Spoofhound research · 2026-11-08
State of DMARC 2026 — Italy
Nearly nine in ten Italian domains can be impersonated by email.
Spoofhound scanned the Italian web: 36,842 mail-receiving domains across the country’s popular websites and mapped local businesses in all 20 regions, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
Nearly nine in ten Italian domains that receive email can be impersonated. Of 36,842 mail-receiving domains checked, 31,888 (86.6%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •13.4% enforce DMARC, among the lowest we have measured. That is below France (15.7%) and well behind the UK (24.5%). Counting businesses only, Italy is at 13.3%. See how every country we have measured compares.
- •More than half stop at p=none: 54.9%. That is well above the Netherlands (42.1%). Three in four of these domains (15,235) do not even ask for DMARC reports, so their record neither blocks fakes nor tells anyone about them.
- •The small-business gap: 9.8% against 43.4%. Italian businesses with one to three locations enforce DMARC at 9.8%, among the lowest small-business figures we have measured. Italy’s top-100,000-ranked .it websites manage 43.4%.
The average Italian domain scores 31.1 out of 100 on the full email-security check, and 90.5% have at least one problem worth fixing.
DMARC across the Italian web
87% of Italian mail-receiving domains are open to impersonation
31,888 of 36,842 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
Italy’s problem is not missing records but unfinished ones. Most Italian domains publish a DMARC record, yet more than half leave it at p=none, and most of those don’t collect the reports that would show what to fix. Getting from p=none to enforcement takes those reports: they show every service that legitimately sends mail for the domain. Reading them and finishing that job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 2,594 (7.0%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 1,142 (3.1%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 53 |
| MTA-STS | Protects inbound mail against interception: adopted (55 of these in testing mode only) | 115 (0.3%) |
| TLS-RPT | Reports failed secure delivery: adopted | 183 (0.5%) |
| BIMI | Verified logo in the inbox: live | 279 (0.8%) |
Most Italian domains have the basics in place: only 7.0% have no SPF record. The gap is in the final step. The newer standards have barely arrived: fewer than 1 in 100 domains use MTA-STS, TLS-RPT or BIMI.
Small businesses against bigger ones
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| Italian businesses with 1–3 locations (shops, offices, trades) | 26,316 | 32.5% | 57.2% | 9.8% |
| Italian businesses with 4–9 locations | 252 | 15.5% | 55.2% | 29.0% |
| Italian businesses with 10 or more locations | 88 | 14.8% | 39.8% | 45.5% |
| Italy’s top-100,000-ranked .it websites | 822 | 17.8% | 38.7% | 43.4% |
Protection rises with size, but even Italy’s chains and best-known websites stop short: fewer than half enforce DMARC. Small businesses are furthest behind. Fewer than one in ten enforce, 57.2% sit at p=none and 93.3% carry at least one email-security problem.
Who is most exposed
Only IT companies protect more than one Italian domain in four
Share of each sector’s mail-receiving domains at p=quarantine or p=reject (domains checked in brackets).
Accountants (101)
Beauty salons (265)
Hairdressers (337)
Opticians (379)
Bakeries (354)
Bicycle shops (513)
Estate agents (755)
Wineries (637)
Car repair garages (707)
Jewellers (371)
Wine shops (534)
Travel agents (350)
Car dealers (718)
Furniture shops (685)
Clothes shops (1,132)
Law firms (128)
Supermarkets (360)
Insurance agents (114)
Company offices (2,260)
Government offices (324)
IT companies (415)
Blue: professions that handle client money · dashed line: Italy average (13.4%).
The professions that handle client money are among the least protected. Just 3 of 101 accountants enforce DMARC, and only 5.4% of estate agents, though both deal in exactly the payments and invoices that impostor email targets. The sample’s 637 wineries manage 5.5%. IT companies lead at 33.5%, and even there two in three leave their own name open.
Methodology
Population. 36,842 Italian domains that receive email (they publish working MX records). They come from two sources:
- Italian businesses mapped on OpenStreetMap with a website of their own, on any domain ending: 27,048 domains
- every .it domain in the Tranco top-1-million popularity ranking: 10,901 mail-receiving domains
1,107 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-08.
Honest limits.
- Public sector. Government, municipal, regional and school domains we can identify (.gov.it, comune., regione., provincia., .edu.it, and offices mapped as government) are 548 domains, 1.5% of the sample, and enforce DMARC at 22.3%. Without them the figure is 13.3%, so the headline is in effect a business figure.
- Sample skew. The business sample covers mapped businesses with websites, which leans towards visible, consumer-facing trades. Sector figures rest on 100 to 2,300 domains each.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free