Spoofhound research · 2026-11-09
State of DMARC 2026 — Nigeria
More than four in five Nigerian domains can be impersonated by email.
Spoofhound scanned the Nigerian web: 879 mail-receiving domains across Nigeria’s popular websites and mapped businesses and public bodies, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
More than four in five Nigerian domains that receive email can be impersonated. Of 879 mail-receiving domains checked, 727 (82.7%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •17.3% enforce DMARC. That is just behind Vietnam (18.9%) and ahead of Finland (17.0%), and half the rate of South Africa (34.1%). See how every country we have measured compares.
- •The public sector: 16.8%. Government and university domains enforce DMARC less often than Nigerian small businesses (19.6%), as in Greece, where the public sector was at 16.9%. University .edu.ng domains are at 11.9%.
- •2.8% have a broken or duplicate DMARC record, among the highest shares we have measured, above India (2.0%). Receiving servers ignore a broken record, so these domains are as open as those with none.
The average Nigerian domain scores 32.4 out of 100 on the full email-security check, and 88.2% have at least one problem worth fixing.
DMARC across the Nigerian web
83% of Nigerian mail-receiving domains are open to impersonation
727 of 879 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
Nigerian domains split almost evenly between no DMARC record (40.6%) and p=none (39.2%). Of the 345 at p=none, 215 don’t ask for DMARC reports, so their record neither blocks fakes nor tells anyone about them. Only 6.8% use p=reject. The reports are what show every service sending mail in a domain’s name. Reading them and finishing the job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 79 (9.0%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 11 (1.3%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 5 |
| MTA-STS | Protects inbound mail against interception: adopted (in testing mode only) | 1 (0.1%) |
| TLS-RPT | Reports failed secure delivery: adopted | 3 (0.3%) |
| BIMI | Verified logo in the inbox: live | 7 (0.8%) |
About one Nigerian domain in eleven (9.0%) has no SPF record. The newer standards have barely arrived: one domain uses MTA-STS, and only in testing mode.
Small businesses against popular websites
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| Nigerian businesses with 1–3 locations (shops, offices, trades) | 102 | 43.1% | 37.3% | 19.6% |
| Nigeria’s top-100,000-ranked .ng websites | 46 | 32.6% | 43.5% | 23.9% |
Even Nigeria’s most popular .ng websites enforce DMARC at only 23.9%, close to the rate for small businesses (19.6%). Most of them stop at p=none (43.5%). Both groups are small, so read their figures as a guide only.
Government against small businesses
Public bodies are an obvious target for impostor email. We compared the public-sector domains we can identify (.gov.ng, .edu.ng, .mil.ng and .sch.ng domains, and offices mapped as government) with Nigeria’s small businesses:
| Population | Domains | No DMARC record | Monitor only | p=quarantine | p=reject | Enforced |
|---|---|---|---|---|---|---|
| Nigerian government and education domains | 304 | 42.4% | 36.5% | 12.2% | 4.6% | 16.8% |
| Nigerian businesses with 1–3 locations | 102 | 43.1% | 37.3% | 9.8% | 9.8% | 19.6% |
The public sector is a third of Nigeria’s sample, and it is no better protected than small businesses: four in five public-sector domains have no DMARC record or stop at p=none. Government .gov.ng domains do better (22.3% of 112) than university .edu.ng domains (11.9% of 185).
Methodology
Population. 879 Nigerian domains that receive email (they publish working MX records). They come from two sources:
- Nigerian businesses and public bodies mapped on OpenStreetMap with a website of their own, on any domain ending: 127 domains
- every .ng domain in the Tranco top-1-million popularity ranking: 764 mail-receiving domains
12 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-09.
Honest limits.
- Sample. Nigeria’s sample is small (879 domains) and comes mostly from the popularity ranking, because few Nigerian businesses are mapped with a website (102). That is too few to break down by sector or by size, and the small-business and popular-website figures are a guide only.
- Public sector. Government and education domains we can identify (.gov.ng, .edu.ng, .mil.ng, .sch.ng, and offices mapped as government) are 304 domains, 34.6% of the sample, and enforce DMARC at 16.8%. Without them the figure is 17.6%.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free