Spoofhound research · 2026-11-09
State of DMARC 2026 — Argentina
Four in five Argentine domains can be impersonated by email.
Spoofhound scanned the Argentine web: 6,683 mail-receiving domains across the country’s popular websites and mapped local businesses and public bodies in every province, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
Four in five Argentine domains that receive email can be impersonated. Of 6,683 mail-receiving domains checked, 5,383 (80.5%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •19.5% enforce DMARC. That is level with the US (19.4%), behind Taiwan (20.8%) and Brazil (25.3%), and ahead of France (15.7%) and Italy (13.4%). Counting businesses only, Argentina is at 17.1%. See how every country we have measured compares.
- •Monitor-only is the norm. More than half of Argentine domains (3,522, 52.7%) publish DMARC but stop at p=none, among the highest shares we have measured, though below Italy (54.9%). Two in three of them (2,347) don’t ask for DMARC reports either.
- •Small businesses: 13.3%. Argentine businesses with one to three locations enforce DMARC at 13.3%, among the lowest we have measured, though above Italy (9.8%). Argentina’s top-100,000-ranked .ar websites manage 40.8%.
The average Argentine domain scores 35.2 out of 100 on the full email-security check, and 85.5% have at least one problem worth fixing.
DMARC across the Argentine web
81% of Argentine mail-receiving domains are open to impersonation
5,383 of 6,683 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
Most Argentine domains have taken the first step: only 27.3% have no DMARC record. But 52.7% stopped there, at p=none, and two in three of those (2,347) don’t ask for DMARC reports, so their record neither blocks fakes nor tells anyone about them. The reports are what show every service sending mail in a domain’s name. Reading them and finishing the job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 444 (6.6%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 79 (1.2%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 8 |
| MTA-STS | Protects inbound mail against interception: adopted (11 of these in testing mode only) | 22 (0.3%) |
| TLS-RPT | Reports failed secure delivery: adopted | 32 (0.5%) |
| BIMI | Verified logo in the inbox: live | 66 (1.0%) |
SPF is in good shape: only 6.6% of Argentine domains have none, among the lowest shares we have measured, though above Spain (4.9%), South Africa (5.8%) and the Netherlands (6.5%). The newer standards have barely arrived: about 1 in 100 domains use MTA-STS, TLS-RPT or BIMI.
Small businesses against bigger ones
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| Argentine businesses with 1–3 locations (shops, offices, trades) | 3,473 | 29.2% | 57.1% | 13.3% |
| Argentine businesses with 4–9 locations | 108 | 19.4% | 50.0% | 30.6% |
| Argentine businesses with 10 or more locations | 33 | 12.1% | 54.5% | 33.3% |
| Argentina’s top-100,000-ranked .ar websites | 267 | 21.7% | 37.5% | 40.8% |
Businesses with four or more locations enforce DMARC at more than twice the rate of small ones. Small businesses are the clearest case of the p=none habit: 57.1% publish a record and stop there, and 90.7% carry at least one email-security problem.
Government against small businesses
Public bodies are an obvious target for impostor email. We compared the public-sector domains we can identify (.gob.ar, .gov.ar, .edu.ar, .mil.ar and .int.ar domains, and offices mapped as government) with Argentina’s small businesses:
| Population | Domains | No DMARC record | Monitor only | p=quarantine | p=reject | Enforced |
|---|---|---|---|---|---|---|
| Argentine public-sector domains we can identify | 653 | 21.7% | 36.6% | 27.1% | 14.1% | 41.2% |
| Argentine businesses with 1–3 locations | 3,473 | 29.2% | 57.1% | 8.0% | 5.3% | 13.3% |
Public-sector domains are three times as likely to enforce DMARC as small businesses. Even so, most of them (58.3%) still have no record or stop at p=none, and two in three of those that enforce stop at quarantine rather than reject.
Who is most exposed
Most Argentine sectors protect fewer than one domain in seven
Share of each sector’s mail-receiving domains at p=quarantine or p=reject (domains checked in brackets).
Hardware shops (87)
Travel agents (66)
Bakeries (43)
Tyre shops (42)
Estate agents (165)
Motorcycle dealers (83)
Car parts shops (66)
Computer shops (99)
Car dealers (149)
Car repair garages (78)
Building and trade suppliers (85)
Paint shops (53)
Furniture shops (68)
Clothes shops (180)
Trade unions (42)
Supermarkets (66)
Electronics shops (75)
Company offices (268)
Associations (69)
Insurance agents (83)
Blue: professions that handle client money · dashed line: Argentina average (19.5%).
Almost every Argentine trade sits below the national average, most between 7% and 14%. Hardware shops (3.4%) and travel agents (4.5%) are the least protected, and estate agents, who handle deposits and rent, enforce at only 7.9%. Insurance agents lead at 31.3%. Sector figures rest on 42 to 268 domains each, so treat small differences between them as indicative.
Methodology
Population. 6,683 Argentine domains that receive email (they publish working MX records). They come from two sources:
- Argentine businesses and public bodies mapped on OpenStreetMap with a website of their own, on any domain ending: 3,831 domains
- every .ar domain in the Tranco top-1-million popularity ranking: 3,307 mail-receiving domains
455 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded. Businesses mapped in Argentina but using a neighbouring country’s domain (.cl, .uy, .py, .bo, .br) are counted under that country.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-09.
Honest limits.
- Public sector. Public-sector domains we can identify (.gob.ar, .gov.ar, .edu.ar, .mil.ar, .int.ar, and offices mapped as government) are 653 domains, 9.8% of the sample, and enforce DMARC at 41.2%. Without them the figure is 17.1%.
- Sample skew. The business sample covers mapped businesses with websites, which leans towards visible, consumer-facing trades. Sector figures rest on 42 to 268 domains each, and the group with ten or more locations on 33.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free