Key findings.
We call a domain spoofable when it has no DMARC record, or has one with the policy p=none. In both cases a forged message that claims to come from the domain is not rejected or quarantined on the domain owner's instruction.
- 72.7% of business domains in Western Europe, 75.8% in Central and Eastern Europe, 71.2% in the United States and 79.2% in the Asian and Gulf countries we sampled are spoofable.
- Trades and crafts (82.1%) and health practices (81.0%) are the most exposed sectors. IT companies are the least exposed, and still 55.9% are spoofable.
- Size matters, but less than expected: in Norway, 65.3% of companies with 10 to 49 staff are spoofable, against 43.2% of companies with 250 or more.
- Companies that route mail through a dedicated mail security gateway are 6.8 times more likely to enforce DMARC. Microsoft 365 and Google Workspace raise the odds 2.3 times.
- Many companies start DMARC and stop halfway. In the Netherlands, 54.6% of the domains that publish DMARC stay at p=none.
- The pattern matches official statistics: countries where more small firms have a written security policy have fewer spoofable domains (Spearman ρ = −0.51, p = 0.005, 28 EEA countries).
Method.
The study is passive. For each company we read public DNS records (MX, SPF, DMARC, a list of common DKIM selectors, MTA-STS, DNSSEC, CAA) and made one ordinary request to the home page, as a browser would. We did not scan ports, send email, test logins or probe for vulnerabilities.
Companies come from OpenStreetMap: businesses mapped as offices, health practices, trades, shops and similar, with a website tag, in 39 countries (22,359 domains, collected through the Overpass API and Geofabrik extracts). To measure company size we added 1,486 Norwegian companies from the Brønnøysund public register, which publishes staff counts.
Domains shared by many businesses (marketplaces, social networks, franchise portals) were removed. DNS lookups that failed were retried; 2.88% stayed unresolved and are excluded from each measure rather than counted as missing records.
Analysis was done in Python (NumPy, pandas, SciPy, scikit-learn): bootstrap 95% confidence intervals per country, chi-square tests between regions, logistic regression for the odds of DMARC enforcement, and Spearman correlation against Eurostat's 2024 survey of ICT security in enterprises.
We publish aggregate figures only. No company is named, and the raw per-domain data is not published.
Results by region.
The differences between regions are statistically significant (χ² = 48.3, 3 degrees of freedom, p < 0.001), but small next to the overall level: in every region, roughly three quarters of companies are exposed.
| Region | Domains | Spoofable | No DMARC | DMARC at p=none | Microsoft 365 |
|---|---|---|---|---|---|
| Western Europe | 13,281 | 72.7% | 40.4% | 32.2% | 32.5% |
| Central and Eastern Europe | 6,358 | 75.8% | 44.2% | 31.7% | 17.8% |
| Asia and Gulf | 2,129 | 79.2% | 49.4% | 29.7% | 16.4% |
| United States | 591 | 71.2% | 38.0% | 32.9% | 33.1% |
Among the larger country samples, Italy is the most exposed (87.7%), followed by France (78.9%) and Spain (78.2%). Germany (69.3%), Romania (69.9%) and the Netherlands (66.0%) sit below the average. The Netherlands has the fewest domains without DMARC (24.8%) but the highest share stuck at p=none, so half of Dutch Microsoft 365 users we measured are still spoofable.
Results by sector.
Sectors that handle payments and personal data on behalf of clients are not better protected than others. Health practices, which send appointment and billing messages to patients, are among the most exposed.
| Sector | Domains | Spoofable | Microsoft 365 | WordPress outdated |
|---|---|---|---|---|
| Trades and crafts | 3,808 | 82.1% | 20.8% | 27.1% |
| Health | 7,469 | 81.0% | 18.1% | 27.5% |
| Legal | 565 | 73.4% | 31.8% | 32.2% |
| Professional services | 2,390 | 72.2% | 30.4% | 27.2% |
| Finance and accounting | 820 | 60.1% | 37.3% | 30.9% |
| IT | 847 | 55.9% | 34.2% | 27.9% |
Results by company size.
OpenStreetMap does not record staff numbers, so we measured size on the Norwegian register sample. Protection improves with size (Spearman ρ = 0.17, p < 0.001, n = 1,431), yet even in one of Europe's most mature markets two thirds of firms with 10 to 49 staff can be impersonated.
| Staff | Domains | Spoofable | No DMARC | Mail security gateway |
|---|---|---|---|---|
| 10 to 49 | 774 | 65.3% | 27.2% | 2.6% |
| 50 to 249 | 599 | 49.4% | 17.0% | 6.5% |
| 250 or more | 113 | 43.2% | 8.1% | 11.7% |
What predicts protection.
A logistic regression on region, sector and mail platform shows that the way mail is run matters more than where the company is. Domains behind a mail security gateway enforce DMARC with 6.8 times the odds of domains on shared hosting mail. Microsoft 365 and Google Workspace raise the odds 2.3 times. Being in Central or Eastern Europe rather than Western Europe changes the odds very little (0.92).
Sector still counts after mail platform is accounted for: health practices (0.58) and trades (0.51) enforce DMARC far less often than the reference group, IT companies more often (1.57).
The practical reading is that most companies never had someone own their email setup. Mail moved to a hosting package or a cloud suite, and the DNS records were left at the defaults.
Websites.
The same single home page request shows how websites are maintained. These figures cover only what a site reveals publicly, so they are lower bounds.
- Between 25% and 33% of WordPress sites that publish their version are three or more minor releases behind the newest one we saw (7.1).
- Between 43% and 58% of sites that reveal their PHP version run a release that no longer receives security fixes.
- 66% of Western and 77% of Eastern European sites send no HSTS header, and 6% to 10% present an expired or mismatched certificate.
Comparison with official statistics.
Eurostat's 2024 survey of ICT security in enterprises asks companies what they do inside the network, which a passive scan cannot see. The gap between small and large firms is wide across every area, and the countries that score lower in the survey also score worse in our scan.
| Measure | 10 to 49 staff | 250 or more staff |
|---|---|---|
| Multi-factor authentication | 36.1% | 77.7% |
| Monitoring for suspicious activity | 40.6% | 82.5% |
| Written security policy | 30.3% | 81.5% |
| Security testing | 29.8% | 78.1% |
| Compulsory security training | 20.4% | 65.9% |
| Backup to a separate location | 77.1% | 95.0% |
Limitations.
- The sample is not random. It favours businesses that someone mapped in OpenStreetMap with a website, which skews toward local, customer-facing companies.
- Samples for the United States and for Asian countries are small and should be read as indicative.
- Size is measured in one country only. Norway is more mature than most of Europe, so the size gap elsewhere is likely larger, not smaller.
- DKIM selectors cannot be listed from outside. A domain with no common selector may still sign its mail.
- A spoofable domain is an opening, not proof of fraud. Some receiving servers apply their own filters regardless of the sender's policy.
What companies can do.
None of the following needs new software. Most companies can complete the first three steps within a month.
- Publish a DMARC record with reporting turned on, and read the reports for two to four weeks to find every service that sends mail in your name.
- Fix SPF and DKIM for those services, then move the policy to p=quarantine and later to p=reject.
- Turn on multi-factor authentication for every mailbox, starting with finance and management.
- Agree with suppliers that a change of bank details is confirmed by phone, on a number you already have.
- Keep the website platform and PHP version on supported releases, and add HSTS once HTTPS works on every page.
Sources.
Check your own domain.
We will check your email and website setup and explain what needs to change.
Contact us