We take a careful, responsible approach to the benchmark research. This article explains what we collect, what we publish, and the lines we will not cross.
Public, non-personal data only
The benchmarks are built entirely from public, non-personal information. We read the DNS records a domain publishes for the whole internet to see, which is exactly the information mail servers use to decide whether to trust an email. We do not collect personal data, and we do not access anyone's mailbox or messages.
We publish statistics, never individual domains
Everything we publish is statistical. You will see percentages and trends grouped by industry and country, for example the share of domains in a sector that have a strong DMARC policy. You will never see a named domain or organisation singled out.
This is a deliberate choice. Publishing that a specific domain is weakly protected would hand attackers a ready-made target list and put that domain holder at risk. Keeping everything aggregated lets us share the big picture without exposing anyone.
Can I exclude my domain from the benchmarks?
This is a question we are sometimes asked, and the answer is no. The benchmarks read only public DNS records, never any personal data, and we publish statistics rather than anything about an individual domain. Because nothing identifiable about your domain is collected or published, there is nothing to opt out of. Leaving individual domains out would also weaken a dataset whose whole value is that it reflects the public internet as a whole.
Research used for good
Our aim is to raise the overall standard of email security by showing, openly and with real evidence, where it stands today and where it needs to improve. If you are a DMARCER customer and want to know how your own domains score, you will find that privately in your account, where only you and your team can see it.