Spoofhound research · 2026-11-10
State of DMARC 2026 — Japan
Nearly nine in ten Japanese domains can be impersonated by email.
Spoofhound scanned the Japanese web: 25,956 mail-receiving domains across Japan’s popular websites and mapped businesses and public bodies, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
Nearly nine in ten Japanese domains that receive email can be impersonated. Of 25,956 mail-receiving domains checked, 23,061 (88.8%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •11.2% enforce DMARC. That is below Italy (13.4%), ahead of South Korea (5.8%), and about half the rate in Taiwan (20.8%). See how every country we have measured compares.
- •The small-business gap: 7.1% against 25.3%. Japanese businesses with one to three locations enforce DMARC at 7.1%. Japan’s .jp websites ranked in the global top 100,000 manage 25.3%.
- •Nearly half stop at p=none: 45.9%. That is more than in the Netherlands (42.1%), though less than Italy (54.9%). 6,858 of these 11,922 Japanese domains don’t even ask for DMARC reports.
The average Japanese domain scores 29.1 out of 100 on the full email-security check, and 92.1% have at least one problem worth fixing.
DMARC across the Japanese web
89% of Japanese mail-receiving domains are open to impersonation
23,061 of 25,956 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
Japanese domains split almost evenly between no DMARC record (42.8%) and p=none (45.9%). Of the 11,922 at p=none, 6,858 (57.5%) don’t ask for DMARC reports, so their record neither blocks fakes nor tells anyone about them. Those that enforce mostly choose p=quarantine (7.4%) over p=reject (3.8%). The reports are what show every service sending mail in a domain’s name. Reading them and finishing the job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 1,968 (7.6%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 150 (0.6%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 23 |
| MTA-STS | Protects inbound mail against interception: adopted (24 of these in testing mode only) | 42 (0.2%) |
| TLS-RPT | Reports failed secure delivery: adopted | 54 (0.2%) |
| BIMI | Verified logo in the inbox: live | 269 (1.0%) |
SPF is in better shape than DMARC: only 7.6% of Japanese domains have no SPF record, under half the rate in Germany (16.3%) and the US (17.8%). So most Japanese domains already have the groundwork for DMARC enforcement. MTA-STS and TLS-RPT have barely arrived, at 0.2% each.
Small businesses against bigger ones
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| Japanese businesses with 1–3 locations (shops, offices, trades) | 11,347 | 52.3% | 40.5% | 7.1% |
| Japanese businesses with 4–9 locations | 431 | 41.1% | 48.5% | 10.2% |
| Japanese businesses with 10 or more locations | 209 | 34.4% | 50.2% | 15.3% |
| Japan’s .jp websites ranked in the global top 100,000 | 1,586 | 21.9% | 52.6% | 25.3% |
Protection rises with size, but slowly: even Japanese businesses with ten or more locations enforce DMARC at only 15.3%, and half of them stop at p=none. Small businesses are the opposite of finished: more than half publish no DMARC record at all, and 96.1% carry at least one email-security problem.
Government against small businesses
Public bodies are an obvious target for impostor email. We compared the public-sector domains we can identify (.go.jp, .lg.jp, .ac.jp and .ed.jp domains, and offices mapped as government) with Japan’s small businesses:
| Population | Domains | No DMARC record | Monitor only | p=quarantine | p=reject | Enforced |
|---|---|---|---|---|---|---|
| Japanese government and education domains | 856 | 35.6% | 52.5% | 9.3% | 2.5% | 11.8% |
| Japanese businesses with 1–3 locations | 11,347 | 52.3% | 40.5% | 5.2% | 1.9% | 7.1% |
Japan’s public sector does a little better than its small businesses (11.8% against 7.1%), but most of it stops at p=none (52.5%). Central government .go.jp domains lead at 28.1% of 178. Universities (.ac.jp, 8.3% of 515) and schools (.ed.jp, 6.7% of 90) are close to small-business levels.
Who is most exposed
Every Japanese trade we can measure sits below the national average
Share of each sector’s mail-receiving domains at p=quarantine or p=reject (domains checked in brackets).
Bookshops (124)
Beauty salons (115)
Massage shops (252)
Associations (256)
Funeral directors (126)
Gift shops (162)
Supermarkets (427)
Confectioners (335)
Carpenters (102)
Hairdressers (415)
Estate agents (360)
Patisseries (115)
Bakeries (310)
Bicycle shops (184)
Car dealers (326)
Off-licences (116)
Sports shops (108)
Company offices (2,984)
Car repair garages (119)
Clothes shops (381)
Blue: professions that handle client money · dashed line: Japanese average (11.2%).
The national average is lifted by Japan’s popular websites: no mapped trade reaches it. Clothes shops come closest at 10.5%, and company offices, the largest group with 2,984 domains, manage 9.0%. Bookshops (4.0%), beauty salons (4.3%) and massage shops (4.4%) are lowest. Estate agents, who handle deposits and rent, are at 6.1%.
Methodology
Population. 25,956 Japanese domains that receive email (they publish working MX records). They come from two sources:
- Japanese businesses and organisations mapped on OpenStreetMap with a website of their own, on any domain ending: 12,145 domains
- every .jp domain in the Tranco top-1-million popularity ranking: 15,148 mail-receiving domains
1,337 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-10.
Honest limits.
- Public sector. Government and education domains we can identify (.go.jp, .lg.jp, .ac.jp, .ed.jp, and offices mapped as government) are 856 domains, 3.3% of the sample, and enforce DMARC at 11.8%. Without them the figure is 11.1%. Only 3 local-government .lg.jp domains are in the sample, so local government is barely represented.
- Sample skew. The business sample covers mapped businesses with websites, which leans towards visible, consumer-facing trades. Sector figures rest on 102 to 2,984 domains each, and too few law firms, accountants or financial firms are mapped to show them.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free