Bitsight Adds DMARC to 2026 Rating Algorithm
Bitsight adds DMARC to its security ratings starting April 16 preview. DMARC now counts 1% toward overall ratings alongside SPF and DKIM, directly rewarding email authentication investment.
Marcus Webb
9 de abril de 2026

Starting April 16, 2026, DMARC will count toward an organization's Bitsight Security Rating for the first time, carrying a 1% weight in the platform's annual algorithm update. For businesses that have treated DMARC as a "nice to have," that posture now has a measurable cost on a score that insurers, vendors, and boards rely on to evaluate cyber risk.
What Changed and Why It Matters
DMARC will now contribute to the Bitsight Rating with a 1% weight, reallocated from the Compromised Systems category. This completes the trio of foundational email-based risk vectors: Sender Policy Framework (SPF) domains, DomainKeys Identified Mail (DKIM) records, and DMARC.
DMARC grades were already visible within the Bitsight platform, but prior to this update they had no impact on the overall rating. DKIM and SPF both carry a weight of 1%, and organizations that implement DMARC policies will now see that investment reflected directly in their Bitsight Rating.
The 2026 Bitsight Ratings Algorithm Update will be available for preview starting April 16. To ensure transparency and give organizations time to prepare, Bitsight is providing a three-month preview window before the update goes live.
The stakes here extend well beyond a single percentage point. From boardrooms to credit agencies, insurers to regulators, and compliance officers to SOC analysts, Bitsight Security Ratings are woven into the fabric of global commerce. The platform's rating system is correlated with breach likelihood and used widely by insurers and financial institutions. For marketing and growth teams, that means a weak DMARC posture can now indirectly affect cyber insurance premiums, vendor approvals, and procurement decisions, not just email deliverability.
What DMARC Actually Does
DMARC is an email authentication protocol that builds on SPF and DKIM by giving domain owners greater control over email authentication, including the ability to require either SPF or DKIM to pass for email to be considered authenticated, specify what action mail servers should take when authentication fails (such as rejecting or quarantining the message), and request authentication statistics from receiving mail servers to review the effectiveness of their implementation.
For email marketers, this has a direct deliverability dimension. Marketers are realizing that DMARC not only improves security but also boosts email deliverability. When ISPs see that a sender has a strong authentication posture, legitimate campaigns are less likely to be flagged as spam, which is critical for email marketing success.
The Adoption Gap That Creates Risk
The challenge is that most organizations have not yet reached full DMARC enforcement. DMARC adoption among top domains increased from 27.2% to 47.7% between 2023 and 2025, a 75% surge in protected domains, with enforcement policies (quarantine and reject) growing by 50% during this period. That growth sounds encouraging, but the enforcement detail tells a different story.


