Spoofhound research · 2026-11-09
State of DMARC 2026 — Vietnam
Six in ten Vietnamese domains have no DMARC record at all.
Spoofhound scanned the Vietnamese web: 3,297 mail-receiving domains across Vietnam’s popular websites and mapped local businesses and public bodies, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
Four in five Vietnamese domains that receive email can be impersonated. Of 3,297 mail-receiving domains checked, 2,673 (81.1%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •59.4% have no DMARC record at all. That is more than Taiwan (49.3%), the US and Finland (both 48.6%).
- •22.8% have no SPF record. More than one domain in five publishes no list of the servers allowed to send its mail, among the highest shares we have measured and above Taiwan and the US (both 17.8%).
- •18.9% enforce DMARC. That is just behind the US (19.4%) and ahead of Finland (17.0%), France (15.7%) and Italy (13.4%). See how every country we have measured compares.
The average Vietnamese domain scores 26.1 out of 100 on the full email-security check, below the US (28.9) and Taiwan (29.2), and 87.1% have at least one problem worth fixing.
DMARC across the Vietnamese web
81% of Vietnamese mail-receiving domains are open to impersonation
2,673 of 3,297 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
Most Vietnamese domains never got as far as publishing DMARC: 59.4% have no record, against 20.4% at p=none. Of those 672 p=none domains, 254 don’t ask for DMARC reports, so their record neither blocks fakes nor tells anyone about them. The reports are what show every service sending mail in a domain’s name. Reading them and finishing the job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 753 (22.8%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 38 (1.2%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 5 |
| MTA-STS | Protects inbound mail against interception: adopted (4 of these in testing mode only) | 6 (0.2%) |
| TLS-RPT | Reports failed secure delivery: adopted | 11 (0.3%) |
| BIMI | Verified logo in the inbox: live | 15 (0.5%) |
More than one Vietnamese domain in five (22.8%) has no SPF record at all, so nothing tells receiving servers which senders are genuine. The newer standards have barely arrived: fewer than 1 in 100 domains use MTA-STS, TLS-RPT or BIMI.
Small businesses against bigger ones
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| Vietnamese businesses with 1–3 locations (shops, offices, trades) | 804 | 62.9% | 19.7% | 15.8% |
| Vietnamese businesses with 4 or more locations | 28 | 39.3% | 32.1% | 28.6% |
| Vietnam’s top-100,000-ranked .vn websites | 247 | 37.7% | 26.3% | 34.4% |
Vietnam’s most popular .vn websites enforce DMARC at 34.4%, about twice the rate of its small businesses. Even among those popular sites, 37.7% have no DMARC record. Small businesses are worse still: 62.9% have no record, and 90.5% carry at least one email-security problem.
Government against small businesses
Public bodies are an obvious target for impostor email. We compared the public-sector domains we can identify (.gov.vn, .edu.vn and .ac.vn domains, and offices mapped as government) with Vietnam’s small businesses:
| Population | Domains | No DMARC record | Monitor only | p=quarantine | p=reject | Enforced |
|---|---|---|---|---|---|---|
| Vietnamese government and education domains | 543 | 57.5% | 21.9% | 10.9% | 9.0% | 19.9% |
| Vietnamese businesses with 1–3 locations | 804 | 62.9% | 19.7% | 7.6% | 8.2% | 15.8% |
Vietnam’s public sector is barely better protected than its small businesses, and enforces DMARC less often than the public sectors of Taiwan (25.2%) and Thailand (26.8%). Government domains do better than education: 35.6% of the 163 .gov.vn domains enforce, against 13.2% of the 369 .edu.vn domains used by schools and universities.
Methodology
Population. 3,297 Vietnamese domains that receive email (they publish working MX records). They come from two sources:
- Vietnamese businesses and public bodies mapped on OpenStreetMap with a website of their own, on any domain ending: 913 domains
- every .vn domain in the Tranco top-1-million popularity ranking: 2,530 mail-receiving domains
146 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-09.
Honest limits.
- Public sector. Government and education domains we can identify (.gov.vn, .edu.vn, .ac.vn, and offices mapped as government) are 543 domains, 16.5% of the sample, and enforce DMARC at 19.9%. Without them the figure is 18.7%.
- Sample. Most of the sample (2,530 of 3,297 domains) comes from the popularity ranking, because few Vietnamese businesses are mapped with a website (832). That is too few to break down by sector, and the group with four or more locations rests on 28 domains.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free