Spoofhound research · 2026-11-10
State of DMARC 2026 — South Korea
More than nine in ten South Korean domains can be impersonated by email.
Spoofhound scanned the South Korean web: 4,384 mail-receiving domains across South Korea’s popular websites and mapped businesses and public bodies, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
More than nine in ten South Korean domains that receive email can be impersonated. Of 4,384 mail-receiving domains checked, 4,130 (94.2%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •5.8% enforce DMARC. That is less than half the rate in Italy (13.4%), and well behind Taiwan (20.8%). See how every country we have measured compares.
- •Seven in ten have no DMARC record at all: 69.2%. That is well above the US (48.6%) and Taiwan (49.3%). Without a record, receivers have no instruction at all for mail that fails authentication.
- •Government .go.kr domains: 4 of 247. Just 1.6% of government domains enforce DMARC, and 84.6% have no DMARC record at all.
The average South Korean domain scores 22.1 out of 100 on the full email-security check (the US average is 28.9), and 95.7% have at least one problem worth fixing.
DMARC across the South Korean web
94% of South Korean mail-receiving domains are open to impersonation
4,130 of 4,384 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
Seven in ten South Korean domains publish no DMARC record (69.2%), and another quarter stop at p=none (24.9%). Half of those at p=none (543 of 1,091) don’t ask for DMARC reports, so their record neither blocks fakes nor tells anyone about them. Only 2.3% use p=reject. The reports are what show every service sending mail in a domain’s name. Reading them and finishing the job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 656 (15.0%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 7 (0.2%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 0 |
| MTA-STS | Protects inbound mail against interception: adopted (2 of these in testing mode only) | 7 (0.2%) |
| TLS-RPT | Reports failed secure delivery: adopted | 6 (0.1%) |
| BIMI | Verified logo in the inbox: live | 4 (0.1%) |
About one South Korean domain in seven (15.0%) has no SPF record, and 624 domains have neither SPF nor DMARC. Without SPF, a business can’t reach DMARC enforcement without breaking its own mail. The newer standards have barely arrived: 7 domains use MTA-STS, 6 use TLS-RPT and 4 use BIMI.
Small businesses against popular websites
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| South Korean businesses with 1–3 locations (shops, offices, trades) | 504 | 65.3% | 28.4% | 6.2% |
| South Korea’s .kr websites ranked in the global top 100,000 | 243 | 46.1% | 40.7% | 12.3% |
Even South Korea’s most popular .kr websites enforce DMARC at only 12.3%, twice the rate for small businesses (6.2%) but still about one in eight. Most have no record (46.1%) or stop at p=none (40.7%). Both groups are small, so read their figures as a guide only.
Government against small businesses
Public bodies are an obvious target for impostor email. We compared the public-sector domains we can identify (.go.kr, .ac.kr and .mil.kr domains, and offices mapped as government) with South Korea’s small businesses:
| Population | Domains | No DMARC record | Monitor only | p=quarantine | p=reject | Enforced |
|---|---|---|---|---|---|---|
| South Korean government and education domains | 562 | 72.6% | 22.1% | 3.7% | 1.2% | 5.0% |
| South Korean businesses with 1–3 locations | 504 | 65.3% | 28.4% | 3.6% | 2.6% | 6.2% |
The public sector is one domain in eight of the sample, and it is no better protected than small businesses. Central and local government .go.kr domains: 4 of 247 enforce DMARC (1.6%), and 84.6% have no DMARC record at all. University .ac.kr domains do a little better, at 8.3% of 288.
Methodology
Population. 4,384 South Korean domains that receive email (they publish working MX records). They come from two sources:
- South Korean businesses and public bodies mapped on OpenStreetMap with a website of their own, on any domain ending: 686 domains
- every .kr domain in the Tranco top-1-million popularity ranking: 3,894 mail-receiving domains
196 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-10.
Honest limits.
- Sample. South Korea’s sample comes mostly from the popularity ranking (3,894 of 4,384 domains), because few South Korean businesses are mapped with a website (504 small businesses). That is too few to break down by sector or by size, and the small-business figure is a guide only.
- Public sector. Government and education domains we can identify (.go.kr, .ac.kr, .mil.kr, and offices mapped as government) are 562 domains, 12.8% of the sample, and enforce DMARC at 5.0%. Without them the figure is 5.9%.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free