Spoofhound research · 2026-11-08
State of DMARC 2026 — Netherlands
More than two in three Dutch domains can be impersonated by email.
Spoofhound scanned the Dutch web: 43,453 mail-receiving domains across the country’s popular websites and mapped local businesses in all 12 provinces, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
More than two in three Dutch domains that receive email can be impersonated. Of 43,453 mail-receiving domains checked, 30,166 (69.4%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •30.6% enforce DMARC. That is behind Saudi Arabia (45.7%) and South Africa (34.1%), and ahead of the UK (24.5%). Counting businesses only, the Netherlands is at 30.2%. See how every country we have measured compares.
- •Government sets the pace: 80.7% against 27.5%. Dutch government domains we can identify enforce DMARC at 80.7%. Dutch businesses with one to three locations manage 27.5%.
- •Four in ten stop at p=none: 42.1%. Italy has a larger monitor-only group, at 54.9%. Two in three of these Dutch domains (12,074) do not even ask for DMARC reports, so their record neither blocks fakes nor tells anyone about them.
The average Dutch domain scores 38.1 out of 100 on the full email-security check, and 84.0% have at least one problem worth fixing.
DMARC across the Dutch web
69% of Dutch mail-receiving domains are open to impersonation
30,166 of 43,453 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
Most Dutch domains have made a start: only a quarter have no DMARC record (26.6%). The largest group publishes one but leaves it at p=none (42.1%). Those organisations are a short step from protection, but the step needs the DMARC reports that show every service sending mail in their name. Reading those reports and finishing the job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 2,810 (6.5%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 832 (1.9%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 183 |
| MTA-STS | Protects inbound mail against interception: adopted (158 of these in testing mode only) | 395 (0.9%) |
| TLS-RPT | Reports failed secure delivery: adopted | 645 (1.5%) |
| BIMI | Verified logo in the inbox: live | 457 (1.1%) |
The basics are mostly in place: only 6.5% of Dutch domains have no SPF record. The newer standards are still rare: fewer than 2 in 100 domains use MTA-STS, TLS-RPT or BIMI.
Small businesses against bigger ones
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| Dutch businesses with 1–3 locations (shops, offices, trades) | 33,220 | 28.7% | 43.1% | 27.5% |
| Dutch businesses with 4–9 locations | 462 | 11.7% | 44.6% | 43.3% |
| Dutch businesses with 10 or more locations | 187 | 8.6% | 30.5% | 60.4% |
| The Netherlands’ top-100,000-ranked .nl websites | 606 | 12.4% | 22.3% | 65.3% |
Protection rises with size. Chains and the best-known .nl websites have largely done the work, while 88.0% of small businesses still carry at least one email-security problem. The small-business gap is less about missing records than about records left at p=none: 43.1% of small businesses sit there.
Government against small businesses
Dutch government organisations have committed to protecting their domains with DMARC. The standard is on the Forum Standaardisatie “comply or explain” list, and a government-wide agreement set the end of 2019 as the deadline for a strict policy. The Forum counts p=quarantine or p=reject as strict, with p=reject as the end goal. The data shows that most government domains have followed, though not all the way:
| Population | Domains | No DMARC record | Monitor only | p=quarantine | p=reject | Enforced |
|---|---|---|---|---|---|---|
| Dutch government domains we can identify | 305 | 7.2% | 11.8% | 37.7% | 43.0% | 80.7% |
| Dutch businesses with 1–3 locations | 33,220 | 28.7% | 43.1% | 14.3% | 13.1% | 27.5% |
Government domains are three times as likely to enforce DMARC as small businesses. Four in five meet the strict-policy agreement, but fewer than half (43.0%) have reached p=reject, and one in five (19.0%) still has no record or stops at p=none, seven years after the deadline. Small businesses have no such agreement behind them, and it shows: 71.8% have no record or stop at p=none.
Who is most exposed
Estate agents are the least protected Dutch sector
Share of each sector’s mail-receiving domains at p=quarantine or p=reject (domains checked in brackets).
Estate agents (656)
Florists (598)
Bakeries (656)
Bicycle shops (1,232)
Clothes shops (2,021)
Car repair garages (1,120)
Hairdressers (1,926)
Beauty salons (795)
Jewellers (454)
Car dealers (1,014)
Furniture shops (533)
Computer shops (220)
Financial advisers (118)
Law firms (258)
Accountants (163)
Insurance agents (106)
Company offices (4,368)
Education offices (408)
Financial offices (102)
Notaries (111)
IT companies (483)
Blue: professions that handle client money · dashed line: Netherlands average (30.6%).
Estate agents come last at 17.4%, though they handle the deposits and purchase payments that impostor email targets. The other money-handling professions do better: notaries lead them at 52.3%, with law firms and accountants between 36% and 39%. High-street shops cluster around one in five. IT companies lead at 56.9%.
Methodology
Population. 43,453 Dutch domains that receive email (they publish working MX records). They come from two sources:
- Dutch businesses and organisations mapped on OpenStreetMap with a website of their own, on any domain ending: 34,169 domains
- every .nl domain in the Tranco top-1-million popularity ranking: 10,777 mail-receiving domains
1,493 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-08.
Honest limits.
- Government domains. The 305 government domains are those we can identify: offices mapped as government on OpenStreetMap, and domains named for an overheid, gemeente, provincie or waterschap. Many municipalities and ministries use plain .nl names, so this is a sample of government, not all of it. It is 0.7% of the total, so the headline is in effect a business figure (30.2% without it).
- Sample skew. The business sample covers mapped businesses with websites, which leans towards visible, consumer-facing trades. Sector figures rest on 100 to 4,400 domains each.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free