Spoofhound research · 2026-11-08
State of DMARC 2026 — United States
Four in five US businesses can be impersonated by email.
Spoofhound scanned US businesses: 113,484 mail-receiving domains, almost all of them local businesses mapped across all 50 states, checked with the same engine behind our free domain check. It’s one of the largest samples in our research.
Check your domain — freeThe headline
Four in five US businesses that receive email can be impersonated. Of 113,484 mail-receiving domains checked, 91,419 (80.6%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •19.4% enforce DMARC. That’s behind the UK (24.5%), India (24.9%), South Africa (34.1%) and Saudi Arabia (45.7%), and ahead of France (15.7%). Counting businesses only, the US is at 19.0%. See how every country we have measured compares.
- •Half have no DMARC record at all: 48.6%. 55,208 domains publish nothing, so their owners would never hear that someone was sending mail in their name.
- •The small-business gap: 18.5% against 73.5%. US businesses with one to three locations enforce DMARC at 18.5%. US businesses whose websites rank in the global top 100,000 manage 73.5%.
The average US business domain scores 28.9 out of 100 on the full email-security check, and 84.7% have at least one problem worth fixing.
DMARC across US businesses
81% of US business domains are open to impersonation
91,419 of 113,484 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
The US has one of the largest no-record groups we have measured: nearly half of all domains (48.6%), against 39.2% in India and 34.2% in South Africa. Another third publish a record but leave it at p=none (31.5%). That monitor-only group matters most commercially. These businesses have already started and may well be receiving reports, but stopped short of the setting that actually blocks impostor mail. Finishing that job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 20,225 (17.8%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 3,365 (3.0%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 385 |
| MTA-STS | Protects inbound mail against interception: adopted (339 of these in testing mode only) | 656 (0.6%) |
| TLS-RPT | Reports failed secure delivery: adopted | 944 (0.8%) |
| BIMI | Verified logo in the inbox: live | 899 (0.8%) |
The US gap starts below DMARC. Nearly one in five businesses has no SPF record at all, among the highest rates we have measured: three times South Africa’s (5.8%) and well above India’s (11.6%). Without SPF, a business can’t reach DMARC enforcement without breaking its own mail. The newer standards have barely arrived: fewer than 1 in 100 domains use MTA-STS, TLS-RPT or BIMI.
Small businesses against bigger ones
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| US businesses with 1–3 locations (shops, offices, trades) | 109,355 | 49.7% | 31.4% | 18.5% |
| US businesses with 4–9 locations | 1,687 | 16.5% | 36.3% | 46.5% |
| US businesses with 10 or more locations | 908 | 6.5% | 31.1% | 62.1% |
| US businesses whose website ranks in the global top 100,000 | 2,070 | 2.7% | 23.8% | 73.5% |
Protection rises steadily with size. Chains and well-known brands have largely done the work: only one in fifteen with ten or more locations lacks a DMARC record. Small businesses are the opposite, with half publishing nothing and 85.6% carrying at least one email-security problem. Those are the firms fake-invoice fraud and impersonation hit hardest, because they have no security team to notice.
Who is most exposed
Main Street trades protect fewer than one domain in ten
Share of each sector’s mail-receiving domains at p=quarantine or p=reject (domains checked in brackets).
Hair salons (3,208)
Bicycle shops (1,504)
Breweries (1,552)
Beauty salons (3,010)
Florists (1,004)
Bakeries (2,160)
Auto repair shops (3,980)
Jewelers (1,352)
Car dealers (3,782)
Real estate agents (2,604)
Plumbers (635)
Tax preparers (366)
HVAC contractors (937)
Law firms (3,761)
Accountants (729)
Architects (648)
Company offices (5,528)
Financial advisors (489)
IT companies (954)
Insurance agents (2,278)
Blue: professions that handle client money · dashed line: US average (19.4%).
The trades on a typical Main Street sit lowest: hair and beauty salons, florists, bakeries and bike shops all protect fewer than one domain in ten. The money-handling professions do better but are still exposed. Real estate agents (18.4%) and law firms (23.2%) are the usual targets of wire fraud on home purchases, and three in four of them leave their name open. Insurance agents lead at 51.4%, likely because large carriers set up their agents’ email.
Methodology
Population. 113,484 US domains that receive email (they publish working MX records). They come from two sources:
- US businesses mapped on OpenStreetMap with a website of their own, on any domain ending: 111,716 domains
- every .us domain in the Tranco top-1-million popularity ranking: 1,864 mail-receiving domains
96 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-08.
Honest limits.
- A business report, not a national one. Popular US websites mostly use .com, which doesn’t identify a country, so the US popular web can’t be sampled the way the UK’s .uk or India’s .in can. The US figures describe mapped businesses; the comparison row uses mapped businesses whose websites also rank in the Tranco top 100,000.
- Public sector left out. Government and university domains are only 1.3% of the sample (enforcing at 53.5%). In the Tranco list, .gov domains enforce at 63.5% and .edu at 57.5%, far ahead of business.
- Sample skew. The business sample covers mapped businesses with websites, which leans towards visible, consumer-facing trades. Sector figures rest on 300 to 5,500 domains each, large enough to quote.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free