Spoofhound research · 2026-10-31
State of DMARC 2026 — South Africa
Two in three South African domains can be impersonated by email.
Spoofhound scanned the South African web: 4,324 mail-receiving domains across the country’s popular websites and mapped local businesses, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
Two in three South African domains that receive email can be impersonated. Of 4,324 mail-receiving domains checked, 2,850 (65.9%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •34.1% enforce DMARC. That’s ahead of the UK (24.5%) and France (15.7%), but behind Saudi Arabia (45.7%), the strongest market Spoofhound has scanned.
- •The small-business gap: 29.0% against 58.1%. South African businesses with one to three locations enforce DMARC at 29.0%. The country’s top-100,000-ranked .za websites manage 58.1%.
- •One in nine domains has an SPF record that blocks nothing. 478 domains (11.1%) end their SPF record with ?all or +all, so they publish a record that still lets any server send as them. That’s more than five times the UK rate (2.0%).
The average South African domain scores 38.1 out of 100 on the full email-security check, and 73.0% have at least one problem worth fixing.
DMARC across the South African web
66% of South African mail-receiving domains are open to impersonation
2,850 of 4,324 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
South Africa splits three ways: a third of domains have no DMARC record (34.2%), a third publish one but leave it at p=none (31.0%), and a third enforce. The monitor-only group matters most commercially. These organisations have already started and may well be receiving reports, but stopped short of the setting that actually blocks impostor mail. Finishing that job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 249 (5.8%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 478 (11.1%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 18 |
| MTA-STS | Protects inbound mail against interception: adopted (127 of these in testing mode only) | 181 (4.2%) |
| TLS-RPT | Reports failed secure delivery: adopted | 204 (4.7%) |
| BIMI | Verified logo in the inbox: live | 75 (1.7%) |
South Africa’s weak spot is SPF. Fewer domains have no SPF record than in the UK, but one in nine publishes a record ending ?all, which tells receivers to treat any sender as neutral. On the newer standards South Africa is ahead of both the UK and France, though fewer than 5 in 100 domains use MTA-STS or TLS-RPT.
Small businesses against the popular web
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| South African businesses with 1–3 locations (shops, offices, trades) | 1,987 | 42.6% | 27.9% | 29.0% |
| South Africa’s top-100,000-ranked .za websites | 227 | 18.1% | 22.9% | 58.1% |
The gap has the same shape as in every market scanned so far. Large, visible organisations have largely done the work, while 77.8% of small businesses still have at least one email-security problem. Over four in ten publish no DMARC record at all, so they would never find out their domain was being used for fraud.
Who is most exposed
No South African sector protects more than half its domains
Share of each sector’s mail-receiving domains at p=quarantine or p=reject (domains checked in brackets).
Bicycle shops (31)
Car parts shops (47)
Shopping malls (78)
Car dealers (81)
Wine estates (146)
Hardware shops (37)
Non-profits (32)
Estate agents (31)
Law firms (34)
Furniture shops (31)
Education offices (31)
Government offices (64)
Clothes shops (75)
Garages / car repair (34)
Company offices (172)
IT companies (30)
Blue: professions that handle client money · dashed line: South Africa average (34.1%).
Shops that sell to the public sit lowest: fewer than one in five car-parts and bicycle shops enforce DMARC. Wine estates, the largest single sector in the sample with 146 domains, manage 28.1%. That matters because their names are known abroad and their customers buy online and pay by bank transfer, which is what invoice fraud exploits. Law firms and estate agents, which handle client money, sit near the national average, still with two in three unprotected.
Methodology
Population. 4,324 South African domains that receive email (they publish working MX records). They come from two sources:
- every .za domain in the Tranco top-1-million popularity ranking: 2,568 mail-receiving domains
- South African businesses mapped on OpenStreetMap with a website of their own, on any domain ending: 2,005 domains
249 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (29 common selectors), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-10-31.
Honest limits.
- Smaller sample. Far fewer South African businesses list a website on OpenStreetMap than UK ones (2,005 against 40,599). Headline figures are solid; sector figures rest on 30 to 170 domains each and should be read as indicative.
- Coverage gaps. South Africa was imported in map squares, and 176 of about 2,150 squares could not be fetched from the busy public OpenStreetMap servers. They are spread across rural areas and offshore islands, with almost none in the main cities, and are retried next month.
- Sample skew. The business sample covers mapped businesses with websites, which leans towards visible, consumer-facing trades.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free