Spoofhound research · 2026-11-09
State of DMARC 2026 — Iceland
Nearly three in four Icelandic domains can be impersonated by email.
Spoofhound scanned the Icelandic web: 843 mail-receiving domains across Iceland’s popular websites and mapped local businesses, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
Nearly three in four Icelandic domains that receive email can be impersonated. Of 843 mail-receiving domains checked, 618 (73.3%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •26.7% enforce DMARC. Among the Nordic countries that puts Iceland level with Sweden (26.4%), well behind Norway (40.4%) and Denmark (39.0%), and ahead of Finland (17.0%). See how every country we have measured compares.
- •Small businesses: 18.6%. Icelandic businesses with one to three locations enforce DMARC at 18.6%, about half the rate in Norway (34.7%) and Denmark (34.5%). Four in five of them (80.1%) have no record or stop at p=none.
- •38.4% stop at p=none. p=none is the largest group in Iceland, and 181 of those 324 domains don’t ask for DMARC reports either.
The average Icelandic domain scores 34.6 out of 100 on the full email-security check, and 80.0% have at least one problem worth fixing.
DMARC across the Icelandic web
73% of Icelandic mail-receiving domains are open to impersonation
618 of 843 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
A third of Icelandic domains (33.7%) have no DMARC record and more (38.4%) stop at p=none. A record at p=none without reports neither blocks fakes nor tells anyone about them. When Icelandic domains do enforce, slightly more use p=reject (14.2%) than p=quarantine (12.5%). The reports are what show every service sending mail in a domain’s name. Reading them and finishing the job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 79 (9.4%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 14 (1.7%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 3 |
| MTA-STS | Protects inbound mail against interception: adopted (6 of these in testing mode only) | 13 (1.5%) |
| TLS-RPT | Reports failed secure delivery: adopted | 18 (2.1%) |
| BIMI | Verified logo in the inbox: live | 11 (1.3%) |
About one Icelandic domain in eleven (9.4%) has no SPF record. The newer standards have a small foothold: 1 to 2 in 100 domains use MTA-STS, TLS-RPT or BIMI.
Small businesses against bigger ones
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| Icelandic businesses with 1–3 locations (shops, offices, trades) | 458 | 36.9% | 43.2% | 18.6% |
| Icelandic businesses with 4 or more locations | 16 | 12.5% | 37.5% | 50.0% |
| Iceland’s top-100,000-ranked .is websites | 36 | 25.0% | 22.2% | 52.8% |
Iceland’s most popular .is websites enforce DMARC at 52.8%, nearly three times the rate of its small businesses. Small businesses mostly stop at p=none (43.2%) or have no record (36.9%), and 84.9% carry at least one email-security problem. The bigger groups are small, so read their figures as a guide only.
Methodology
Population. 843 Icelandic domains that receive email (they publish working MX records). They come from two sources:
- Icelandic businesses mapped on OpenStreetMap with a website of their own, on any domain ending: 495 domains
- every .is domain in the Tranco top-1-million popularity ranking: 403 mail-receiving domains
55 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-09.
Honest limits.
- Sample size. This is one of the smallest samples in our series: 843 domains, against 928 in Saudi Arabia. That is too few to break down by sector, and the groups with four or more locations (16 domains) and the top-ranked websites (36) are small enough that one domain moves their figure by several points.
- Public sector. We can identify only 21 Icelandic public bodies (offices mapped as government), too few to compare with businesses, so this report has no government section. Without them the headline figure is 26.4%.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free