A domain publishing SPF is not proof that its legitimate email passes authentication. Research can identify failure patterns and help prioritise prevention, but a historical domain sample does not establish a particular business's current failure rate or support costs.
An email-security statistic can sound like a diagnosis: a large share of domains have a particular issue, so your business must need a fix. That conclusion needs evidence about your domain.
Published does not mean correctly configured
SPF adoption measures can count domains that publish a policy. The policy could still omit a legitimate sender, contain an error, or describe a domain that sends no mail at all.
A valid v=spf1 -all policy can be an intentional statement that a domain sends no email. Finding it on an unused domain is not evidence of a broken business mail system.
Conversely, a well-formed policy can be wrong for the application's actual sending IP. The SPF standard defines evaluation against a sender and domain, not a general certificate of email health. SPF alone also does not establish DKIM, DMARC or inbox placement.
A large sample still has a defined population
SPF Beyond the Standard, published at USENIX Security 2024, examined 176 million domains across .com, .org, .net and .se using historical data ending in March 2023.
A domain is not necessarily a business, and an organisation can own many domains with different purposes. This historical sample therefore cannot establish a current failure rate for a particular type of business.
The findings can identify failure modes worth preventing. Applying a numerical rate to a different population, or using it to estimate today's incident workload, needs further evidence.
A business decision needs evidence from the business
For a reported delivery problem, the useful evidence is the affected sender, its configuration and the outcome of an actual message. For a DNS policy question, inspect that policy and its dependencies.
A public SPF checker can help with selected DNS checks. It cannot establish the complete sender inventory or whether a message reached an inbox.
Population research can help prioritise safeguards. The business's sending configuration and incident experience determine which safeguards address its risks; an adoption statistic does not make that decision on its own.
Sources and further reading
Sources reviewed 8 September 2026. Our editorial standards.