SPF, DKIM, and DMARC in 2026: Why 69% of Business Domains Can Still Be Spoofed — and How €89 Fixes It

Quick Answer: 69.2% of domains worldwide have no effective DMARC protection (DmarcDkim.com, May 2026). Only 11.2% enforce a reject policy. This means anyone can send emails pretending to be your company — to your clients, your partners, your bank. Business Email Compromise (BEC) caused $3.05 billion in verified losses in the US alone in 2025 (FBI IC3 Report). SPF, DKIM, and DMARC are three DNS records that prevent domain spoofing. Setup takes 5 business days and costs €89 at Optimum Web. Required by GDPR Article 32, NIS2 Article 21(2), and now enforced by Google and Yahoo for all bulk senders.

Right now, someone could send an email from [email protected] to your biggest client, asking them to wire €50,000 to a new bank account. The email would look legitimate. It would pass through most spam filters. Your client would see your company name in the “From” field.

If your domain doesn’t have SPF, DKIM, and DMARC configured — this takes about 15 minutes for an attacker. No hacking required. No password theft. Just a $5 SMTP server and your company’s domain name.

This isn’t theoretical. The FBI reports that Business Email Compromise caused $3.05 billion in verified losses in the United States in 2025 alone — and those are only the cases that were reported. The real number is significantly higher.

The fix? Three DNS records. €89. Five business days. Your domain becomes unspoofable.

Every statistic below is from named, verifiable sources.

Despite BEC costing billions, most domains remain unprotected:

Let’s demystify these three protocols. They’re simpler than they sound.

What it does: Tells the world which servers are allowed to send email from your domain.

How it works: You publish a DNS TXT record listing every IP address and service that legitimately sends email on your behalf (your mail server, Google Workspace, Mailchimp, your CRM, etc.). When a receiving server gets an email from your domain, it checks this list. If the sending server isn’t on the list — the email fails SPF.

What it looks like: ``v=spf1 include:_spf.google.com include:servers.mcsv.net include:sendgrid.net -all``

This says: “Google Workspace, Mailchimp, and SendGrid are allowed to send email from our domain. Nobody else. Reject everything else.”

Without SPF: Any server in the world can claim to send email from your domain. Spam filters might catch some of it, but there’s no authoritative way to verify.

What it does: Adds a digital signature to every email you send, proving it hasn’t been tampered with in transit.

How it works: Your email server signs each outgoing email with a private key. The corresponding public key is published in your DNS. Receiving servers verify the signature against the public key. If the signature matches — the email is authentic and unmodified.

Why it matters beyond anti-spoofing: DKIM also proves that the email content hasn’t been altered after sending. If an attacker intercepts an email and changes the bank account number in a wire transfer request, the DKIM signature breaks. The receiving server knows the email was tampered with.

Without DKIM: Emails can be modified in transit, and there’s no way for the recipient to verify integrity.

What it does: Tells receiving servers what to do when SPF or DKIM fails — and sends you reports about who’s trying to send email from your domain.

Three policy levels:

What it looks like: ``v=DMARC1; p=reject; rua=mailto:[email protected]; pct=100``

The critical insight: DMARC at p=none provides zero protection. It only monitors. Yet more than half of all domains with DMARC records are still at p=none — giving a false sense of security while offering no actual defense against spoofing.

Without DMARC: Even with SPF and DKIM, receiving servers don’t know what to do when authentication fails. Some might still deliver the forged email. DMARC closes this gap by providing an explicit policy.

SPF alone can be bypassed. DKIM alone doesn’t specify a policy. DMARC without SPF and DKIM has nothing to evaluate. Together, they form a complete defense.

When an email arrives at a recipient’s server: 1. Check SPF: Is the sending server authorised? 2. Check DKIM: Is the signature valid and unmodified? 3. Check DMARC: Do SPF or DKIM pass AND align with the From domain? - If yes: deliver normally - If no: apply DMARC policy (none/quarantine/reject) - Send report to domain owner

All three are required. This is not optional layering — it’s a system.

Email authentication has shifted from best practice to hard requirement across multiple regulatory and platform frameworks.

Google and Yahoo now require SPF, DKIM, and DMARC for all bulk senders (5,000+ emails per day). Without these:

- Emails are throttled (delivered slowly) - Emails go to spam folder - Emails are rejected entirely

This isn’t a recommendation. It’s enforced. If your company sends newsletters, marketing emails, or transactional emails to Gmail or Yahoo users without proper authentication — your emails are already being affected.

PCI DSS v4.0 requirement 5.4.1 requires “anti-phishing mechanisms” including “DMARC with a policy of p=reject or p=quarantine” for all organizations processing card payments. This took effect March 31, 2025.

NIS2 Article 21(2) requires “security measures” for network and information systems. Email authentication is explicitly covered as a baseline measure in ENISA guidance for NIS2 implementation.

GDPR Article 32 requires “appropriate technical measures” for data security. A spoofed email that tricks an employee into revealing customer data is a data breach. If your domain could have prevented the spoofing with a €89 DMARC setup — the regulator will ask why you didn’t.

These are not hypothetical edge cases. Each scenario below occurs thousands of times per month worldwide.

An attacker sends an email from [email protected] to your CFO: “Please wire €47,000 to this new supplier account urgently. I’m in a meeting, can’t talk.” The CFO sees the CEO’s name, sees the correct domain, and processes the payment.

With DMARC at p=reject: The email would never reach the CFO’s inbox. The receiving server would check DMARC, find that the sending server is not authorised, and reject the email.

Average loss per incident: $123,000 (FBI IC3 2025)

An attacker sends invoices from [email protected] to your clients with a different bank account number. Your client pays the attacker. You never receive the money. Your client thinks they paid you.

With DMARC at p=reject: The fake invoice email is blocked. Your client only receives emails from servers you’ve authorised.

An attacker sends a “password reset” email from [email protected] to all employees. The link leads to a credential harvesting page. 5 employees enter their passwords. The attacker now has VPN access.

With DMARC at p=reject: The phishing email is blocked before reaching any employee’s inbox.

Without SPF and DKIM, your legitimate marketing emails increasingly go to spam. Google, Yahoo, and Microsoft see your domain sends unauthenticated email and gradually lower your reputation. Open rates drop from 25% to 3%. Your email marketing ROI collapses.

With proper authentication: Your emails consistently land in inbox. Deliverability stays above 95%.

Our service covers your entire email sending infrastructure — not just the main domain, but every third-party service that sends email on your behalf.

You can check your domain’s email authentication in 30 seconds:

Step 1: Go to https://mxtoolbox.com/spf.aspx — enter your domain. Do you have an SPF record?

Step 2: Go to https://mxtoolbox.com/dmarc.aspx — enter your domain. Do you have a DMARC record? Is the policy reject or quarantine?

Step 3: Send a test email to mail-tester.com — it shows your SPF, DKIM, and DMARC status.

If any of these checks fail — your domain can be spoofed right now. Every minute of every day.

There is no middle ground with email authentication. Either your domain has SPF + DKIM + DMARC at enforcement level, and nobody can spoof it — or it doesn’t, and anyone can send emails as your CEO to anyone in the world.

69.2% of domains are in the second category. BEC cost $3.05 billion in verified losses last year.

€89 and 5 business days. That’s all it takes.