27.9% of top domains remain vulnerable to email spoofing in late 2026

A recent analysis of the Majestic Million top 1,000 domains shows that 27.9% remain vulnerable to email spoofing as of October 19, 2026. The study highlights that while major platforms have improved adoption, many organizations still rely on permissive DNS records that fail to block forged emails.

What happened

The investigation examined the Domain-based Message Authentication, Reporting, and Conformance (DMARC) records for 974 registrable domains from the Majestic Million list. This ranking measures global web presence by backlinks. The goal was to determine how many of these high-profile domains effectively prevent attackers from sending emails that appear to originate from them. The results indicate that 272 domains either publish no DMARC record, use a non-enforcing policy, or have invalid configurations.

While 72.1% of the audited domains now enforce DMARC, a significant portion remains exposed. Among the enforcing group, 53.1% use the strictest "reject" policy, which tells receiving servers to discard unauthenticated messages entirely. Another 19.0% use "quarantine," which typically routes suspicious mail to spam folders. However, 16.9% still use "none," a monitoring-only mode that allows all mail through regardless of authentication status, and 11.0% have no record at all.

The data also reveals a disparity based on email infrastructure. Domains using major hosted providers like Google Workspace or Microsoft 365 have lower spoofability rates, ranging from 18.1% to 20.5%. In contrast, domains using other or self-hosted mail solutions are spoofable 40.7% of the time. Even domains with no mail exchange (MX) records, which should theoretically not receive email, show a 38.2% spoofability rate because they often lack protective DNS entries.

Key details

• Spoofable definition: A domain is considered spoofable if its effective DMARC policy is missing, set to p=none, or invalid.
• Provider gap: Self-hosted or niche email providers show twice the spoofability rate (40.7%) compared to major platforms like Google (18.1%).
• Compliance vs. security: Major providers like Gmail and Yahoo require only p=none for bulk senders, meaning compliance does not equal full protection.
• SPF issues: 15.5% of domains lack an SPF record entirely, and 1.0% exceed the 10-DNS-lookup limit, causing validation errors.
• Transport security: Only 1.5% of domains enforce MTA-STS, a protocol that ensures encrypted email delivery.
• Non-mail domains: Domains that do not receive email should publish v=spf1 -all and p=reject to prevent impersonation, but many do not.

Background

DMARC works in conjunction with SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to verify email authenticity. SPF lists authorized IP addresses for sending mail, while DKIM adds a digital signature to messages. DMARC ties these together by telling receiving servers what to do if an email fails these checks. A policy of p=none instructs receivers to deliver the mail anyway but send a report to the domain owner. This is useful for initial setup but offers no protection against phishing.

The shift toward stricter enforcement has been driven by new requirements from major mailbox providers. Since early 2024, Gmail and Yahoo have mandated that bulk senders publish DMARC records, though initially accepting p=none. Microsoft followed in May 2025 with similar rules for Outlook.com users. These regulations have successfully increased the number of domains publishing DMARC records, but they have not universally pushed organizations to adopt the stricter p=reject policy needed to stop spoofing.

Why it matters

For teams managing their own software and infrastructure, this data underscores the risk of relying solely on default configurations or minimal compliance. If your organization uses a self-hosted email server or a niche provider, you are statistically more likely to be misconfigured than peers on major platforms. Attackers target well-known domains because users trust them. A p=none policy essentially invites phishers to impersonate your brand, as receiving servers will not block their forged messages.

Furthermore, the low adoption of transport security standards like MTA-STS indicates that many organizations are not protecting email in transit from downgrade attacks. While DMARC prevents impersonation, MTA-STS ensures that the connection between mail servers is encrypted and cannot be intercepted. Ignoring these layers leaves both your reputation and your communications vulnerable.

The distinction between compliance and security is critical. Meeting the minimum requirements of Gmail or Yahoo keeps your marketing emails out of the junk folder, but it does not secure your domain against abuse. IT leads must recognize that passing a bulk-sender check is merely the first step in a broader security strategy.

What you can do

• Audit your DMARC policy: Check if your domain uses p=none and plan a migration to p=quarantine and eventually p=reject.
• Secure non-mail domains: For any domain that does not receive email, publish v=spf1 -all and p=reject to block all outbound mail.
• Review SPF records: Ensure your SPF record includes only necessary services and stays under the 10-DNS-lookup limit to avoid permanent errors.
• Enable reporting: Use rua tags in your DMARC record to receive aggregate reports, helping you identify legitimate senders before enforcing strict policies.
• Implement MTA-STS: Deploy MTA-STS and TLS-RPT to enforce encrypted connections and receive reports on failed TLS negotiations.
• Monitor continuously: Regularly check your DNS records for accidental changes or expiration, especially if you manage multiple subdomains.