Spoofhound research · 2026-11-09
State of DMARC 2026 — Australia
Seven in ten Australian domains can be impersonated by email.
Spoofhound scanned the Australian web: 19,343 mail-receiving domains across the country’s popular websites and mapped local businesses and public bodies in every state and territory, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
Seven in ten Australian domains that receive email can be impersonated. Of 19,343 mail-receiving domains checked, 13,683 (70.7%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •29.3% enforce DMARC. That is behind Saudi Arabia (45.7%), Singapore (37.8%), South Africa (34.1%) and the Netherlands (30.6%), and ahead of Brazil (25.3%) and the UK (24.5%). Counting businesses only, Australia is at 28.0%. See how every country we have measured compares.
- •When Australians enforce, half go all the way. Of the 5,660 domains that enforce DMARC, 2,808 use p=reject, which blocks fakes outright: 14.5% of all domains, behind Saudi Arabia (32.4%), Singapore (21.2%), South Africa (20.3%) and the Netherlands (14.7%).
- •The size gap: 21.4% against 66.9%. Australian businesses with one to three locations enforce DMARC at 21.4%. Two in three businesses with ten or more locations (66.9%) do, and so do 70.3% of Australia’s top-100,000-ranked .au websites.
The average Australian domain scores 35.6 out of 100 on the full email-security check, and 76.8% have at least one problem worth fixing.
DMARC across the Australian web
71% of Australian mail-receiving domains are open to impersonation
13,683 of 19,343 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
Australia splits exactly between domains with no DMARC record (35.2%) and domains that publish one but leave it at p=none (35.1%). More than half of the p=none group (3,851) don’t ask for DMARC reports, so their record neither blocks fakes nor tells anyone about them. The reports are what show every service sending mail in a domain’s name. Reading them and finishing the job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 1,692 (8.7%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 364 (1.9%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 86 |
| MTA-STS | Protects inbound mail against interception: adopted (145 of these in testing mode only) | 308 (1.6%) |
| TLS-RPT | Reports failed secure delivery: adopted | 394 (2.0%) |
| BIMI | Verified logo in the inbox: live | 315 (1.6%) |
Fewer than one Australian domain in eleven (8.7%) has no SPF record. The newer standards have a foothold: about 2 in 100 domains use MTA-STS, TLS-RPT or BIMI, more than in Brazil, Argentina, Taiwan or Singapore, published alongside this report. Nearly half the MTA-STS policies (145 of 308) are still in testing mode, which protects nothing yet.
Small businesses against bigger ones
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| Australian businesses with 1–3 locations (shops, offices, trades) | 11,668 | 42.3% | 35.8% | 21.4% |
| Australian businesses with 4–9 locations | 208 | 9.6% | 35.1% | 55.3% |
| Australian businesses with 10 or more locations | 133 | 3.8% | 29.3% | 66.9% |
| Australia’s top-100,000-ranked .au websites | 474 | 10.8% | 18.8% | 70.3% |
The size gap is sharp. Once a business has four or more locations, more than half enforce DMARC, and almost none (3.8% of the largest) lack a record. Small businesses are the opposite: 42.3% have no record at all, and 84.4% carry at least one email-security problem.
Government against small businesses
Public bodies are an obvious target for impostor email. We compared the public-sector domains we can identify (.gov.au and .edu.au domains, and offices mapped as government) with Australia’s small businesses:
| Population | Domains | No DMARC record | Monitor only | p=quarantine | p=reject | Enforced |
|---|---|---|---|---|---|---|
| Australian government and education domains | 717 | 20.1% | 17.2% | 21.5% | 41.3% | 62.8% |
| Australian businesses with 1–3 locations | 11,668 | 42.3% | 35.8% | 12.5% | 8.9% | 21.4% |
Public-sector domains are three times as likely to enforce DMARC as small businesses, and two in three of those that enforce use p=reject. Still, one in three (37.3%) has no record or stops at p=none.
Who is most exposed
Hairdressers, bakeries and beauty salons protect about one domain in ten
Share of each sector’s mail-receiving domains at p=quarantine or p=reject (domains checked in brackets).
Hairdressers (325)
Bakeries (251)
Beauty salons (252)
Jewellers (107)
Florists (136)
Bicycle shops (201)
Car repair garages (347)
Wineries (175)
Architects (99)
Furniture shops (166)
Supermarkets (162)
Real estate agents (392)
Clothes shops (492)
Accountants (181)
Company offices (603)
Law firms (275)
Car dealers (350)
Financial services (89)
IT companies (138)
Blue: professions that handle client money · dashed line: Australia average (29.3%).
Consumer trades sit far below the national average: hairdressers (7.1%), bakeries (9.2%) and beauty salons (10.3%). Most professions that handle client money do better: accountants (33.7%), law firms (36.7%) and financial services (43.8%) are all above it. Real estate agents, who handle deposits and rent, are the exception at 24.0%. IT companies lead at 47.8%.
Methodology
Population. 19,343 Australian domains that receive email (they publish working MX records). They come from two sources:
- Australian businesses and public bodies mapped on OpenStreetMap with a website of their own, on any domain ending: 12,206 domains
- every .au domain in the Tranco top-1-million popularity ranking: 7,968 mail-receiving domains
831 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-09.
Honest limits.
- Public sector. Government and education domains we can identify (.gov.au, .edu.au, and offices mapped as government) are 717 domains, 3.7% of the sample, and enforce DMARC at 62.8%. Without them the figure is 28.0%, so the headline is in effect a business figure.
- Sample skew. The business sample covers mapped businesses with websites, which leans towards visible, consumer-facing trades. Sector figures rest on 89 to 603 domains each.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free