# Dealership Email Authentication Census: 8,032 Domains

*Email Deliverability · Updated 2026-09-20 · 8 min read*

**Of 8,032 US franchise dealership domains that receive mail, 75% publish an SPF record and 47% publish a DMARC record, but only 23% enforce DMARC with a quarantine or reject policy and just 8% reject outright. 32% publish SPF with no DMARC at all, the configuration that lets anyone send mail that looks like the dealership. Dealers behind a security gateway enforce DMARC at 46%; Google Workspace dealers at 15%. Enforcement runs from 40% of Mercedes-Benz stores to 6% of Ford stores, and from 44% in Florida to 12% in Michigan.**

The [gateway census](/blog/dealership-email-gateway-census) established who receives a dealership's mail. This study asks the other question: when a dealership sends mail, can a receiver tell it is genuine? SPF, DKIM and DMARC are the three records that answer it, and since 2024 Google and Yahoo have required all three from bulk senders, with Microsoft following in 2025. A dealership emails its customers about service, recalls, financing and offers; a dealership domain without DMARC is a domain anyone can impersonate. We resolved the DNS records of every franchise dealer domain in the census in September 2026.

Population: 17,636 franchise dealership website domains from manufacturer locators resolved cleanly. 8,032 of them publish a mail exchange record and are the population for every figure below, because a domain that receives no mail is rarely a domain that sends it. Figures are shares of domains, not of dealerships or of messages.

## How many dealership domains publish SPF and DMARC?

6,054 of 8,032 mail-receiving dealer domains (75%) publish an SPF record, and 2,947 (37%) end it with a hard fail, the setting that tells receivers to refuse mail from unlisted servers. DMARC is thinner: 3,770 domains (47%) publish a record at all. Of those, 1,923 run p=none, which only asks for reports and blocks nothing; 1,192 run p=quarantine and 651 run p=reject. Put together, 23% of dealer domains enforce DMARC and 8% reject spoofed mail outright.

![DMARC status across 8,032 US franchise dealer domains that receive mail: none, p=none, quarantine and reject](/images/blog/dealer-email-auth-dmarc.svg)

*DMARC status of the 8,032 franchise dealer domains that receive mail. Source: Provena dealership email authentication census, September 2026.*

The exposure sits in the gap between the two records. 32% of mail-receiving dealer domains publish SPF but no DMARC. SPF on its own restricts which servers may use the envelope sender; it says nothing about the From address a customer sees, so a message can fail SPF and still land with the dealership's name on it. DMARC is what ties the visible From domain to a passing check and tells the receiver what to do when it fails. 27% of domains include a reporting address, which means most dealers with a policy are at least seeing what is sent in their name.

## Which mail provider's dealers are best protected?

The provider in front of a dealership predicts its authentication posture more than anything else in the data. Dealers behind a dedicated security gateway (Mimecast, Barracuda, Proofpoint and similar) publish DMARC at 70% and enforce it at 46%; a gateway vendor usually configures the records during onboarding. Microsoft 365 dealers publish SPF almost universally (99%) and hard-fail it at 77%, because Microsoft's setup wizard writes that record, but only 34% enforce DMARC. Google Workspace dealers are the least protected large group: 38% publish DMARC, 15% enforce it, and only 7% hard-fail SPF, because Google's recommended record ends in a soft fail.

| Provider | Domains | SPF | SPF hard fail | DMARC | DMARC enforced | DMARC reject |
| --- | --- | --- | --- | --- | --- | --- |
| Microsoft 365 | 2,393 | 99% | 77% | 57% | 34% | 9% |
| Google Workspace | 900 | 71% | 7% | 38% | 15% | 6% |
| Security gateway | 915 | 93% | 48% | 70% | 46% | 18% |
| Other and self-managed | 2,794 | 67% | 20% | 46% | 16% | 7% |

*Authentication records by receiving mail provider, mail-receiving dealer domains, September 2026*

## Which brands and states enforce DMARC?

Brand matters because dealer groups standardise technology by franchise and because some manufacturers push security requirements through their dealer programmes. Mercedes-Benz stores lead at 40% enforced; Ford stores trail at 6%. The table covers brands with at least 150 dealer domains receiving mail; a store selling several brands is counted once per brand.

![Share of dealer domains enforcing DMARC by franchise brand, brands with 150 or more dealers receiving mail](/images/blog/dealer-email-auth-brands.svg)

*Share of dealer domains enforcing DMARC (p=quarantine or p=reject) by franchise brand, brands with 150 or more dealers receiving mail.*

| Brand | Domains | SPF | DMARC | DMARC enforced | DMARC reject | SPF without DMARC |
| --- | --- | --- | --- | --- | --- | --- |
| Mercedes-Benz | 228 | 88% | 72% | 40% | 18% | 18% |
| Audi | 190 | 93% | 76% | 40% | 17% | 17% |
| BMW | 226 | 89% | 71% | 37% | 15% | 19% |
| Volkswagen | 276 | 91% | 70% | 35% | 12% | 23% |
| Toyota | 529 | 79% | 57% | 34% | 13% | 27% |
| Honda | 554 | 79% | 50% | 29% | 11% | 32% |
| GMC | 607 | 84% | 59% | 29% | 11% | 28% |
| Buick | 530 | 81% | 57% | 29% | 10% | 28% |
| Acura | 162 | 80% | 48% | 25% | 10% | 35% |
| Nissan | 507 | 75% | 45% | 24% | 5% | 33% |
| Hyundai | 439 | 73% | 44% | 23% | 8% | 31% |
| Kia | 426 | 79% | 46% | 22% | 7% | 37% |
| Dodge | 1,133 | 78% | 48% | 22% | 7% | 33% |
| Ram | 1,080 | 78% | 48% | 22% | 7% | 34% |
| Jeep | 1,156 | 78% | 49% | 22% | 7% | 33% |
| Chrysler | 1,122 | 78% | 48% | 22% | 7% | 33% |
| Mazda | 281 | 73% | 40% | 21% | 7% | 36% |
| Subaru | 365 | 76% | 40% | 20% | 8% | 39% |
| Chevrolet | 1,345 | 75% | 43% | 16% | 6% | 36% |
| Cadillac | 213 | 59% | 37% | 16% | 7% | 28% |
| Ford | 542 | 44% | 19% | 6% | 2% | 28% |

*Authentication by franchise brand, brands with 150 or more dealer domains receiving mail*

By state the spread is wider. Florida dealers enforce DMARC at 44%; Michigan dealers at 12%. States with fewer than 100 dealer domains receiving mail are excluded.

![Share of dealer domains enforcing DMARC by state, states with 100 or more dealers receiving mail](/images/blog/dealer-email-auth-states.svg)

*Share of dealer domains enforcing DMARC by state, states with 100 or more dealers receiving mail.*

| State | Domains | SPF | DMARC | DMARC enforced | DMARC reject |
| --- | --- | --- | --- | --- | --- |
| Florida | 467 | 83% | 59% | 44% | 12% |
| Arizona | 105 | 80% | 51% | 36% | 13% |
| Georgia | 266 | 82% | 57% | 35% | 17% |
| New Jersey | 245 | 79% | 49% | 31% | 14% |
| Colorado | 118 | 81% | 52% | 30% | 12% |
| Virginia | 194 | 75% | 53% | 29% | 7% |
| North Carolina | 255 | 69% | 46% | 29% | 14% |
| California | 561 | 84% | 51% | 26% | 12% |
| Minnesota | 144 | 76% | 53% | 26% | 8% |
| Texas | 486 | 75% | 47% | 24% | 5% |
| New York | 439 | 77% | 43% | 23% | 8% |
| Tennessee | 176 | 76% | 43% | 22% | 7% |
| Massachusetts | 186 | 77% | 49% | 22% | 6% |
| Connecticut | 143 | 79% | 50% | 21% | 8% |
| Washington | 134 | 75% | 44% | 21% | 8% |
| Ohio | 329 | 73% | 46% | 19% | 7% |
| Alabama | 132 | 82% | 41% | 18% | 7% |
| Missouri | 163 | 66% | 38% | 17% | 5% |
| Illinois | 380 | 73% | 52% | 17% | 5% |
| Wisconsin | 154 | 66% | 40% | 17% | 4% |
| Iowa | 108 | 74% | 44% | 17% | 12% |
| South Carolina | 121 | 71% | 34% | 16% | 7% |
| Kentucky | 125 | 73% | 44% | 15% | 2% |
| Louisiana | 111 | 78% | 45% | 14% | 4% |
| Pennsylvania | 354 | 68% | 41% | 13% | 5% |
| Indiana | 196 | 59% | 36% | 12% | 5% |
| Michigan | 273 | 68% | 38% | 12% | 5% |

*Authentication by state, states with 100 or more dealer domains receiving mail*

## Who is authorised to send as a dealership?

An SPF record lists the services allowed to send on the domain's behalf, so the include mechanisms are a map of the dealership email stack. The most common families among mail-receiving dealer domains, counted once per domain: Microsoft 365 (2,960), Google Workspace (651), SendGrid (494), DealerSocket (354), Mimecast (255), Dealer.com (252), GoDaddy (245), CDK (235). Marketing platforms, CRM vendors and website providers sending on the dealership's domain each need their own aligned DKIM signature for DMARC to pass on their mail; an SPF include alone does not align the visible From address, which is why a dealership can have a tidy SPF record and still fail DMARC on its own service reminders.

## What should a dealership, a vendor and a sender do with this?

A dealership without DMARC should publish p=none with a reporting address this week, read the reports for a month to find every service sending in its name, give each one an aligned DKIM signature, then move to quarantine and reject. A dealership on Google Workspace should replace the default soft fail with a hard fail once every sender is listed. The [SPF, DKIM and DMARC guide](/blog/spf-dkim-dmarc-deep-dive) and the [DMARC alignment guide](/blog/dmarc-alignment-guide) walk through each step; the [one-click unsubscribe guide](/blog/one-click-unsubscribe-guide) covers the other bulk-sender requirement.

A vendor emailing dealerships should read the numbers the other way: a dealer domain with p=reject and a security gateway is a domain whose receiver will also scrutinise inbound mail, which is consistent with the [gateway benchmark](/blog/dealer-cold-email-deliverability-by-mail-gateway), where Mimecast-fronted dealers rejected 52 to 72% of cold sends as policy. Classify a dealer list by gateway and by DMARC posture before sending, route Microsoft-hosted recipients to Microsoft-hosted senders, and expect the strictest receivers where the strictest senders are. Provena runs every dealer campaign on a list classified this way as part of its [automotive outbound service](/solutions/automotive); the [SellMyRide case study](/case-studies/sellmyride) shows the routing in production (more in the [case study library](/case-studies)), the [email deliverability hub](/blog/category/email-deliverability) holds the rest of the series, and the [statistics index](/blog/car-dealership-cold-email-statistics) collects every number from this series.

## How was this measured?

Population: the 17,636 franchise dealership website domains from Provena's 2026 dealer census (manufacturer locator pages, with franchise brands and state recorded) that resolved cleanly; domains that failed to resolve after retries were excluded. Records: the root TXT record set was read for SPF (v=spf1, classified by its all mechanism), and the _dmarc subdomain TXT record for DMARC (v=DMARC1, classified by its p tag and the presence of a rua address). Resolution used public resolvers between 18 and 19 September 2026. Mail-receiving domains are those with a mail exchange record in the gateway census. Cohorts: brands with at least 150 and states with at least 100 mail-receiving domains. Limits: a DMARC policy on the organisational domain also covers subdomains unless overridden, and DKIM selectors cannot be enumerated from outside, so DKIM adoption is not reported; a record's presence does not prove the dealership's own senders align with it; the study is a snapshot of published DNS, not a measurement of delivered mail. Aggregate figures only; the domain list is not published.

## Sources

[Provena dealership email authentication census, September 2026, SPF and DMARC records of franchise dealer domains](https://www.provena-ai.com/editorial-standards). Record semantics follow [RFC 7208 (SPF)](https://www.rfc-editor.org/rfc/rfc7208) and [RFC 7489 (DMARC)](https://www.rfc-editor.org/rfc/rfc7489); sender requirements follow [Google's email sender guidelines](https://support.google.com/a/answer/81126) and [Microsoft's Outlook requirements for high volume senders](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730). Companion studies: [the dealership email gateway census](https://www.provena-ai.com/blog/dealership-email-gateway-census) and [the 43,302-send deliverability benchmark](https://www.provena-ai.com/blog/dealer-cold-email-deliverability-by-mail-gateway).

## Frequently asked questions

### How many car dealerships use DMARC?

Among 8,032 US franchise dealership domains that receive mail, 47% publish a DMARC record, but only 23% enforce it with a quarantine or reject policy and 8% reject spoofed mail outright. 24% run the monitoring-only p=none policy.

### Do car dealerships have SPF records?

75% of mail-receiving franchise dealer domains publish SPF, and 37% end it with a hard fail. Microsoft 365 dealers are close to universal because Microsoft's setup writes the record; Google Workspace dealers mostly carry Google's default soft fail.

### Can someone spoof a car dealership's email address?

On 32% of mail-receiving dealer domains, yes, in the sense that they publish SPF but no DMARC, so nothing tells a receiver to reject mail carrying the dealership's From address. A further 24% publish DMARC at p=none, which reports spoofing but does not block it. Only 23% enforce a policy.

### Which dealership brands are best at email authentication?

By DMARC enforcement, Mercedes-Benz stores lead at 40% of domains and Ford stores trail at 6%, among brands with at least 150 dealer domains receiving mail. Dealers behind a security gateway enforce at 46% regardless of brand.

### Does a dealership need DMARC to email customers?

Google and Yahoo have required SPF, DKIM and DMARC from bulk senders since 2024 and Microsoft since 2025, so a dealership sending service reminders, recall notices or offers at volume without DMARC risks its own mail being filtered. Beyond compliance, DMARC is what stops a third party sending mail in the dealership's name to its customers.

## Sources

- [Provena dealership email authentication census, September 2026, SPF and DMARC records of franchise dealer domains](https://www.provena-ai.com/editorial-standards)
- [RFC 7208 (SPF)](https://www.rfc-editor.org/rfc/rfc7208)
- [RFC 7489 (DMARC)](https://www.rfc-editor.org/rfc/rfc7489)
- [Google's email sender guidelines](https://support.google.com/a/answer/81126)
- [Microsoft's Outlook requirements for high volume senders](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730)
- [the dealership email gateway census](https://www.provena-ai.com/blog/dealership-email-gateway-census)
- [the 43,302-send deliverability benchmark](https://www.provena-ai.com/blog/dealer-cold-email-deliverability-by-mail-gateway)

---
Source: https://www.provena-ai.com/blog/dealership-email-authentication-census