Spoofhound research · 2026-11-08
State of DMARC 2026 — India
Three in four Indian domains can be impersonated by email.
Spoofhound scanned the Indian web: 12,398 mail-receiving domains across the country’s popular websites and mapped local businesses, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
Three in four Indian domains that receive email can be impersonated. Of 12,398 mail-receiving domains checked, 9,316 (75.1%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •24.9% enforce DMARC. That’s level with the UK (24.5%) and ahead of France (15.7%), but behind South Africa (34.1%) and Saudi Arabia (45.7%). Counting businesses only, India is at 23.7%, against Saudi Arabia’s 37.8% and South Africa’s 33.6%.
- •Government sets no example: 32.3%. Indian government and university domains (.gov.in, .nic.in, .ac.in, .edu.in, .res.in) enforce DMARC at 32.3%. The UK public sector manages 74.7% and Saudi government and universities 82.4%.
- •The small-business gap: 27.7% against 48.2%. Indian businesses with one to three locations enforce DMARC at 27.7%. The country’s top-100,000-ranked .in websites manage 48.2%.
The average Indian domain scores 32.8 out of 100 on the full email-security check, and 80.4% have at least one problem worth fixing.
DMARC across the Indian web
75% of Indian mail-receiving domains are open to impersonation
9,316 of 12,398 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
India splits much like the UK: four in ten domains have no DMARC record (39.2%), a third publish one but leave it at p=none (33.9%), and only a quarter enforce. The monitor-only group matters most commercially. These organisations have already started and may well be receiving reports, but stopped short of the setting that actually blocks impostor mail. Finishing that job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 1,443 (11.6%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 111 (0.9%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 34 |
| MTA-STS | Protects inbound mail against interception: adopted (15 of these in testing mode only) | 36 (0.3%) |
| TLS-RPT | Reports failed secure delivery: adopted | 64 (0.5%) |
| BIMI | Verified logo in the inbox: live | 205 (1.7%) |
India’s weak spot is SPF. One in nine domains publishes no SPF record at all, twice South Africa’s rate (5.8%). The newer standards have barely arrived: fewer than 1 in 100 domains use MTA-STS or TLS-RPT. BIMI does better than either, at 1.7%, the same as South Africa.
Small businesses against the popular web
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| Indian businesses with 1–3 locations (shops, offices, trades) | 3,144 | 40.9% | 30.0% | 27.7% |
| India’s top-100,000-ranked .in websites | 782 | 25.1% | 24.3% | 48.2% |
The gap has the same shape as in every market scanned so far. Large, visible organisations have done more of the work, while 77.2% of small businesses still have at least one email-security problem. Four in ten publish no DMARC record at all, so they would never find out their domain was being used for fraud.
Who is most exposed
Only finance and government offices protect most Indian domains
Share of each sector’s mail-receiving domains at p=quarantine or p=reject (domains checked in brackets).
Computer shops (35)
Beauty salons (50)
Advertising agencies (55)
Travel agents (71)
Education offices (314)
Non-profits (57)
Supermarkets (88)
Jewellers (56)
Shopping malls (71)
Car dealers (43)
Clothes shops (179)
IT companies (212)
Company offices (580)
Government offices (116)
Financial offices (31)
Blue: businesses that take customer payments by transfer · dashed line: India average (24.9%).
Travel agents sit near the bottom at 14.1%, and they take large payments by bank transfer, which is what invoice fraud exploits. Education offices are the largest group in the sample after company offices, and only one in six enforces DMARC. IT companies, which sell technology to others, manage 34.0%: better than average, but two in three still leave their own name open.
Methodology
Population. 12,398 Indian domains that receive email (they publish working MX records). They come from two sources:
- every .in domain in the Tranco top-1-million popularity ranking: 9,398 mail-receiving domains
- Indian businesses mapped on OpenStreetMap with a website of their own, on any domain ending: 3,253 domains
253 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-08.
Honest limits.
- Popular web, not small business, drives the headline. Unlike the UK and South Africa, three in four Indian domains in the sample come from the Tranco ranking, not from mapped businesses. Few Indian businesses list a website on OpenStreetMap (about 6,700 against 40,599 in the UK).
- Small sector samples. Sector figures rest on 30 to 580 domains each and should be quoted as indicative.
- Sample skew. The business sample covers mapped businesses with websites, which leans towards visible, urban, consumer-facing trades.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free