The one-sentence version#
Email spoofing is one of the cheapest attacks on the internet. A criminal does not need to hack anything to send an invoice, a payroll change, or a "message from the CEO" that appears to come from your exact domain. They just need one thing: a domain that has not told the world's mail servers to reject fakes. We checked how many of the top one million domains actually have.
The headline: 71% of mail-enabled domains can be impersonated#
In July 2026 we assessed 1,000,050 domains from the Cloudflare Radar Top 1 Million (the most-used domains on the internet) against the complete email security stack, live, in a single two-hour window. Not a survey. Not a sample. Every domain.
Seven out of ten mail-enabled domains either publish no anti-spoofing policy at all or explicitly tell receiving mail servers "take no action" against forged mail claiming to be them. Only 13% instruct receivers to hard-reject fakes outright.
Put differently: seven in ten businesses among the world's top domains have effectively decided, by their own published policy, not to stop email fraud committed in their name.
| Domain type | Share of mail-enabled domains |
|---|---|
| Spoofable (attacker can send fake mail as this domain) | 70.9% |
| Enforcing some anti-spoof policy (quarantine or reject) | 29.0% |
| Hard-reject enforcement (fakes actually blocked) | 13.4% |
Only the hard-reject band actually stops fake mail; the monitoring middle band does nothing to attackers.
Deployed, but not switched on#
The pattern that defines the whole study. The basic building blocks look widely adopted:
- 89% of mail-enabled domains list which servers may send for them (SPF)
- 64% publish an anti-spoofing policy (DMARC)
- 59% have discoverable cryptographic signing keys (DKIM)
But adoption is not protection. For SPF, strong enough means a record ending in -all. For DMARC it means quarantine or reject. For DKIM there is no on/off switch in this study, so the cell is the share of domains whose weakest live key is 2048-bit or better.
| Control | Have it | Strong enough |
|---|---|---|
| SPF (sender policy) | 89.1% | 32.3% |
| DMARC (anti-spoofing) | 63.5% | 29.0% |
| DKIM (signing keys) | 58.8% | 44.5% |
| The full defensive stack | 0.34% | 0.34% |
Presence is a solved problem. Enforcement is not. Every dark bar is a compliance checkbox; every light bar is real protection.
Correction (8 October 2026): An earlier version of this table showed 31.9% for SPF and 19.8% for DKIM in the "Actually protects" column. Those figures are not supported by the July aggregate. The corrected values are 32.3% (SPF -all) and 44.5% (weakest live DKIM key 2048-bit or better).
The most common configuration is monitoring mode: the security equivalent of installing a burglar alarm and never arming it. Every compliance checkbox is green. The attack still works.
The layer nobody deployed#
There is a second family of standards that protects email while it travels between servers, preventing attackers on the network path from stripping encryption or rerouting messages entirely. Nine years after publication, effective adoption sits at 1.67%.
Roughly 98% of email connections between organizations can still, in principle, be downgraded to plaintext by an attacker in the right position. This layer has not failed to mature. It has failed to launch.
Trying and failing, silently#
One of the most human findings: tens of thousands of organizations clearly tried to deploy these protections and got them wrong, with no one noticing.
We found over 16,000 sender policies that cancel themselves out through technical errors, nearly 1,000 anti-spoofing records that are syntactically dead, and policy values hand-typed in at least seven languages ("keine", "nenhum", "rejet") plus creative misspellings like "quarentine". Every one of these evaluates as if no policy existed. The operator believes they are protected. They are not, and nothing tells them.
Misconfiguration is not an edge case here. It is a first-class failure mode of the whole system.
The most important finding: it is a defaults problem#
Enforcement rates vary by a factor of sixty depending on who runs a domain's mail. Not company size. Not industry. Not budget.
| Mail provider | Share of customer domains hard-blocking fakes |
|---|---|
| Proofpoint | 71.6% |
| Mimecast | 62.9% |
| Microsoft Exchange Online | 45.0% |
| Google Workspace | 30.7% |
| GoDaddy | 17.7% |
| Hostinger | 3.1% |
| Namecheap | 1.2% |
A factor of sixty between top and bottom, driven almost entirely by provider defaults rather than customer effort.
The Netherlands proves the same point at national scale: registry incentives and government standards pushed Dutch domains to several times the global protection rates.
Email security at internet scale is no longer a protocol problem or an awareness problem. It is a defaults problem, concentrated in perhaps twenty provider settings rather than a million DNS consoles.
What this means for you#
If you lead a business. Ask your IT team or provider one question: "Is our domain's anti-spoofing policy set to reject?" If the answer is "we are in monitoring mode" and has been for more than a quarter, you are in the unprotected 71% and your brand is available to attackers for free.
If you run IT. The fixes are DNS records, not projects. Enforcement-level DMARC, strict sender policies, and closing off unused parked and brand-protection domains (which are free ammunition for fraud against your partners) typically cost a few hours per domain, not a project quarter.
If you are a hosting or email provider. You are the actual lever here. Your defaults decide the security posture of millions of domains whose owners will never open a DNS console. Every default you flip is worth more than any awareness campaign.
Check your own domain#
The exact test used in this study is free at seclens.one. You get a score, a comparison against the million-domain baseline, and copy-paste-ready fixes for anything broken. No signup, no download, thirty seconds.
Want the whole story? The full technical report has the complete methodology, all data, and the compliance mapping (NIS2, ISO 27001, CIS Controls, BSI IT-Grundschutz).
SecLens.ONE measures real-world email security adoption across millions of public domains. All numbers in this briefing are measured, not estimated.