Email authentication at independent insurance agencies

By Tyler Mayberry · Cirlet. Published 2026-10-28. Page updated 2026-10-28.

Of 929 independent insurance agency website domains we checked on October 28, 2026, 86% published one SPF record, 51% published a DMARC record and only 26% asked receivers to quarantine or reject mail that fails.

We looked up public DNS records for the website domains of the 1,073 offices in the Independent Insurance Agencies directory, which Cirlet runs. We publish counts only. No agency or domain is named here or anywhere else.

What we found

SPF is common. 803 of 929 domains (86%) published exactly one SPF record. 117 (13%) published none, and 9 published more than one, which makes SPF fail.
DMARC is not. 454 domains (49%) published no DMARC record, so receivers get no instruction about mail that fails.
Most DMARC records only monitor. 221 domains (24%) published p=none. 142 chose quarantine and 111 reject. 244 (26%) enforced either at full strength.
Few ask for reports. 320 domains (34%) asked receivers to send the aggregate DMARC reports that show who sends mail as the domain.
Microsoft 365 hosts the most agency mail. Of the 862 domains with a mail server record, 396 (46%) used Microsoft 365 and 149 (17%) Google Workspace.

By mail provider

Provider	Domains	One SPF record	DMARC published	DMARC enforced
Microsoft 365	396	99%	59%	35%
Google Workspace	149	76%	46%	16%

Microsoft 365 setup for agencies · Google Workspace setup for agencies

By state

States with at least 25 domains in the sample. Small samples move a lot with a few agencies, so treat these as descriptions of this directory, not state rankings.

State	Domains	One SPF record	DMARC published	DMARC enforced
California	47	89%	47%	23%
Florida	38	84%	58%	42%
Illinois	36	81%	61%	31%
Massachusetts	25	72%	44%	32%
Michigan	36	92%	67%	33%
Missouri	180	87%	49%	28%
New York	45	84%	53%	27%
Ohio	33	88%	55%	24%
Pennsylvania	48	79%	48%	23%
Texas	65	83%	46%	20%
Wisconsin	28	89%	57%	25%

How we checked

Sample: 1,073 reviewed offices in the directory on October 28, 2026. We kept each office’s own website domain once (931 domains) and left out 1 offices whose site sits on a shared platform, social profile or carrier page.
Lookups: MX, SPF (TXT at the domain) and DMARC (TXT at _dmarc) through Cloudflare’s public DNS-over-HTTPS resolver. 2 domains failed to resolve and are excluded, leaving 929.
Enforced means one DMARC record with p=quarantine or p=reject and no pct below 100.
Assumption: an agency’s website domain is also its email domain. Some agencies send from a different domain, which this check would miss.
Not representative: the directory has more Missouri offices than any other state and grows by review, not by random sampling.
Privacy: per-domain results stay in a private working file and are not published. The aggregate counts are available to download.

What public records cannot show

A DMARC record says what receivers should do with failing mail. It does not show whether an agency’s accounts use multi-factor authentication, whether DKIM is signing, or whether staff would spot a convincing request. A domain without DMARC is not proof of a problem, and a domain with p=reject is not proof of safety.

Questions about the findings

What share of insurance agencies use DMARC?

In our October 2026 check of 929 independent agency domains, 51% published a DMARC record and 26% enforced it with quarantine or reject.

Why does DMARC matter for an insurance agency?

Without an enforced DMARC policy, receivers have no instruction to reject mail that falsely uses your domain. That makes it easier for someone to email clients or carriers as your agency, for example with changed payment instructions.

How can I check my own agency’s records?

Use the free email-domain check on a domain you are authorized to review, then give each open question an owner in the provider action plan.