Skip to content

SecLens.ONE Research, October 2026

Recurring email security measurements of the Cloudflare Radar Top 1 Million.

Each figure is computed from per-domain evidence, available on request.

October 2026 edition Latest

Sixty-Nine Percent Spoofable: Email Authentication and Transport Security Across the Top One Million Domains

69.1% of mail-enabled Top 1M domains are spoofable, down from 70.9% in July. Most of that move is one parked-domain portfolio. 1,000,000 domains.

69.1%
of mail-enabled domains are spoofable
1.80%
have enforced transport security
53.9%
of domains with a live RSA key expose a 1024-bit or weaker key
0.34%
deploy the full defensive stack
The short version

Could a Criminal Send Email in Your Company’s Name? Seven in Ten Mail Domains Still Say Yes.

The October 2026 census without the jargon, with the July 2026 numbers beside it. About five minutes to read.

7 in 10 mail domains can still be impersonated 60× gap in enforcement between Proofpoint and Namecheap customers 1.8% have enforced transport encryption 0.34% deploy the full defensive stack
Read the short version
July 2026 edition

Seventy Percent Spoofable: Email Authentication and Transport Security Across the Top One Million Domains

70.9% of mail-enabled Top 1M domains are spoofable. SecLens.ONE measured SPF, DKIM, DMARC, MTA-STS, TLS-RPT, DANE and DNSSEC across 1,000,050 domains.

70.9%
of mail-enabled domains are spoofable
1.67%
have enforced transport security
55.3%
of DKIM domains are in the 1024-bit class
0.34%
deploy the full defensive stack
The short version

Could a Criminal Send Email in Your Company’s Name? For 7 in 10 Mail Domains, the Answer Is Yes.

Our study of one million domains, retold in plain English for business owners, managers, and everyone who uses email. About five minutes to read.

71% of mail domains can be impersonated 60× gap in enforcement between Proofpoint and Namecheap customers 1.7% have enforced transport encryption 0.34% deploy the full defensive stack
Read the short version

New editions publish against fresh Radar snapshots. Scoring rules live on the methodology page.

Where does your domain stand?

Assess your own domain with the same checks used in this report.