foundation:
p=none, watch the reports for two weeks, then move to p=quarantine (then p=reject).Type your domain and get an instant A–F grade on SPF, DKIM, DMARC, and MX — the same live checks we ran across these 130 companies. No signup.
Run the Outbound Reality Check →METHOD: We ran live DNS-over-HTTPS lookups (SPF on the apex TXT, DKIM across common public selectors, DMARC at _dmarc, plus MX) against 130 B2B companies in June 2026. "Has DKIM" means a valid, non-empty public key on a standard selector; a custom selector we didn't probe would read as absent. Honest numbers, no estimates. We publish our own outbound results on a public ledger at /proof.