Spoofhound research · 2026-11-09
State of DMARC 2026 — Sweden
Three in four Swedish domains can be impersonated by email.
Spoofhound scanned the Swedish web: 8,856 mail-receiving domains across Sweden’s popular websites and mapped local businesses, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
Three in four Swedish domains that receive email can be impersonated. Of 8,856 mail-receiving domains checked, 6,519 (73.6%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •26.4% enforce DMARC. That is behind Norway (40.4%) and Australia (29.3%), and ahead of Brazil (25.3%) and Finland (17.0%). See how every country we have measured compares.
- •The size gap: 17.7% against 69.2%. Swedish businesses with one to three locations enforce DMARC at 17.7%, half the rate of Norwegian ones (34.7%). Businesses with ten or more locations enforce at 69.2%.
- •15.6% have no SPF record, among the highest shares we have measured, though below Vietnam (22.8%) and Taiwan and the US (both 17.8%).
The average Swedish domain scores 38.5 out of 100 on the full email-security check, and 78.7% have at least one problem worth fixing.
DMARC across the Swedish web
74% of Swedish mail-receiving domains are open to impersonation
6,519 of 8,856 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
The largest group of Swedish domains (39.9%) publishes a DMARC record but stops at p=none, and 2,191 of those 3,535 don’t ask for DMARC reports, so their record neither blocks fakes nor tells anyone about them. When Swedish domains do enforce, slightly more use p=reject (13.9%) than p=quarantine (12.5%). The reports are what show every service sending mail in a domain’s name. Reading them and finishing the job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 1,381 (15.6%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 308 (3.5%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 24 |
| MTA-STS | Protects inbound mail against interception: adopted (54 of these in testing mode only) | 119 (1.3%) |
| TLS-RPT | Reports failed secure delivery: adopted | 181 (2.0%) |
| BIMI | Verified logo in the inbox: live | 148 (1.7%) |
SPF is Sweden’s weak spot: one domain in six (15.6%) has no SPF record, and another 3.5% publish one that ends +all or ?all, which permits every server anyway. The newer standards have a foothold: about 2 in 100 domains use MTA-STS, TLS-RPT or BIMI.
Small businesses against bigger ones
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| Swedish businesses with 1–3 locations (shops, offices, trades) | 5,573 | 39.6% | 42.3% | 17.7% |
| Swedish businesses with 4–9 locations | 136 | 9.6% | 47.1% | 43.4% |
| Swedish businesses with 10 or more locations | 91 | 3.3% | 27.5% | 69.2% |
| Sweden’s top-100,000-ranked .se websites | 272 | 10.7% | 22.8% | 66.5% |
The size gap is sharp. Swedish businesses with ten or more locations enforce DMARC at nearly four times the rate of small ones, and almost none of them (3.3%) lack a record. Small businesses split between no record (39.6%) and p=none (42.3%), and 87.3% carry at least one email-security problem.
Who is most exposed
Bookshops, beauty salons and bicycle shops protect about one domain in fifteen
Share of each sector’s mail-receiving domains at p=quarantine or p=reject (domains checked in brackets).
Bookshops (92)
Beauty salons (133)
Bicycle shops (155)
Hairdressers (322)
Florists (78)
Bakeries (173)
Jewellers (89)
Car repair garages (109)
Clothes shops (268)
Furniture shops (66)
Supermarkets (69)
Hardware shops (62)
Car dealers (127)
Estate agents (70)
Company offices (512)
Sports shops (61)
IT companies (67)
Blue: professions that handle client money · dashed line: Sweden average (26.4%).
Consumer trades sit far below the national average: bookshops (6.5%), beauty salons (6.8%), bicycle shops (7.1%) and hairdressers (8.7%). Estate agents, who handle deposits, enforce at 28.6%, just above the average. IT companies lead at 49.3%.
Methodology
Population. 8,856 Swedish domains that receive email (they publish working MX records). They come from two sources:
- Swedish businesses mapped on OpenStreetMap with a website of their own, on any domain ending: 5,860 domains
- every .se domain in the Tranco top-1-million popularity ranking: 3,430 mail-receiving domains
434 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded. Businesses mapped in Sweden but using a Norwegian, Finnish or Danish domain are counted under that country.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-09.
Honest limits.
- Public sector. Swedish public bodies mostly use plain .se domains, so we can identify only 60 of them (offices mapped as government, 0.7% of the sample). That is too few to compare with businesses, so this report has no government section. Without them the headline figure is 26.0%.
- Sample skew. The business sample covers mapped businesses with websites, which leans towards visible, consumer-facing trades. Sector figures rest on 61 to 512 domains each, and the groups with four or more locations on fewer than 140 domains each.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free