Spoofhound research · published 2026-10-17
State of DMARC 2026 — France
84% of French domains can be impersonated by email.
Spoofhound scanned the French web — every mail-receiving .fr domain in the Tranco top one million plus 63,069 mapped French businesses, 71,101 domains in all — with the same engine behind our free domain check. This is what French email security actually looks like in 2026.
Check your domain — freeThe headline
84% of French domains that receive email can be impersonated. Of 71,101 French mail-receiving domains checked, 59,920 either publish no DMARC at all, leave it in monitor-only mode, or have a broken record — so receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •84.3% of French mail-receiving domains have no enforced DMARC policy. Fewer than one in six (15.7%) tells the world to quarantine or reject impostors.
- •The small-business gap: 87% exposed, against 44% for the popular web. French businesses with one to three locations enforce DMARC at 13.4%; France’s top-100,000-ranked websites manage 55.8%. The companies least able to survive an invoice-fraud incident are the least protected.
- •The average French domain scores 32.8 out of 100 on the full email-security check (SPF, DKIM, DMARC, MTA-STS, TLS-RPT, BIMI); 89.9% have at least one problem worth fixing.
DMARC across the French web
Nearly half of French mail-receiving domains (47.4%) publish no DMARC record at all — the receiving server is given no policy and no reporting address, so the owner never learns their domain is being abused. Another 36.5% publish a record but leave it at p=none: they may receive reports, yet impostor mail still lands in inboxes. The 318 broken records (duplicates, misspelt policies like “quarentine”) are treated by receivers exactly like no record at all.
The rest of the stack
DMARC is the enforcement layer, but the scan covers the whole chain. Among the same 71,101 French mail-receiving domains:
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all — any server anywhere may send as the domain | 6,511 (9.2%) |
| SPF | Record ends +all or ?all — published, but permits everyone anyway | 5,132 (7.2%) |
| Microsoft 365 DKIM | Both signing selectors broken — their outgoing mail can fail authentication today | 158 |
| MTA-STS | Protects inbound mail against interception — adopted | 276 (0.4%) |
| TLS-RPT | Reports failed secure delivery — adopted | 414 (0.6%) |
| BIMI | Verified logo in the inbox — live | 532 (0.7%) |
The encryption and branding layers barely exist in France: fewer than one domain in a hundred has MTA-STS, TLS-RPT or BIMI. For early adopters that’s an opportunity — a verified logo and enforced transport security are still differentiators here, not table stakes.
Small businesses against the popular web
This is the split no other study measures: industry reports sample popular websites, which is precisely where the problem isn’t.
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| French businesses with 1–3 locations (shops, offices, trades) | 61,305 | 50.2% | 35.9% | 13.4% |
| France’s top-100,000-ranked websites | 1,472 | 13.4% | 30.7% | 55.8% |
The popular web has largely done the work — pushed by Google’s and Yahoo’s 2024 sender rules and by security teams. The bakery, the law office and the garage have nobody pushing: 86.6% of French small businesses can be impersonated by email, and most have no reporting address, so they would never find out. Yet these are the businesses where one fake invoice to a customer, or one spoofed message to their accountant, is an existential event.
Who is most exposed
Because the business data is mapped, exposure can be read by trade. Enforcement by sector, worst first (French businesses, sectors with 400+ checked domains):
| Sector | Domains | No DMARC record | Enforced |
|---|---|---|---|
| Hairdressers | 1,477 | 66.8% | 6.0% |
| Bookshops | 1,145 | 58.0% | 6.9% |
| Opticians | 916 | 56.6% | 7.5% |
| Wine merchants | 882 | 48.6% | 7.8% |
| Beauty salons | 1,256 | 54.9% | 8.0% |
| Garages / car repair | 1,243 | 67.7% | 8.5% |
| Bakeries | 1,048 | 56.3% | 9.3% |
| Car dealers | 1,447 | 61.1% | 9.6% |
| Estate agents | 3,771 | 59.0% | 10.2% |
| Clothes shops | 1,976 | 38.5% | 16.3% |
| Company offices | 5,041 | 38.3% | 26.7% |
| Government offices | 1,322 | 29.0% | 35.8% |
Two readings jump out. Estate agents — businesses that routinely email bank details for deposits and rent — enforce at 10.2%, with 59% publishing nothing at all; they are perhaps France’s highest-stakes unprotected sector. And the gradient from hairdressers (6%) to government (36%) tracks IT support, not risk: protection goes where the IT staff are, not where the fraud exposure is.
Methodology
Population. 71,101 French domains that receive email (publish working MX records), from two sources: every .fr domain in the Tranco top-1-million research ranking of popular websites (12,412 mail-receiving), and 63,069 French businesses mapped on OpenStreetMap with a website of their own (any domain ending; platform pages and social profiles excluded). 4,380 domains appear in both. Domains with no MX, and hosted-page domains the business doesn’t control, are excluded.
Checks. Each domain was scanned by Spoofhound’s own engine — the same one behind the free domain check — covering SPF, DKIM (29 common selectors), DMARC, MTA-STS, TLS-RPT and BIMI, via DNS and policy-file fetches. Every figure here reflects a scan within the 30 days to 2026-10-17.
Honest limits. DKIM can only be confirmed present, never absent, so no DKIM-absence claims are made. The business sample covers mapped businesses with websites, which skews towards visible, consumer-facing trades. “Enforced” means p=quarantine or p=reject on the organisational domain; pct<100 and broken records are counted as unenforced, as receivers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free