Spoofhound research · 2026-11-09
State of DMARC 2026 — Greece
Three in four Greek domains can be impersonated by email, and its public sector is among the least protected we have measured.
Spoofhound scanned the Greek web: 7,366 mail-receiving domains across Greece’s popular websites and mapped local businesses and public bodies, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
Three in four Greek domains that receive email can be impersonated. Of 7,366 mail-receiving domains checked, 5,571 (75.6%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •24.4% enforce DMARC. That is just behind the UK and Thailand (both 24.5%). Small businesses enforce at 22.4%, level with Spain. See how every country we have measured compares.
- •The public sector: 16.9%. Greek government and education domains enforce DMARC less often than Greek small businesses, and the Greek public sector is among the least protected we have measured, alongside Nigeria’s (16.8%). More than half (52.8%) have no DMARC record at all.
- •SPF is the bright spot: 3.8% have no SPF record, among the lowest shares we have measured, and below Spain (4.9%).
The average Greek domain scores 35.1 out of 100 on the full email-security check, and 88.5% have at least one problem worth fixing.
DMARC across the Greek web
76% of Greek mail-receiving domains are open to impersonation
5,571 of 7,366 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
The largest group of Greek domains (42.3%) publishes a DMARC record but stops at p=none, and 2,125 of those 3,115 don’t ask for DMARC reports, so their record neither blocks fakes nor tells anyone about them. When Greek domains do enforce, most stop at p=quarantine: 17.2% of all domains, against 7.2% at p=reject. The reports are what show every service sending mail in a domain’s name. Reading them and finishing the job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 283 (3.8%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 214 (2.9%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 13 |
| MTA-STS | Protects inbound mail against interception: adopted (7 of these in testing mode only) | 19 (0.3%) |
| TLS-RPT | Reports failed secure delivery: adopted | 27 (0.4%) |
| BIMI | Verified logo in the inbox: live | 53 (0.7%) |
Almost every Greek domain publishes SPF: only 3.8% have no record, though another 2.9% publish one that ends +all or ?all, which permits every server anyway. The newer standards have barely arrived: fewer than 1 in 100 domains use MTA-STS, TLS-RPT or BIMI.
Small businesses against bigger ones
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| Greek businesses with 1–3 locations (shops, offices, trades) | 3,618 | 36.3% | 40.9% | 22.4% |
| Greek businesses with 4 or more locations | 95 | 7.4% | 49.5% | 43.2% |
| Greece’s top-100,000-ranked .gr websites | 283 | 25.1% | 37.8% | 36.7% |
Greek businesses with four or more locations enforce DMARC at nearly twice the rate of small ones, but half of them (49.5%) stop at p=none. Even among Greece’s most popular .gr websites, a quarter (25.1%) have no DMARC record. Small businesses split between no record (36.3%) and p=none (40.9%), and 90.5% carry at least one email-security problem.
Government against small businesses
Public bodies are an obvious target for impostor email. We compared the public-sector domains we can identify (.gov.gr and .edu.gr domains, and offices mapped as government) with Greece’s small businesses:
| Population | Domains | No DMARC record | Monitor only | p=quarantine | p=reject | Enforced |
|---|---|---|---|---|---|---|
| Greek government and education domains | 142 | 52.8% | 30.3% | 9.9% | 7.0% | 16.9% |
| Greek businesses with 1–3 locations | 3,618 | 36.3% | 40.9% | 16.3% | 6.1% | 22.4% |
In Greece, as in Nigeria, the public sector enforces DMARC less often than small businesses. More than half of public-sector domains have no DMARC record at all, against 36.3% of small businesses. Of the 69 .gov.gr government domains, 53.6% have no record and only 2 use p=reject. Singapore’s public sector, one of the strongest we have measured, enforces at 91.2%.
Who is most exposed
No Greek sector we can measure protects even one domain in three
Share of each sector’s mail-receiving domains at p=quarantine or p=reject (domains checked in brackets).
Bookshops (71)
Bicycle shops (60)
Jewellers (64)
Car repair garages (75)
Furniture shops (89)
Computer shops (84)
Electronics shops (72)
Travel agents (72)
Clothes shops (222)
Company offices (192)
Supermarkets (65)
Dashed line: Greece average (24.4%).
Greek sectors sit close together, between bookshops (15.5%) and supermarkets (30.8%). Travel agents, who take customers’ payments, enforce at 25.0%, about the national average. Too few accountants and law firms are mapped in Greece to show them.
Methodology
Population. 7,366 Greek domains that receive email (they publish working MX records). They come from two sources:
- Greek businesses and public bodies mapped on OpenStreetMap with a website of their own, on any domain ending: 3,781 domains
- every .gr domain in the Tranco top-1-million popularity ranking: 4,051 mail-receiving domains
466 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-09.
Honest limits.
- Public sector. Government and education domains we can identify (.gov.gr, .edu.gr, and offices mapped as government) are 142 domains, 1.9% of the sample, and enforce DMARC at 16.9%. Without them the figure is 24.5%. Many Greek public bodies use other domain endings and are counted with everyone else.
- Sample skew. The business sample covers mapped businesses with websites, which leans towards visible, consumer-facing trades. Sector figures rest on 60 to 222 domains each, and the group with four or more locations on 95.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free