Spoofhound research · 2026-11-08
State of DMARC 2026 — Spain
Three in four Spanish domains can be impersonated by email.
Spoofhound scanned the Spanish web: 24,449 mail-receiving domains across the country’s popular websites and mapped local businesses in every region, the Balearic and Canary Islands included, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
Three in four Spanish domains that receive email can be impersonated. Of 24,449 mail-receiving domains checked, 18,297 (74.8%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •25.2% enforce DMARC. That is level with India (24.9%) and the UK (24.5%), behind the Netherlands (30.6%), and well ahead of France (15.7%) and Italy (13.4%). Counting businesses only, Spain is at 25.0%. See how every country we have measured compares.
- •Most protection stops at quarantine. Of the 6,152 Spanish domains that enforce DMARC, two in three (4,182) use p=quarantine, which sends fakes to the spam folder. Only 1,970, 8.1% of all domains, use p=reject, which blocks them outright.
- •The small-business gap: 22.4% against 55.7%. Spanish businesses with one to three locations enforce DMARC at 22.4%, ahead of the UK’s (20.1%) and France’s (13.4%). Spain’s top-100,000-ranked .es websites manage 55.7%.
The average Spanish domain scores 34.8 out of 100 on the full email-security check, and 87.1% have at least one problem worth fixing.
DMARC across the Spanish web
75% of Spanish mail-receiving domains are open to impersonation
18,297 of 24,449 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
Spain splits almost evenly between domains with no DMARC record (36.2%) and domains that publish one but leave it at p=none (38.3%). Seven in ten of the p=none group (6,626) don’t ask for DMARC reports, so their record neither blocks fakes nor tells anyone about them. The reports are what show every service sending mail in a domain’s name. Reading them and finishing the job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 1,209 (4.9%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 284 (1.2%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 44 |
| MTA-STS | Protects inbound mail against interception: adopted (41 of these in testing mode only) | 82 (0.3%) |
| TLS-RPT | Reports failed secure delivery: adopted | 136 (0.6%) |
| BIMI | Verified logo in the inbox: live | 244 (1.0%) |
SPF is in good shape: only 4.9% of Spanish domains have none, lower than South Africa (5.8%) and the Netherlands (6.5%). The newer standards have barely arrived: about 1 in 100 domains use MTA-STS, TLS-RPT or BIMI.
Small businesses against bigger ones
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| Spanish businesses with 1–3 locations (shops, offices, trades) | 18,479 | 38.8% | 38.6% | 22.4% |
| Spanish businesses with 4–9 locations | 319 | 22.6% | 40.1% | 37.3% |
| Spanish businesses with 10 or more locations | 147 | 15.0% | 34.7% | 50.3% |
| Spain’s top-100,000-ranked .es websites | 490 | 18.0% | 26.3% | 55.7% |
Protection rises with size: half of Spain’s businesses with ten or more locations enforce DMARC (50.3%). Small businesses are split evenly between no record (38.8%) and p=none (38.6%), and 90.7% carry at least one email-security problem.
Who is most exposed
Most Spanish sectors protect about one domain in five
Share of each sector’s mail-receiving domains at p=quarantine or p=reject (domains checked in brackets).
Pastry shops (173)
Beauty salons (222)
Wineries (296)
Architects (178)
Bakeries (325)
Hairdressers (290)
Law firms (350)
Bicycle shops (375)
Estate agents (714)
Car dealers (268)
Car repair garages (425)
Tax advisers (115)
Opticians (193)
Travel agents (211)
Furniture shops (339)
Clothes shops (686)
Supermarkets (265)
Insurance agents (173)
Government offices (313)
Company offices (1,615)
IT companies (266)
Blue: professions that handle client money · dashed line: Spain average (25.2%).
Spain’s sectors are unusually even: from pastry shops to car dealers, almost all sit between 17% and 25%. The money-handling professions are no better protected. Law firms (19.4%), estate agents (19.7%) and tax advisers (21.7%) are all below the national average, though they handle the payments that impostor email targets. IT companies lead at 44.0%.
Methodology
Population. 24,449 Spanish domains that receive email (they publish working MX records). They come from two sources:
- Spanish businesses mapped on OpenStreetMap with a website of their own, on any domain ending: 19,265 domains
- every .es domain in the Tranco top-1-million popularity ranking: 5,880 mail-receiving domains
696 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-08.
Honest limits.
- Public sector. Government, regional, municipal and school domains we can identify (.gob.es, .edu.es, regional government domains, ayuntamiento and diputación names, and offices mapped as government) are 384 domains, 1.6% of the sample, and enforce DMARC at 32.8%. Without them the figure is 25.0%, so the headline is in effect a business figure.
- Sample skew. The business sample covers mapped businesses with websites, which leans towards visible, consumer-facing trades. Sector figures rest on 110 to 1,600 domains each.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free