Spoofhound research · 2026-11-09
State of DMARC 2026 — Singapore
Singapore’s public sector has locked its domains down. Its small businesses have not.
Spoofhound scanned the Singaporean web: 1,504 mail-receiving domains across Singapore’s popular websites and mapped local businesses and public bodies, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
Six in ten Singaporean domains that receive email can be impersonated. Of 1,504 mail-receiving domains checked, 936 (62.2%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •37.8% enforce DMARC, among the highest rates we have measured. That is behind Saudi Arabia (45.7%) and ahead of South Africa (34.1%) and the Netherlands (30.6%). Counting businesses only, Singapore is at 31.9%. See how every country we have measured compares.
- •The public sector: 91.2% enforced, 81.1% at p=reject. 135 of the 148 public-sector domains we can identify enforce DMARC, and 120 block fakes outright. That is among the highest public-sector shares we have measured, ahead of the Dutch government’s 80.7%.
- •Small businesses: 24.8%. Singaporean businesses with one to three locations enforce DMARC at 24.8%, and three in four of them (74.7%) have no record or stop at p=none.
The average Singaporean domain scores 37.0 out of 100 on the full email-security check, and 71.1% have at least one problem worth fixing.
DMARC across the Singaporean web
62% of Singaporean mail-receiving domains are open to impersonation
936 of 1,504 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
Like Saudi Arabia and South Africa, Singapore has more domains at p=reject than at p=quarantine: 21.2% of all domains block fakes outright. Even so, 62.0% still have no record or stop at p=none, and 259 of the 480 p=none domains don’t ask for DMARC reports, so their record neither blocks fakes nor tells anyone about them. The reports are what show every service sending mail in a domain’s name. Reading them and finishing the job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 152 (10.1%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 24 (1.6%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 8 |
| MTA-STS | Protects inbound mail against interception: adopted (7 of these in testing mode only) | 14 (0.9%) |
| TLS-RPT | Reports failed secure delivery: adopted | 17 (1.1%) |
| BIMI | Verified logo in the inbox: live | 23 (1.5%) |
One Singaporean domain in ten (10.1%) has no SPF record. The newer standards have barely arrived: about 1 in 100 domains use MTA-STS, TLS-RPT or BIMI.
Small businesses against bigger ones
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| Singaporean businesses with 1–3 locations (shops, offices, trades) | 723 | 36.7% | 38.0% | 24.8% |
| Singaporean businesses with 4 or more locations | 27 | 22.2% | 25.9% | 51.9% |
| Singapore’s top-100,000-ranked .sg websites | 77 | 11.7% | 15.6% | 72.7% |
Singapore’s most popular .sg websites enforce DMARC at 72.7%, nearly three times the rate of its small businesses. Small businesses are split evenly between no record (36.7%) and p=none (38.0%), and 82.8% carry at least one email-security problem.
Government against small businesses
Public bodies are an obvious target for impostor email. We compared the public-sector domains we can identify (.gov.sg and .edu.sg domains, and offices mapped as government) with Singapore’s small businesses:
| Population | Domains | No DMARC record | Monitor only | p=quarantine | p=reject | Enforced |
|---|---|---|---|---|---|---|
| Singaporean government and education domains | 148 | 1.4% | 7.4% | 10.1% | 81.1% | 91.2% |
| Singaporean businesses with 1–3 locations | 723 | 36.7% | 38.0% | 15.1% | 9.7% | 24.8% |
This is one of the widest gaps between government and small businesses we have measured. Nine in ten public-sector domains enforce DMARC, and eight in ten use p=reject, against 43.0% for the Dutch government. Only 13 of 148 have no record or stop at p=none. A Singaporean small business is barely a quarter as likely to enforce DMARC, and almost four times as likely to have no record at all as to block fakes outright.
Methodology
Population. 1,504 Singaporean domains that receive email (they publish working MX records). They come from two sources:
- Singaporean businesses and public bodies mapped on OpenStreetMap with a website of their own, on any domain ending: 807 domains
- every .sg domain in the Tranco top-1-million popularity ranking: 792 mail-receiving domains
95 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded. Businesses mapped in Singapore but using a Malaysian or Indonesian domain (.my, .id) are counted under that country.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-09.
Honest limits.
- Public sector. Government and education domains we can identify (.gov.sg, .edu.sg, and offices mapped as government) are 148 domains, 9.8% of the sample, and enforce DMARC at 91.2%. Without them the figure is 31.9%.
- Sample size. Singapore is small, and so is its sample: 1,504 domains, with 750 mapped businesses. That is too few to break down by sector, and the groups with four or more locations and the top-ranked websites rest on fewer than 80 domains each.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free