Spoofhound research · published 2026-10-17
State of DMARC 2026 — Saudi Arabia
Saudi Arabia enforces email authentication at three times the rate of France — but 54% of domains remain spoofable.
Spoofhound scanned the Saudi web — 928 mail-receiving domains across the Kingdom’s popular websites and mapped businesses, checked with the same engine behind our free domain check. The story is different from Europe’s: the Kingdom leads the markets we scan, and half the job remains.
Check your domain — freeThe headline
Saudi Arabia enforces email authentication at nearly three times the rate of France — and is still only half protected. Of 928 Saudi mail-receiving domains checked, 424 (45.7%) enforce DMARC at quarantine or reject, against 15.7% in our France scan. The other 504 (54.3%) — no record, monitor-only, or broken — remain open to impersonation.
Three numbers carry the story:
- •45.7% enforced — the strongest market Spoofhound has scanned so far, and notably 32.4% sit at full p=reject (France: 7.1%). Mandated cyber-security controls and the 2024 Gmail/Yahoo sender rules have clearly moved the Saudi market.
- •Government leads from the front: of 40 mapped government offices, 85% enforce DMARC — against 22.5% of the clothing retailers in the same scan. Protection tracks regulation and IT support, not fraud exposure.
- •The remaining gap is the private high street: Saudi businesses with one to three locations enforce at 35.0%, and 68.9% of them carry at least one email-security problem worth fixing. The average Saudi domain scores 42.3 out of 100 across the full check.
DMARC across the Saudi web
The shape is the reverse of Europe’s: p=reject is the largest single group (32.4%), not the smallest — when Saudi organisations adopt DMARC, they tend to finish the job. The exposure concentrates in the 30.5% publishing nothing at all, plus 23.4% parked at monitor-only.
The rest of the stack
DMARC is the enforcement layer, but the scan covers the whole chain. Among the same 928 Saudi mail-receiving domains:
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all | 65 (7.0%) |
| SPF | Record ends +all or ?all — permits everyone anyway | 10 (1.1%) |
| MTA-STS | Inbound transport protection — adopted | 5 (0.5%) |
| TLS-RPT | Failed-delivery reporting — adopted | 8 (0.9%) |
| BIMI | Verified logo in the inbox — live | 10 (1.1%) |
SPF hygiene is noticeably better than Europe’s (7.0% missing against France’s 9.2%, and almost nobody publishes the self-defeating +all). The encryption and branding layers are as empty as everywhere else — under one domain in a hundred — which for early movers is a visible differentiator, not a compliance checkbox.
Who leads, who lags
| Population | Domains | No DMARC record | Enforced | ≥1 problem |
|---|---|---|---|---|
| Saudi popular websites (Tranco-ranked) | 620 | 21.3% | 55.5% | 48.1% |
| Saudi businesses with 1–3 locations | 434 | 36.6% | 35.0% | 68.9% |
The same small-business gap as Europe, but compressed: Saudi local businesses (35.0% enforced) protect themselves at nearly three times the rate of French ones (13.4%). The standouts in the mapped data: government offices enforce at 85% (34 of 40) — consistent with the National Cybersecurity Authority’s controls, which require email anti-spoofing protection for organisations in their scope — while consumer retail sits near 22%. In Saudi Arabia the question for a prospect isn’t “what is DMARC?” as it often is in Europe; it’s “why haven’t you finished what your regulator and your peers already started?”
Methodology
Population. 928 Saudi domains that receive email (publish working MX records): every .sa domain in the Tranco top-1-million popularity ranking plus mapped Saudi businesses on OpenStreetMap with their own website (620 popular, 456 mapped, 148 in both). Checks by Spoofhound’s own engine — the same one behind the free domain check — covering SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI, all within the 30 days to 2026-10-17.
Honest limits, which matter more here than in the France report. The sample is two orders of magnitude smaller than France’s 71,101 (business mapping in the Kingdom is sparse and skews towards larger, urban, consumer-facing organisations — the true small-business exposure is likely worse than measured). Sector figures rest on 40 domains each and are directional, not precise. DKIM is only ever confirmed present, never absent. “Enforced” = p=quarantine or p=reject, as receivers treat it.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free