Spoofhound research · 2026-11-09
State of DMARC 2026 — Brazil
Three in four Brazilian domains can be impersonated by email.
Spoofhound scanned the Brazilian web: 24,186 mail-receiving domains across the country’s popular websites and mapped local businesses and public bodies in every state, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
Three in four Brazilian domains that receive email can be impersonated. Of 24,186 mail-receiving domains checked, 18,058 (74.7%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •25.3% enforce DMARC. That is level with Spain (25.2%) and India (24.9%), behind Australia (29.3%) and ahead of the UK (24.5%). Counting businesses only, Brazil is at 24.2%. See how every country we have measured compares.
- •Most protection stops at quarantine. Of the 6,128 Brazilian domains that enforce DMARC, two in three (3,946) use p=quarantine, which sends fakes to the spam folder. Only 2,182, 9.0% of all domains, use p=reject, which blocks them outright.
- •The small-business gap: 18.6% against 51.0%. Brazilian businesses with one to three locations enforce DMARC at 18.6%. Brazil’s top-100,000-ranked .br websites manage 51.0%.
The average Brazilian domain scores 35.2 out of 100 on the full email-security check, and 81.0% have at least one problem worth fixing.
DMARC across the Brazilian web
75% of Brazilian mail-receiving domains are open to impersonation
18,058 of 24,186 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
Monitor-only is the most common setting in Brazil: 41.0% of domains publish DMARC at p=none, against 32.2% with no record at all. Just over half of the p=none group (5,219) don’t ask for DMARC reports, so their record neither blocks fakes nor tells anyone about them. The reports are what show every service sending mail in a domain’s name. Reading them and finishing the job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 1,613 (6.7%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 1,255 (5.2%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 49 |
| MTA-STS | Protects inbound mail against interception: adopted (42 of these in testing mode only) | 90 (0.4%) |
| TLS-RPT | Reports failed secure delivery: adopted | 160 (0.7%) |
| BIMI | Verified logo in the inbox: live | 259 (1.1%) |
Few Brazilian domains lack SPF (6.7%), but one in twenty (5.2%) publish a record that ends +all or ?all and so permits any server anyway: among the highest shares we have measured, though below South Africa (11.1%) and France (7.2%). The newer standards have barely arrived: about 1 in 100 domains use MTA-STS, TLS-RPT or BIMI.
Small businesses against bigger ones
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| Brazilian businesses with 1–3 locations (shops, offices, trades) | 7,597 | 39.9% | 40.2% | 18.6% |
| Brazilian businesses with 4–9 locations | 191 | 22.0% | 31.4% | 45.5% |
| Brazilian businesses with 10 or more locations | 74 | 8.1% | 37.8% | 52.7% |
| Brazil’s top-100,000-ranked .br websites | 1,253 | 15.7% | 32.4% | 51.0% |
Protection rises steeply with size: businesses with four or more locations enforce DMARC at more than twice the rate of small ones. Small businesses are split evenly between no record (39.9%) and p=none (40.2%), and 86.4% carry at least one email-security problem.
Government against small businesses
Public bodies are an obvious target for impostor email. We compared the public-sector domains we can identify (.gov.br, .edu.br, .mil.br, .jus.br, .leg.br and .mp.br domains, and offices mapped as government) with Brazil’s small businesses:
| Population | Domains | No DMARC record | Monitor only | p=quarantine | p=reject | Enforced |
|---|---|---|---|---|---|---|
| Brazilian public-sector domains we can identify | 1,732 | 28.1% | 30.7% | 28.3% | 12.2% | 40.5% |
| Brazilian businesses with 1–3 locations | 7,597 | 39.9% | 40.2% | 12.5% | 6.1% | 18.6% |
Public-sector domains are twice as likely to enforce DMARC as small businesses, but most (58.8%) still have no record or stop at p=none. Those that enforce mostly stop at quarantine: only 12.2% of public-sector domains use p=reject.
Who is most exposed
Law firms and estate agents sit well below the Brazilian average
Share of each sector’s mail-receiving domains at p=quarantine or p=reject (domains checked in brackets).
Bicycle shops (83)
Bakeries (117)
Computer shops (94)
Car repair garages (155)
Law firms (168)
Hardware shops (226)
Estate agents (307)
NGOs (144)
Clothes shops (295)
Car parts shops (99)
Furniture shops (159)
Associations (136)
Shopping centres (379)
Accountants (124)
Motorcycle dealers (90)
Car dealers (349)
Supermarkets (455)
Company offices (606)
Advertising agencies (83)
Schools and colleges (143)
IT companies (263)
Blue: professions that handle client money · dashed line: Brazil average (25.3%).
The professions that handle client money are no better protected. Law firms (12.5%), estate agents (14.3%) and accountants (22.6%) are all below the national average, though they handle the payments that impostor email targets. Bicycle shops (6.0%) and bakeries (7.7%) are the least protected; IT companies lead at 33.8%.
Methodology
Population. 24,186 Brazilian domains that receive email (they publish working MX records). They come from two sources:
- Brazilian businesses and public bodies mapped on OpenStreetMap with a website of their own, on any domain ending: 8,572 domains
- every .br domain in the Tranco top-1-million popularity ranking: 16,708 mail-receiving domains
1,094 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded. Businesses mapped in Brazil but using a neighbouring country’s domain are counted under that country.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-09.
Honest limits.
- Public sector. Public-sector domains we can identify (.gov.br, .edu.br, .mil.br, .jus.br, .leg.br, .mp.br, and offices mapped as government) are 1,732 domains, 7.2% of the sample, and enforce DMARC at 40.5%. Without them the figure is 24.2%.
- Sample skew. Two in three domains come from the popularity ranking, and the business sample covers mapped businesses with websites, which leans towards visible, consumer-facing trades. Sector figures rest on 83 to 606 domains each.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free