Spoofhound research · 2026-11-09
State of DMARC 2026 — Norway
Norway is among the best-protected countries we have measured. Six in ten of its domains can still be impersonated.
Spoofhound scanned the Norwegian web: 5,365 mail-receiving domains across Norway’s popular websites and mapped local businesses, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
Six in ten Norwegian domains that receive email can be impersonated. Of 5,365 mail-receiving domains checked, 3,197 (59.6%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •40.4% enforce DMARC, among the highest rates we have measured. That is lower than Saudi Arabia (45.7%) and ahead of Denmark (39.0%) and Singapore (37.8%). See how every country we have measured compares.
- •Small businesses: 34.7%. Norwegian businesses with one to three locations enforce DMARC at 34.7%, close to Saudi Arabia (35.0%), twice the rate in Sweden (17.7%) and nearly three times the rate in Finland (12.7%).
- •21.2% have no DMARC record at all, among the lowest shares we have measured. In the Netherlands the share is 26.6%. The gap is at p=none: 38.2% publish a record but stop there.
The average Norwegian domain scores 41.7 out of 100 on the full email-security check, and 66.5% have at least one problem worth fixing.
DMARC across the Norwegian web
60% of Norwegian mail-receiving domains are open to impersonation
3,197 of 5,365 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
p=none is now the largest group in Norway (38.2%), and 1,432 of those 2,051 domains don’t ask for DMARC reports, so their record neither blocks fakes nor tells anyone about them. And 23.8% of all Norwegian domains use p=quarantine, among the highest shares we have measured. The reports are what show every service sending mail in a domain’s name. Reading them and finishing the job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 514 (9.6%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 108 (2.0%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 15 |
| MTA-STS | Protects inbound mail against interception: adopted (57 of these in testing mode only) | 194 (3.6%) |
| TLS-RPT | Reports failed secure delivery: adopted | 230 (4.3%) |
| BIMI | Verified logo in the inbox: live | 101 (1.9%) |
The newer standards have a foothold: 3.6% of Norwegian domains use MTA-STS and 4.3% TLS-RPT, among the highest shares we have measured, below South Africa (4.2% and 4.7%). One domain in ten (9.6%) still has no SPF record.
Small businesses against bigger ones
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| Norwegian businesses with 1–3 locations (shops, offices, trades) | 3,503 | 23.7% | 41.3% | 34.7% |
| Norwegian businesses with 4–9 locations | 124 | 5.6% | 39.5% | 54.8% |
| Norwegian businesses with 10 or more locations | 69 | 10.1% | 18.8% | 71.0% |
| Norway’s top-100,000-ranked .no websites | 142 | 5.6% | 21.1% | 73.2% |
Bigger Norwegian businesses enforce DMARC more often than small ones, and seven in ten of the largest (71.0%) do. Even so, small businesses here are among the best protected we have measured, close to Saudi Arabia (35.0%). Their weak point is p=none: 41.3% publish a record but stop there.
Who is most exposed
Even Norway’s least protected trades enforce DMARC more than one domain in five
Share of each sector’s mail-receiving domains at p=quarantine or p=reject (domains checked in brackets).
Beauty salons (67)
Sports shops (65)
Car dealers (222)
Bicycle shops (103)
Clothes shops (196)
Hairdressers (151)
Bakeries (99)
Car repair garages (72)
Company offices (371)
Plumbers (114)
Dashed line: Norway average (40.4%).
Beauty salons are the least protected sector we can measure in Norway, at 22.4%. Hairdressers enforce at 38.4%, against 8.7% in Sweden and 6.4% in Finland. Plumbers lead at 56.1%. Too few accountants, law firms and estate agents are mapped in Norway to show them.
Methodology
Population. 5,365 Norwegian domains that receive email (they publish working MX records). They come from two sources:
- Norwegian businesses mapped on OpenStreetMap with a website of their own, on any domain ending: 3,742 domains
- every .no domain in the Tranco top-1-million popularity ranking: 1,951 mail-receiving domains
328 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded. Businesses mapped in Norway but using a Swedish, Finnish, Danish or Russian domain are counted under that country.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-09.
Honest limits.
- Public sector. Norwegian public bodies mostly use plain .no domains, so we can identify only 46 of them (municipal kommune.no domains and offices mapped as government, 0.9% of the sample). That is too few to compare with businesses, so this report has no government section. Without them the headline figure is 40.1%.
- Sample skew. The business sample covers mapped businesses with websites, which leans towards visible, consumer-facing trades. Sector figures rest on 65 to 371 domains each, and the groups with four or more locations on fewer than 130 domains each.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free