service/email.md

@@ -68,7 +68,7 @@ Interestingly, ran by [sparkpost](https://www.sparkpost.com/).
 
 ## Installation
 
-<!-- how to setup the service from scratch -->
+<!-- TODO: how to setup the service from scratch -->
 
 ### Manual DKIM configuration
 
@@ -290,7 +290,9 @@ reject attempts from servers not in the `A` or `AAAA` record of
 [DMARC](https://en.wikipedia.org/wiki/DMARC) records glue together SPF and DKIM to tell which *policy*
 to apply once the rules defined above check out (or not). It is
 defined in [RFC7489](https://www.rfc-editor.org/rfc/rfc7489.html) and has a [friendly homepage](https://dmarc.org/) with a [good
-introduction](https://dmarc.org/overview/).
+introduction](https://dmarc.org/overview/). Note that DMARC usage has been growing steadily
+since 2018 and more steeply since 2021, see the [usage stats](https://dmarc.org/stats/dmarc/). See
+also the [Alex top site usage](https://dmarc.org/stats/alexa-top-sites/).
 
 Our current DMARC policy is: