Spoofhound research · 2026-11-09
State of DMARC 2026 — Denmark
When Danish domains enforce DMARC, most go all the way to p=reject. Six in ten still don’t enforce at all.
Spoofhound scanned the Danish web: 9,946 mail-receiving domains across Denmark’s popular websites and mapped local businesses, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
Six in ten Danish domains that receive email can be impersonated. Of 9,946 mail-receiving domains checked, 6,066 (61.0%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •39.0% enforce DMARC, among the highest rates we have measured. That is lower than Saudi Arabia (45.7%) and Norway (40.4%), and ahead of Singapore (37.8%). See how every country we have measured compares.
- •26.5% use p=reject, among the highest rates we have measured, below Saudi Arabia (32.4%). Two in three Danish domains that enforce DMARC block fakes outright rather than send them to spam.
- •Small businesses: 34.5%. Danish businesses with one to three locations enforce DMARC at 34.5%, level with Norway (34.7%) and twice the rate in Sweden (17.7%). Nearly one in four (23.8%) uses p=reject.
The average Danish domain scores 38.9 out of 100 on the full email-security check, and 70.7% have at least one problem worth fixing.
DMARC across the Danish web
61% of Danish mail-receiving domains are open to impersonation
6,066 of 9,946 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
Denmark splits into three groups of similar size: no DMARC record (29.8%), p=none (30.8%) and p=reject (26.5%). Of the 3,067 domains that stop at p=none, 2,143 don’t ask for DMARC reports, so their record neither blocks fakes nor tells anyone about them. The reports are what show every service sending mail in a domain’s name. Reading them and finishing the job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 1,542 (15.5%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 397 (4.0%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 28 |
| MTA-STS | Protects inbound mail against interception: adopted (41 of these in testing mode only) | 102 (1.0%) |
| TLS-RPT | Reports failed secure delivery: adopted | 229 (2.3%) |
| BIMI | Verified logo in the inbox: live | 133 (1.3%) |
SPF lags behind DMARC in Denmark: one domain in six (15.5%) has no SPF record, and another 4.0% publish one that ends +all or ?all, which permits every server anyway. The newer standards have a foothold: about 2 in 100 domains use MTA-STS, TLS-RPT or BIMI.
Small businesses against bigger ones
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| Danish businesses with 1–3 locations (shops, offices, trades) | 7,607 | 32.5% | 32.6% | 34.5% |
| Danish businesses with 4–9 locations | 128 | 10.2% | 25.8% | 63.3% |
| Danish businesses with 10 or more locations | 70 | 4.3% | 14.3% | 80.0% |
| Denmark’s top-100,000-ranked .dk websites | 147 | 7.5% | 19.0% | 73.5% |
Four in five Danish businesses with ten or more locations enforce DMARC. Small businesses are better protected than in almost any country we have measured, and 23.8% of them use p=reject, nearly twice the rate among Dutch small businesses (13.1%). Still, two in three of them (65.1%) have no record or stop at p=none.
Who is most exposed
Florists, farm shops and hairdressers are the least protected Danish trades
Share of each sector’s mail-receiving domains at p=quarantine or p=reject (domains checked in brackets).
Florists (79)
Farm shops (285)
Hairdressers (310)
Car repair garages (235)
Beauty salons (113)
Clothes shops (250)
Jewellers (84)
Bicycle shops (223)
Bakeries (181)
Butchers (92)
Car dealers (249)
Supermarkets (61)
Furniture shops (66)
Electricians (66)
Company offices (759)
IT companies (99)
Dashed line: Denmark average (39.0%).
Every sector we can measure is below the national average except furniture shops, electricians, company offices and IT companies. Florists (20.3%), farm shops (22.1%) and hairdressers (22.9%) are the least protected. IT companies lead at 58.6%. Too few accountants, law firms and estate agents are mapped in Denmark to show them.
Methodology
Population. 9,946 Danish domains that receive email (they publish working MX records). They come from two sources:
- Danish businesses mapped on OpenStreetMap with a website of their own, on any domain ending: 7,898 domains
- every .dk domain in the Tranco top-1-million popularity ranking: 2,497 mail-receiving domains
449 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded. Businesses mapped in Denmark but using a German, Swedish or Norwegian domain are counted under that country.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-09.
Honest limits.
- Public sector. Danish public bodies mostly use plain .dk domains, so we can identify only 93 of them (offices mapped as government, 0.9% of the sample). That is too few to compare with businesses, so this report has no government section. Without them the headline figure is 38.5%.
- Sample skew. The business sample covers mapped businesses with websites, which leans towards visible, consumer-facing trades. Sector figures rest on 61 to 759 domains each, and the groups with four or more locations on fewer than 130 domains each.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free