State of DMARC 2026 — Taiwan

Half of Taiwanese domains have no DMARC record at all.

Spoofhound scanned the Taiwanese web: 3,171 mail-receiving domains across Taiwan’s popular websites and mapped local businesses and public bodies, checked with the same engine behind our free domain check.

Check your domain — free

The headline

Four in five Taiwanese domains that receive email can be impersonated. Of 3,171 mail-receiving domains checked, 2,512 (79.2%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.

Three numbers carry the story:

•20.8% enforce DMARC. That is behind Canada (22.9%) and just ahead of Argentina (19.5%) and the US (19.4%). Counting businesses only, Taiwan is at 20.1%. See how every country we have measured compares.
•Half have no DMARC record at all. 1,564 domains (49.3%) publish nothing, among the highest shares we have measured, ahead of the US (48.6%) and France (47.4%). Without a record, receivers have no instruction at all for mail that fails authentication.
•The public sector is barely ahead. Government, education and military domains enforce DMARC at 25.2%, against 20.1% for businesses, and half of them (50.5%) have no record either.

The average Taiwanese domain scores 29.2 out of 100 on the full email-security check, among the lowest we have measured, just above the US (28.9), and 86.1% have at least one problem worth fixing.

DMARC across the Taiwanese web

79% of Taiwanese mail-receiving domains are open to impersonation

2,512 of 3,171 checked domains have no enforced DMARC policy.

No DMARC record

1,564 · 49.3%

Monitor only (p=none)

932 · 29.4%

Broken or duplicate record

16 · 0.5%

p=quarantine

430 · 13.6%

p=reject

229 · 7.2%

Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.

Spoofhound scan of 3,171 Taiwanese mail-receiving domains, checked within the 30 days to 2026-11-09.

The biggest group in Taiwan is the domains with no DMARC record at all (49.3%). Another 29.4% publish a record but leave it at p=none, and 414 of those 932 don’t ask for DMARC reports, so their record neither blocks fakes nor tells anyone about them. The reports are what show every service sending mail in a domain’s name. Reading them and finishing the job is exactly what Spoofhound does.

The rest of the stack

Check	Finding	Domains
SPF	No record at all: any server anywhere may send as the domain	563 (17.8%)
SPF	Record ends +all or ?all: published, but permits everyone anyway	103 (3.2%)
Microsoft 365 DKIM	Both signing selectors broken: outgoing mail can fail authentication today	3
MTA-STS	Protects inbound mail against interception: adopted (2 of these in testing mode only)	5 (0.2%)
TLS-RPT	Reports failed secure delivery: adopted	7 (0.2%)
BIMI	Verified logo in the inbox: live	31 (1.0%)

SPF is a weak spot too: 17.8% of Taiwanese domains have no SPF record, level with the US and among the highest shares we have measured. The newer standards have barely arrived: only 5 domains use MTA-STS and 7 use TLS-RPT.

Small businesses against bigger ones

Population	Domains checked	No DMARC record	Monitor only	Enforced
Taiwanese businesses with 1–3 locations (shops, offices, trades)	905	53.9%	28.2%	17.6%
Taiwanese businesses with 4–9 locations	49	46.9%	26.5%	20.4%
Taiwanese businesses with 10 or more locations	28	28.6%	32.1%	39.3%
Taiwan’s top-100,000-ranked .tw websites	275	34.5%	35.3%	30.2%

More than half of Taiwan’s small businesses (53.9%) have no DMARC record at all, and 88.6% carry at least one email-security problem. Protection rises with size, though the groups above three locations are small. Even Taiwan’s most popular .tw websites enforce DMARC at only 30.2%.

Government against small businesses

Public bodies are an obvious target for impostor email. We compared the public-sector domains we can identify (.gov.tw, .edu.tw and .mil.tw domains, and offices mapped as government) with Taiwan’s small businesses:

Population	Domains	No DMARC record	Monitor only	p=quarantine	p=reject	Enforced
Taiwanese government, education and military domains	432	50.5%	24.1%	19.9%	5.3%	25.2%
Taiwanese businesses with 1–3 locations	905	53.9%	28.2%	10.5%	7.1%	17.6%

The public sector is only slightly better protected than small businesses, and half its domains have no DMARC record at all. Only 5.3% use p=reject. Identified the same way, Taiwan’s public sector is less protected than Singapore’s (91.2%), Australia’s (62.8%), Argentina’s (41.2%) or Brazil’s (40.5%).

Methodology

Population. 3,171 Taiwanese domains that receive email (they publish working MX records). They come from two sources:

Taiwanese businesses and public bodies mapped on OpenStreetMap with a website of their own, on any domain ending: 1,167 domains
every .tw domain in the Tranco top-1-million popularity ranking: 2,326 mail-receiving domains

322 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded.

Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-09.

Honest limits.

Public sector. Government, education and military domains (.gov.tw, .edu.tw, .mil.tw, and offices mapped as government) are 432 domains, 13.6% of the sample, and enforce DMARC at 25.2%. Without them the figure is 20.1%.
Sample size. Taiwan’s mapped-business sample is small (982 businesses), so we don’t break it down by sector, and the groups with four or more locations rest on fewer than 50 domains each. Most of the sample comes from the popularity ranking.
DKIM. DKIM can only be confirmed present, never absent.
What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.

Where does your domain sit in these numbers? Find out in 30 seconds.

Check your domain — free