Spoofhound research · 2026-11-09
State of DMARC 2026 — Thailand
Three in four Thai domains can be impersonated by email.
Spoofhound scanned the Thai web: 2,085 mail-receiving domains across Thailand’s popular websites and mapped local businesses and public bodies, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
Three in four Thai domains that receive email can be impersonated. Of 2,085 mail-receiving domains checked, 1,574 (75.5%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •24.5% enforce DMARC. That is level with the UK (24.5%), just behind India (24.9%), and ahead of Taiwan (20.8%) and Vietnam (18.9%). See how every country we have measured compares.
- •The public sector: 58.3% have no DMARC record. Of the 612 government and education domains we can identify, more than half have no record at all, a higher share than Thai small businesses (46.5%). Only 5.4% use p=reject.
- •Small businesses: 18.2%. Thai businesses with one to three locations enforce DMARC at 18.2%, and 81.4% have no record or stop at p=none.
The average Thai domain scores 30.9 out of 100 on the full email-security check, and 84.3% have at least one problem worth fixing.
DMARC across the Thai web
75% of Thai mail-receiving domains are open to impersonation
1,574 of 2,085 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
Nearly half of Thai domains (46.2%) have no DMARC record at all. Among those that enforce, p=quarantine is twice as common as p=reject (16.4% against 8.1%). Of the 602 domains that stop at p=none, 243 don’t ask for DMARC reports, so their record neither blocks fakes nor tells anyone about them. The reports are what show every service sending mail in a domain’s name. Reading them and finishing the job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 217 (10.4%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 33 (1.6%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 15 |
| MTA-STS | Protects inbound mail against interception: adopted (3 of these in testing mode only) | 5 (0.2%) |
| TLS-RPT | Reports failed secure delivery: adopted | 9 (0.4%) |
| BIMI | Verified logo in the inbox: live | 15 (0.7%) |
One Thai domain in ten (10.4%) has no SPF record. The newer standards have barely arrived: fewer than 1 in 100 domains use MTA-STS, TLS-RPT or BIMI.
Small businesses against bigger ones
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| Thai businesses with 1–3 locations (shops, offices, trades) | 892 | 46.5% | 34.9% | 18.2% |
| Thai businesses with 4 or more locations | 32 | 34.4% | 31.2% | 34.4% |
| Thailand’s top-100,000-ranked .th websites | 94 | 22.3% | 38.3% | 37.2% |
Thailand’s most popular .th websites enforce DMARC at 37.2%, twice the rate of its small businesses. Nearly half of small businesses (46.5%) have no record at all, and 88.7% carry at least one email-security problem.
Government against small businesses
Public bodies are an obvious target for impostor email. We compared the public-sector domains we can identify (.go.th, .ac.th and .mi.th domains, and offices mapped as government) with Thailand’s small businesses:
| Population | Domains | No DMARC record | Monitor only | p=quarantine | p=reject | Enforced |
|---|---|---|---|---|---|---|
| Thai government and education domains | 612 | 58.3% | 14.5% | 21.4% | 5.4% | 26.8% |
| Thai businesses with 1–3 locations | 892 | 46.5% | 34.9% | 12.3% | 5.8% | 18.2% |
Thai public-sector domains enforce DMARC more often than small businesses, but they are also more likely to have no record at all: 58.3% against 46.5%. Of the 436 .go.th government domains, 63.1% have no DMARC record. That is ahead of the public sectors of Taiwan (25.2%) and Vietnam (19.9%), and far behind Singapore’s (91.2%).
Methodology
Population. 2,085 Thai domains that receive email (they publish working MX records). They come from two sources:
- Thai businesses and public bodies mapped on OpenStreetMap with a website of their own, on any domain ending: 1,237 domains
- every .th domain in the Tranco top-1-million popularity ranking: 968 mail-receiving domains
120 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-09.
Honest limits.
- Public sector. Government and education domains we can identify (.go.th, .ac.th, .mi.th, and offices mapped as government) are 612 domains, 29.4% of the sample, a far larger share than in most countries we have measured. They enforce DMARC at 26.8%. Without them the figure is 23.6%.
- Sample size. Thailand’s sample is small: 2,085 domains, with 924 mapped businesses. That is too few to break down by sector, and the group with four or more locations rests on 32 domains.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free