Evidence and research

SPF Adoption Statistics Are Not an Email Health Check

By EmailmetryReviewed 2 min read

A domain publishing SPF is not proof that its legitimate email passes authentication. Research can identify failure patterns and help prioritise prevention, but a historical domain sample does not establish a particular business's current failure rate or support costs.

An email-security statistic can sound like a diagnosis: a large share of domains have a particular issue, so your business must need a fix. That conclusion needs evidence about your domain.

Published does not mean correctly configured

SPF adoption measures can count domains that publish a policy. The policy could still omit a legitimate sender, contain an error, or describe a domain that sends no mail at all.

A valid v=spf1 -all policy can be an intentional statement that a domain sends no email. Finding it on an unused domain is not evidence of a broken business mail system.

Conversely, a well-formed policy can be wrong for the application's actual sending IP. The SPF standard defines evaluation against a sender and domain, not a general certificate of email health. SPF alone also does not establish DKIM, DMARC or inbox placement.

A large sample still has a defined population

SPF Beyond the Standard, published at USENIX Security 2024, examined 176 million domains across .com, .org, .net and .se using historical data ending in March 2023.

A domain is not necessarily a business, and an organisation can own many domains with different purposes. This historical sample therefore cannot establish a current failure rate for a particular type of business.

The findings can identify failure modes worth preventing. Applying a numerical rate to a different population, or using it to estimate today's incident workload, needs further evidence.

A business decision needs evidence from the business

For a reported delivery problem, the useful evidence is the affected sender, its configuration and the outcome of an actual message. For a DNS policy question, inspect that policy and its dependencies.

A public SPF checker can help with selected DNS checks. It cannot establish the complete sender inventory or whether a message reached an inbox.

Population research can help prioritise safeguards. The business's sending configuration and incident experience determine which safeguards address its risks; an adoption statistic does not make that decision on its own.

Sources and further reading

Sources reviewed 8 September 2026. Our editorial standards.