How many local Alabama firms publish DMARC? We checked 246.
By Adam W., founder of DMARCit · Last updated 2026-10
On October 1, 2026 we read the public DNS records for the domains of 246 local Alabama law, accounting, title, insurance, and financial-advisory firms. 53% of those domains published no DMARC record. Another 26% published p=none, which asks receiving servers to take no DMARC-specific action. One in five published a policy asking receivers to quarantine or reject mail that fails DMARC.
The numbers by type of firm
| Type of firm | Domains checked | No DMARC record | Unusable record | p=none | p=quarantine | p=reject |
|---|---|---|---|---|---|---|
| Law firms | 82 | 50 (61%) | 0 | 21 (26%) | 8 | 3 |
| Accounting and tax | 85 | 41 (48%) | 2 | 27 (32%) | 12 | 3 |
| Title and closing | 26 | 16 (62%) | 0 | 2 (8%) | 5 | 3 |
| Insurance agencies | 26 | 14 (54%) | 0 | 6 (23%) | 2 | 4 |
| Financial and mortgage | 27 | 9 (33%) | 0 | 9 (33%) | 4 | 5 |
| All | 246 | 130 (53%) | 2 | 65 (26%) | 31 | 18 |
An unusable record is one receivers have to ignore. One domain published two DMARC records; the other's record is missing the semicolon after v=DMARC1.
What a missing record means, and what it doesn't
DMARC is the DNS record a domain owner uses to say how receiving mail servers should treat messages that use the domain in the From address but don't pass SPF or DKIM in alignment with it, and where to send reports about them. With no record published, receivers get no instruction from the domain owner and rely on their own filtering. The owner also gets no DMARC aggregate reports, which are one of the few ways to see every service sending mail under the domain.
A missing record doesn't mean a firm has been spoofed, and publishing one doesn't stop every kind of impersonation. DMARC applies to mail that uses the firm's exact domain. It does nothing about lookalike domains or a mailbox whose password was stolen.
p=none is a reasonable place to start. It asks receivers to change nothing about delivery, and with a reporting address (rua=) it brings in the aggregate reports that show which services, such as a billing system or a copier, might fail DMARC once a domain moves to enforcement. Some domains stay at p=none on purpose.
Title companies are worth a separate look because their email carries wiring instructions for closings. 16 of the 26 title and closing domains we checked published no DMARC record.
Reports that go nowhere
116 of the domains published at least one DMARC record. 46 of those (40%) list no rua= address, so receivers have nowhere to send aggregate reports. Three more send reports to addresses that can't reach anyone at the firm: one to contoso.com, the example domain from Microsoft's documentation; one to mailertest.com; and one to its own domain with ".com" typed twice.
DKIM on Microsoft 365
113 of the domains point their MX records directly at Microsoft 365. For 60 of them, neither selector1._domainkey nor selector2._domainkey, the two selector names Microsoft 365 uses to sign mail with a custom domain, was published. That is all a DNS lookup can show. It doesn't tell us what signs each firm's outbound mail; only message headers show that.
SPF
12 of the 246 domains published no SPF record. Expanding every include statically, 4 more SPF records count past the 10 DNS lookups SPF allows. Treat those as potential lookup-limit problems: a receiver evaluating a real message may perform fewer lookups than a full static expansion.
How we checked
- Firms came from web searches for local, Alabama-based firms in each category across more than a dozen Alabama cities. National and multi-state firms were excluded. One domain per firm. This is a sample, not a census: it leans toward firms with a findable website, and the percentages describe these 246 domains, not every Alabama firm.
- We counted only domains with MX records, meaning they receive mail. 25 domains without MX records were dropped.
- DNS was read over DNS-over-HTTPS from Google Public DNS on October 1, 2026 (Central time). Every DMARC and SPF result was read again from Cloudflare's resolver, and the two agreed on all 246 domains. That shows the records were stable, not that our reading of them is right, so the record text behind each figure is kept.
- None of the seven top-level domains in the sample (
.com,.net,.org,.us,.biz,.cpa,.tax) publishes a DMARC policy of its own, so no domain inherits one. - For the DKIM figure we looked only at the two Microsoft 365 selector names. A firm can still sign mail under a selector we didn't look at.
- We don't name any firm.
Check your own domain
The free DMARC checker reads the same records for one domain. If you look after several clients' domains, the bulk check takes 25 at a time.