DE EN IT

~/blog / email-spoofing-ranking-102-domains

Can these domains be spoofed? We checked SPF and DMARC of 102 well-known domains, and only half of the banks reject forged mail

· Daniele Michelin · ~2 min read · Also in DE · IT

Phishing works best when the sender address looks real. DMARC with p=reject is the record that stops forged mail in a domain's name. We read it from public DNS for 102 well-known domains.

#email #security #dmarc #spf #phishing #research

Topics: DNS, mail & certificates Security & patches

daniele@mikweb: ~/blog — less email-spoofing-ranking-102-domains.md

Most phishing mail does not need a hacked server. It only needs a sender address that looks right. Whether a forged mail with @yourbank.com in the From line gets delivered depends largely on one DNS record: the domain's DMARC policy. I read SPF, DMARC and MTA-STS for 102 well-known domains from public DNS. The full result is a sortable heatmap in the e-mail ranking.

The numbers

  • SPF: 100 of 102 domains publish one. 62 end it with -all, which tells receivers to refuse other servers.
  • DMARC with p=reject: 59 of 102. Forged mail in their name gets refused.
  • p=quarantine: 16. Forged mail goes to spam, which is better than nothing.
  • p=none: 21. DMARC only collects reports; forged mail is not blocked by the policy.
  • No DMARC at all: 6, including tim.it, europa.eu, gov.it and faz.net.
  • MTA-STS (TLS enforced for incoming mail): only 10.

Banks: only half reject

Banks are the most imitated senders in phishing, so I expected them on top. Of 22 banks and payment providers, 11 use p=reject. Several large ones in Germany and Italy only monitor with p=none, for example sparkasse.de, dkb.de, postbank.de and poste.it, and two have no DMARC record on their main domain.

In fairness: banks often send customer mail from separate domains, and big mailbox providers filter forgeries with other signals too. A missing reject policy does not mean customers are unprotected, only that the domain itself does not tell receivers to refuse fakes.

Germany and Italy

In Germany, 20 of 40 domains reject forged mail. In Italy, 13 of 30 do; many major Italian news sites and agid.gov.it are still at p=none.

Why p=none is so common

p=none is meant as the first step: collect reports, find every legitimate sender (newsletter tool, CRM, ticket system), fix SPF and DKIM for them, then move to quarantine and reject. Many organisations stop after step one, because moving to reject feels risky. The reports (rua) are already there: 92 of 102 domains collect them.

How to get to reject

  1. Publish DMARC with p=none and a rua address, and read the reports for two to four weeks.
  2. Make every legitimate sender pass SPF or DKIM with your domain aligned.
  3. Switch to p=quarantine, optionally with pct= to start with a share of mail.
  4. When the reports are clean, set p=reject.

The DMARC generator writes the record, and the mail DNS checker shows what your domain publishes today. If SPF breaks on the 10-lookup limit, the SPF checker shows where.

Method

Only public DNS TXT lookups; nothing was sent to the domains. For subdomains the organisational domain was measured. DKIM is not included, because it cannot be checked from outside without knowing the selector. Points: SPF 20, SPF with -all 15 (~all 8), DMARC 20, p=reject 30 (quarantine 20), reports 5, MTA-STS 10. The ranking is rescanned every week, so numbers can change. As of 6 November 2026.

New articles by e-mail

One e-mail per new article. No tracking, unsubscribe any time. As a thank-you after confirming: my “Server operations & patching” checklist (PDF).

daniele@mikweb: ~/blog — ls

More articles

Mail landing in spam: SPF, DKIM and DMARC alignment explainedSPF, DKIM and DMARC explained simply: what each checks, why mail lands in spam although SPF passes, how to read headers — with a table and checklist.We graded the security headers of 57 big websites: only 21 ship an effective CSPA scan of 57 well-known sites: HSTS is common, CSP is not. Results by header, the four sites with grade A, and how to read the numbers fairly.Scam radar: today's phishing emails and fake texts in plain words, updated twice a dayMy new scam radar collects current scams, explains them in plain words and says what to do. How it works, and how to spot a scam before you click.

← All articles