In short#
A criminal does not need to break into your company to send an invoice, a payroll change, or a "message from the CEO" that appears to come from your exact domain. They need a domain that has not told the world's mail servers to reject fakes. We checked the top one million domains again in October 2026. The answer is still yes for seven in ten domains that have a mail server.
The headline: 69.1% of mail-enabled domains can be impersonated#
On 7 October 2026 we assessed 1,000,000 domains from the Cloudflare Radar Top 1 Million, live, in one window of 1 hour 37 minutes. This is a new popularity list, not the same domains measured again. Every comparison below is against the July 2026 edition of this study (1,000,050 domains).
Seven out of ten mail-enabled domains either publish no anti-spoofing policy or tell receiving servers to take no action. That share is 69.1%, against 70.9% in July. Hard-reject (p=reject), the setting that tells receivers to refuse fakes, is 15.1%, against 13.4%.
| Domain type | October 2026 | July 2026 |
|---|---|---|
| Spoofable (no enforced anti-spoofing policy) | 69.1% | 70.9% |
| Enforcing some anti-spoof policy (quarantine or reject) | 30.8% | 29.0% |
| Hard-reject policy (p=reject) | 15.1% | 13.4% |
October shares. July was 70.9% spoofable, 29.0% enforcing, 13.4% hard-reject.
The 1.8 point drop is real, and it is mostly one parked-domain portfolio. This snapshot contains 14,295 parked domains whose mail records point at one domain-parking operator's servers, and 99.9% of them enforce. Take that portfolio out and the spoofable share is 70.5%, against 70.9% in July.
Deployed, but not switched on#
Most domains publish the basic records. Far fewer set them to block fakes.
- 89.5% of mail-enabled domains list which servers may send for them (SPF). July was 89.1%.
- 65.0% publish an anti-spoofing policy (DMARC). July was 63.5%.
- 57.1% have a discoverable signing key (DKIM). July was 58.8%. The count of domains barely changed. The rate fell because more domains on this list have a mail record.
"Strong enough" in the table below means the control is set to do the job. For SPF that is a record ending in -all. For DMARC that is quarantine or reject. For DKIM there is no on/off switch in this study, so the cell is the share of domains whose weakest live key is 2048-bit or better. The July briefing has been corrected to use the same definitions.
| Control | Have it | Strong enough | July, have it | July, strong enough |
|---|---|---|---|---|
| SPF (sender policy) | 89.5% | 33.9% | 89.1% | 32.3% |
| DMARC (anti-spoofing) | 65.0% | 30.8% | 63.5% | 29.0% |
| DKIM (signing keys) | 57.1% | 46.1% | 58.8% | 44.5% |
| The full defensive stack | 0.34% | 0.34% | 0.34% | 0.34% |
Strong enough is -all for SPF and quarantine or reject for DMARC. The full stack is unchanged from July at 0.34%.
The most common DMARC setting is still monitoring mode (p=none). It does not ask receivers to block fakes. 53.9% of domains with a live DKIM key still publish a 1024-bit or weaker RSA key, against 55.5% in July. We found 19 modern Ed25519 keys in the whole corpus, the same count as July.
Transport security: 1.8% enforced#
A second family of standards protects mail while it travels between servers. Eight to eleven years after publication, effective adoption is 1.80% of mail-enabled domains. July was 1.67%.
MTA-STS, the policy that refuses a downgrade to plaintext, is advertised by 1.36% and enforced by 0.62%. July was 1.40% and 0.64%. Fully valid DANE rose from 1.11% to 1.26%.
Broken records#
Thousands of domains publish these records and get them wrong.
16,843 sender policies exceed the 10-lookup limit and cancel themselves (July 16,316). 913 anti-spoofing records are syntactically dead (July 955). Among the policies a parser cannot accept we counted an empty value 403 times, the misspelling quarentine 14 times, the French spellings quarantaine and rejet, and the words nenhum and nessuno. Each of those evaluates as if no policy existed, and the record still looks deployed in the DNS.
Who runs the mail still decides#
Enforcement rates differ by mail provider.
| Mail provider | October, enforcing | July, enforcing |
|---|---|---|
| Domain parking (one operator) | 99.9% | not in the July top set |
| Proofpoint | 73.0% | 71.6% |
| Mimecast | 64.8% | 62.9% |
| Microsoft Exchange Online | 45.0% | 45.0% |
| Google Workspace | 31.4% | 30.7% |
| GoDaddy | 22.4% | 17.7% |
| Hostinger | 3.8% | 3.1% |
| Namecheap | 1.2% | 1.2% |
Proofpoint and Namecheap are still about sixty times apart. Domain parking at 99.9% is one parking template, and it is most of this quarter's headline move.
The spread is the same as July. Microsoft is 45.0% in both snapshots. GoDaddy rose from 17.7% to 22.4% on a similar number of domains.
Dutch domains still publish DNSSEC far above the rest of the list: 48.4% of mail-enabled .nl domains have a DS record, against 6.9% of all domains in the corpus. Their DMARC enforcement fell from 44.5% to 38.7% while more .nl domains entered the ranking. The Dutch registry's DNSSEC incentives still show in the numbers, but enforcement did not rise with the larger .nl slice.
What this means for you#
If you lead a business. Ask one question: "Is our anti-spoofing policy set to reject?" If the answer is "we are monitoring" and has been for more than a quarter, you are among the seven in ten mail domains that can be impersonated.
If you run IT. The fixes are DNS records: enforcement-level DMARC, a strict sender policy, and the same records on parked domains that do not send mail.
If you are a hosting or email provider. Your default is the security posture of every customer who will never open a DNS console. This quarter's broad change without the portfolio was 0.4 points of enforcement. One hosting default can move more than that. This edition's headline moved because one parking template showed up in the ranking.
Check your own domain#
The test used in this study is free at seclens.one. You get a score, a comparison against this baseline, and copy-paste fixes. No signup, no download.
The full technical report has the methodology, the October tables with July comparisons, and the compliance mapping (NIS2, ISO 27001, CIS Controls, BSI IT-Grundschutz). The July edition remains at /research/2026-07-email-security-top1m.
SecLens.ONE measures email security on public domains. October numbers come from the 7 October 2026 assessment. July numbers are the published July edition.