Spoofhound research · 2026-11-09
State of DMARC 2026 — Finland
More than four in five Finnish domains can be impersonated by email.
Spoofhound scanned the Finnish web: 9,153 mail-receiving domains across Finland’s popular websites and mapped local businesses, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
More than four in five Finnish domains that receive email can be impersonated. Of 9,153 mail-receiving domains checked, 7,600 (83.0%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •17.0% enforce DMARC. That is behind Argentina (19.5%) and the US (19.4%), and ahead of France (15.7%) and Italy (13.4%). See how every country we have measured compares.
- •48.6% have no DMARC record at all. That is level with the US (48.6%) and just below Taiwan (49.3%). Another 34.2% publish a record but stop at p=none.
- •Small businesses: 12.7%. Finnish businesses with one to three locations enforce DMARC at 12.7%, among the lowest we have measured, though above Italy (9.8%). More than half of them (54.7%) have no DMARC record at all.
The average Finnish domain scores 31.5 out of 100 on the full email-security check, and 88.3% have at least one problem worth fixing.
DMARC across the Finnish web
83% of Finnish mail-receiving domains are open to impersonation
7,600 of 9,153 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
The largest group of Finnish domains (48.6%) has no DMARC record at all. Of the 3,129 domains that stop at p=none, 1,938 (61.9%) don’t ask for DMARC reports, so their record neither blocks fakes nor tells anyone about them. The reports are what show every service sending mail in a domain’s name. Reading them and finishing the job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 810 (8.8%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 153 (1.7%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 23 |
| MTA-STS | Protects inbound mail against interception: adopted (16 of these in testing mode only) | 51 (0.6%) |
| TLS-RPT | Reports failed secure delivery: adopted | 81 (0.9%) |
| BIMI | Verified logo in the inbox: live | 69 (0.8%) |
Fewer than one Finnish domain in eleven (8.8%) has no SPF record. The newer standards have barely arrived: fewer than 1 in 100 domains use MTA-STS, TLS-RPT or BIMI.
Small businesses against bigger ones
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| Finnish businesses with 1–3 locations (shops, offices, trades) | 7,074 | 54.7% | 32.3% | 12.7% |
| Finnish businesses with 4–9 locations | 146 | 17.8% | 45.9% | 36.3% |
| Finnish businesses with 10 or more locations | 83 | 10.8% | 49.4% | 39.8% |
| Finland’s top-100,000-ranked .fi websites | 194 | 10.8% | 44.8% | 44.3% |
Bigger Finnish businesses are about three times as likely to enforce DMARC as small ones, but most still don’t: half of the businesses with ten or more locations (49.4%) and 44.8% of the most popular .fi websites stop at p=none. Small businesses mostly have no record at all, and 92.3% carry at least one email-security problem.
Who is most exposed
Florists, beauty salons and hairdressers protect about one domain in sixteen
Share of each sector’s mail-receiving domains at p=quarantine or p=reject (domains checked in brackets).
Florists (119)
Beauty salons (221)
Hairdressers (440)
Jewellers (76)
Clothes shops (263)
Bicycle shops (127)
Car repair garages (285)
Bakeries (108)
Car dealers (128)
Furniture shops (68)
Estate agents (100)
Hardware shops (106)
Accountants (64)
Company offices (947)
IT companies (82)
Blue: professions that handle client money · dashed line: Finland average (17.0%).
Consumer trades sit far below the national average: florists (5.0%), beauty salons (6.3%) and hairdressers (6.4%). The professions that handle client money do little better: estate agents enforce at 18.0% and accountants at 20.3%, close to the national average. IT companies lead at 40.2%.
Methodology
Population. 9,153 Finnish domains that receive email (they publish working MX records). They come from two sources:
- Finnish businesses mapped on OpenStreetMap with a website of their own, on any domain ending: 7,372 domains
- every .fi domain in the Tranco top-1-million popularity ranking: 2,250 mail-receiving domains
469 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded. Businesses mapped in Finland but using a Swedish or Russian domain (.se, .ru) are counted under that country.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-09.
Honest limits.
- Public sector. Finnish public bodies mostly use plain .fi domains, so we can identify only 69 of them (offices mapped as government, 0.8% of the sample). That is too few to compare with businesses, so this report has no government section. Without them the headline figure is 16.8%.
- Sample skew. The business sample covers mapped businesses with websites, which leans towards visible, consumer-facing trades. Sector figures rest on 64 to 947 domains each, and the groups with four or more locations on fewer than 150 domains each.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free