Spoofhound research · 2026-11-09
State of DMARC 2026 — Turkey
Turkey’s public sector is well ahead of its small businesses. Seven in ten Turkish domains can still be impersonated by email.
Spoofhound scanned the Turkish web: 5,646 mail-receiving domains across Turkey’s popular websites and mapped local businesses and public bodies, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
Seven in ten Turkish domains that receive email can be impersonated. Of 5,646 mail-receiving domains checked, 3,894 (69.0%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •31.0% enforce DMARC. That is behind South Africa (34.1%) and just ahead of the Netherlands (30.6%). Counting businesses only, Turkey is at 28.3%. See how every country we have measured compares.
- •The public sector: 52.3%. More than half of the 644 government, education and municipal domains we can identify enforce DMARC, more than twice the rate of Turkish small businesses (23.4%). Municipal .bel.tr domains reach 62.3%.
- •Law firms: 10.3%. The professions that handle client money are among the least protected: law firms enforce DMARC at 10.3% and travel agents at 11.8%, about a third of the national rate.
The average Turkish domain scores 34.4 out of 100 on the full email-security check, and 78.1% have at least one problem worth fixing.
DMARC across the Turkish web
69% of Turkish mail-receiving domains are open to impersonation
3,894 of 5,646 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
The largest group of Turkish domains (38.4%) has no DMARC record at all. When Turkish domains do enforce, two in three stop at p=quarantine: 20.7% of all domains, among the highest shares we have measured, against 10.3% at p=reject. Of the 1,676 domains at p=none, 828 don’t ask for DMARC reports, so their record neither blocks fakes nor tells anyone about them. The reports are what show every service sending mail in a domain’s name. Reading them and finishing the job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 271 (4.8%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 73 (1.3%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 10 |
| MTA-STS | Protects inbound mail against interception: adopted (12 of these in testing mode only) | 21 (0.4%) |
| TLS-RPT | Reports failed secure delivery: adopted | 35 (0.6%) |
| BIMI | Verified logo in the inbox: live | 42 (0.7%) |
SPF is widely published in Turkey: only 4.8% of domains have no SPF record, among the lowest shares we have measured, with Greece (3.8%) lower still. The newer standards have barely arrived: fewer than 1 in 100 domains use MTA-STS, TLS-RPT or BIMI.
Small businesses against bigger ones
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| Turkish businesses with 1–3 locations (shops, offices, trades) | 2,688 | 45.1% | 30.7% | 23.4% |
| Turkish businesses with 4 or more locations | 74 | 24.3% | 33.8% | 41.9% |
| Turkey’s top-100,000-ranked .tr websites | 271 | 14.4% | 24.7% | 60.1% |
Turkey’s most popular .tr websites enforce DMARC at 60.1%, more than twice the rate of its small businesses. Nearly half of small businesses (45.1%) have no DMARC record at all, and 85.8% carry at least one email-security problem.
Government against small businesses
Public bodies are an obvious target for impostor email. We compared the public-sector domains we can identify (.gov.tr, .edu.tr, .bel.tr and .k12.tr domains, and offices mapped as government) with Turkey’s small businesses:
| Population | Domains | No DMARC record | Monitor only | p=quarantine | p=reject | Enforced |
|---|---|---|---|---|---|---|
| Turkish government, education and municipal domains | 644 | 27.6% | 19.6% | 36.5% | 15.8% | 52.3% |
| Turkish businesses with 1–3 locations | 2,688 | 45.1% | 30.7% | 16.5% | 6.9% | 23.4% |
Turkey’s public sector enforces DMARC at more than twice the rate of its small businesses, and is among the strongest public sectors we have measured, below Singapore (91.2%), the Netherlands (80.7%) and Australia (62.8%). Most of it stops at p=quarantine. Municipal .bel.tr domains do best (62.3% of 101), then universities on .edu.tr (57.6% of 222). Central government .gov.tr domains trail at 46.1% of 280, and 41.4% of them have no DMARC record.
Who is most exposed
Law firms and travel agents are the least protected Turkish businesses
Share of each sector’s mail-receiving domains at p=quarantine or p=reject (domains checked in brackets).
Law firms (58)
Travel agents (76)
Estate agents (89)
Shopping centres (115)
Car dealers (64)
Company offices (355)
Supermarkets (76)
Clothes shops (118)
IT companies (60)
Blue: professions that handle client money · dashed line: Turkey average (31.0%).
Every Turkish sector we can measure is below the national average except clothes shops (36.4%) and IT companies (43.3%). The businesses that handle client money do worst: law firms (10.3%), travel agents (11.8%) and estate agents (20.2%).
Methodology
Population. 5,646 Turkish domains that receive email (they publish working MX records). They come from two sources:
- Turkish businesses and public bodies mapped on OpenStreetMap with a website of their own, on any domain ending: 2,979 domains
- every .tr domain in the Tranco top-1-million popularity ranking: 2,976 mail-receiving domains
309 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded. Businesses mapped in Turkey but using a neighbouring country’s domain are counted under that country.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-09.
Honest limits.
- Public sector. Government, education and municipal domains we can identify (.gov.tr, .edu.tr, .bel.tr, .k12.tr, and offices mapped as government) are 644 domains, 11.4% of the sample, and enforce DMARC at 52.3%. Without them the figure is 28.3%.
- Sample skew. The business sample covers mapped businesses with websites, which leans towards visible, consumer-facing trades. Sector figures rest on 58 to 355 domains each, and the group with four or more locations on 74.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free