Spoofhound research · 2026-11-10
State of DMARC 2026 — Germany
Nearly three in four German domains can be impersonated by email.
Spoofhound scanned the German web: 199,513 mail-receiving domains across Germany’s mapped businesses and public bodies and its popular websites, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
Nearly three in four German domains that receive email can be impersonated. Of 199,513 mail-receiving domains checked, 144,813 (72.6%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •27.4% enforce DMARC. That is ahead of the UK (24.5%) and France (15.7%), and behind the Netherlands (30.6%) and Denmark (39.0%). See how every country we have measured compares.
- •The small-business gap: 26.3% against 45.1%. German businesses with one to three locations enforce DMARC at 26.3%. Germany’s .de websites ranked in the global top 100,000 manage 45.1%.
- •Money-handling professions sit at the average. Law firms (27.8%), notaries (27.7%), estate agents (26.6%) and tax advisers (25.2%) are no better protected than German businesses as a whole, though they handle the payments impostor email targets.
The average German domain scores 28.5 out of 100 on the full email-security check, and 91.3% have at least one problem worth fixing.
DMARC across the German web
73% of German mail-receiving domains are open to impersonation
144,813 of 199,513 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
German domains split between no DMARC record (38.5%) and p=none (33.9%). Of the 67,734 at p=none, 53,127 (78.4%) don’t ask for DMARC reports, so their record neither blocks fakes nor tells anyone about them. Those that do enforce mostly go all the way: p=reject (18.2%) is twice as common as p=quarantine (9.2%). The reports are what show every service sending mail in a domain’s name. Reading them and finishing the job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 32,449 (16.3%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 5,815 (2.9%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 411 |
| MTA-STS | Protects inbound mail against interception: adopted (347 of these in testing mode only) | 1,581 (0.8%) |
| TLS-RPT | Reports failed secure delivery: adopted | 1,792 (0.9%) |
| BIMI | Verified logo in the inbox: live | 1,217 (0.6%) |
One German domain in six (16.3%) has no SPF record, close to the US (17.8%). Without SPF, a business can’t reach DMARC enforcement without breaking its own mail. The newer standards have barely arrived: fewer than 1 in 100 domains use MTA-STS, TLS-RPT or BIMI.
Small businesses against bigger ones
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| German businesses with 1–3 locations (shops, offices, trades) | 169,234 | 39.4% | 34.2% | 26.3% |
| German businesses with 4–9 locations | 2,376 | 31.7% | 35.0% | 33.2% |
| German businesses with 10 or more locations | 1,090 | 22.2% | 37.4% | 40.2% |
| Germany’s .de websites ranked in the global top 100,000 | 2,045 | 20.7% | 33.9% | 45.1% |
Protection rises with size, but less steeply than in the US: German businesses with ten or more locations reach 40.2%, against 62.1% in the US. Small businesses are most of the sample, and 93.2% of them carry at least one email-security problem. They are the firms fake-invoice fraud hits hardest, because they have no security team to notice.
Government against small businesses
Public bodies are an obvious target for impostor email. We compared the public-sector domains we can identify (offices mapped as government on OpenStreetMap) with Germany’s small businesses:
| Population | Domains | No DMARC record | Monitor only | p=quarantine | p=reject | Enforced |
|---|---|---|---|---|---|---|
| German government offices | 1,350 | 39.4% | 26.4% | 15.9% | 18.1% | 34.1% |
| German businesses with 1–3 locations | 169,234 | 39.4% | 34.2% | 8.1% | 18.2% | 26.3% |
German public bodies do better than small businesses (34.1% against 26.3%), but just as many have no DMARC record at all (39.4%). Next door, Dutch government domains enforce DMARC at 80.7%, more than twice the German rate.
Who is most exposed
German professions that handle client money are no better protected than average
Share of each sector’s mail-receiving domains at p=quarantine or p=reject (domains checked in brackets).
Church and religious offices (948)
Bookshops (1,325)
Butchers (2,448)
Hairdressers (6,192)
Bakeries (3,133)
Opticians (2,628)
Clothes shops (4,674)
Florists (2,057)
Tax advisers (1,636)
Bicycle shops (3,626)
Car dealers (4,721)
Estate agents (2,162)
Financial advisers (184)
Accountants (281)
Notaries (267)
Law firms (3,254)
Car repair garages (5,996)
Insurance agents (793)
Company offices (20,255)
Financial offices (130)
Computer shops (1,097)
Energy suppliers (228)
IT companies (3,470)
Blue: professions that handle client money · dashed line: German average (27.4%).
Tax advisers (25.2%), estate agents (26.6%), notaries (27.7%) and law firms (27.8%) all sit close to the German average, though they handle the deposits, fees and purchase payments that impostor email targets. In the Netherlands, notaries lead at 52.3%. Insurance agents (32.3%) and financial offices (34.6%) do a little better. High-street shops cluster just above one in five, and church and religious offices come last at 18.5%. IT companies lead at 43.6%.
Methodology
Population. 199,513 German domains that receive email (they publish working MX records). They come from two sources:
- German businesses and organisations mapped on OpenStreetMap with a website of their own, on any domain ending: 174,048 domains
- every .de domain in the Tranco top-1-million popularity ranking: 30,449 mail-receiving domains
4,984 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-10.
Honest limits.
- Government domains. The 1,350 government domains are offices mapped as government on OpenStreetMap. German public bodies use ordinary .de names, with no government-only ending to find them by, so this is a sample of government, not all of it. It is 0.7% of the total, so the headline is in effect a business figure (27.4% without it too).
- Sample skew. The business sample covers mapped businesses with websites, which leans towards visible, consumer-facing trades. Sector figures rest on 130 to 20,255 domains each.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free