Defaults.Exposed › Research › Domain Exposure by Country
Domain Exposure by Country
Data as of 2026-07-28 · 68 countries · "spoofable" = lacks an enforcing DMARC policy (`quarantine`/`reject`). Aggregate only.
Across the whole census, 88.2% of domains can be impersonated in email, 10% accept mail with no authentication at all, and 8.5% have none of the five core protections. Here's how national domain endings (ccTLDs) compare — lower is better.
| # | Country | Domains | Spoofable | Mail, no auth | Fully exposed |
|---|---|---|---|---|---|
| 1 | Switzerland | 1,409,983 | 66.8% | 7% | 0.5% |
| 2 | Netherlands | 3,027,676 | 70.4% | 6.9% | 0.5% |
| 3 | Poland | 1,658,199 | 71.2% | 3.2% | 0.5% |
| 4 | India | 2,421,232 | 77.7% | 4.9% | 3.7% |
| 5 | Germany | 8,535,457 | 78.1% | 8.4% | 1.2% |
| 6 | Kenya | 89,348 | 78.6% | 4.1% | 0.6% |
| 7 | Norway | 488,542 | 80% | 14.5% | 0.5% |
| 8 | Denmark | 655,290 | 80.4% | 28.1% | 0.4% |
| 9 | Colombia | 2,254,601 | 80.7% | 9.1% | 6.7% |
| 10 | Luxembourg | 53,751 | 81.5% | 9.3% | 3.1% |
| 11 | Slovakia | 287,028 | 81.7% | 7% | 0.9% |
| 12 | European Union | 1,586,756 | 82% | 12% | 1.8% |
| 13 | Greece | 370,344 | 82.1% | 3.9% | 0.6% |
| 14 | Thailand | 54,355 | 82.6% | 7.3% | 1.6% |
| 15 | Singapore | 100,621 | 82.7% | 14.1% | 2% |
| 16 | Turkey | 498,690 | 83.7% | 4.6% | 0.7% |
| 17 | South Africa | 1,003,189 | 84.6% | 6.3% | 1.5% |
| 18 | Belgium | 925,509 | 85.1% | 17.1% | 1.3% |
| 19 | United Kingdom | 6,096,874 | 85.2% | 13.9% | 7.6% |
| 20 | Spain | 1,120,833 | 85.2% | 4.8% | 1.2% |
| 21 | Australia | 2,471,538 | 85.4% | 8.7% | 2.5% |
| 22 | Mexico | 693,170 | 85.9% | 7.8% | 3.4% |
| 23 | Canada | 2,398,161 | 86.4% | 11.1% | 6.9% |
| 24 | France | 2,584,421 | 86.5% | 8.1% | 1.5% |
| 25 | Portugal | 280,782 | 86.6% | 4.9% | 0.7% |
| 26 | Nigeria | 119,991 | 87.1% | 7.1% | 2.2% |
| 27 | Peru | 98,314 | 87.8% | 7% | 1.5% |
| 28 | Montenegro | 724,706 | 88.4% | 9% | 5.1% |
| 29 | New Zealand | 442,276 | 88.7% | 9.9% | 1.9% |
| 30 | Brazil | 3,259,886 | 88.8% | 5.6% | 1.1% |
| 31 | Austria | 753,911 | 88.9% | 10.6% | 1.4% |
| 32 | Latvia | 86,334 | 88.9% | 8.8% | 1.4% |
| 33 | United States | 1,119,264 | 88.9% | 13.4% | 13% |
| 34 | Romania | 456,287 | 89% | 6.2% | 0.7% |
| 35 | Estonia | 139,977 | 89% | 7.1% | 0.8% |
| 36 | Saudi Arabia | 55,039 | 89% | 8.5% | 1.1% |
| 37 | Croatia | 104,384 | 89.4% | 4.5% | 0.6% |
| 38 | Indonesia | 634,878 | 89.7% | 6.9% | 3.2% |
| 39 | Bulgaria | 66,456 | 90.6% | 7.2% | 0.7% |
| 40 | Chile | 435,801 | 90.6% | 5.5% | 1.7% |
| 41 | Czechia | 917,837 | 90.7% | 31% | 2% |
| 42 | Taiwan | 205,319 | 90.8% | 10.5% | 4% |
| 43 | Hong Kong | 80,620 | 90.9% | 12.5% | 2.9% |
| 44 | United Arab Emirates | 135,794 | 91.1% | 9.8% | 1.4% |
| 45 | Ireland | 180,887 | 91.3% | 11.9% | 1.3% |
| 46 | Sweden | 1,006,974 | 91.5% | 21.5% | 0.6% |
| 47 | Malaysia | 309,075 | 92.2% | 6.4% | 2.9% |
| 48 | Finland | 367,709 | 92.8% | 11.9% | 1% |
| 49 | Slovenia | 126,446 | 93% | 3.9% | 0.7% |
| 50 | Kazakhstan | 117,210 | 93.1% | 5% | 1.5% |
| 51 | Serbia | 117,403 | 93.8% | 7.7% | 0.6% |
| 52 | Pakistan | 109,756 | 93.9% | 3.6% | 0.5% |
| 53 | Argentina | 417,979 | 93.9% | 4.3% | 2% |
| 54 | Belarus | 98,058 | 94% | 8.5% | 0.8% |
| 55 | Hungary | 584,280 | 94% | 13% | 1.1% |
| 56 | Lithuania | 142,070 | 94% | 4.6% | 0.9% |
| 57 | Uzbekistan | 69,627 | 94% | 8% | 1.6% |
| 58 | Japan | 1,097,074 | 94.1% | 7.8% | 1.3% |
| 59 | Morocco | 67,168 | 94.4% | 10.9% | 3.9% |
| 60 | Iran | 480,373 | 94.9% | 7.9% | 4.3% |
| 61 | Israel | 185,689 | 95% | 11.5% | 1.4% |
| 62 | Italy | 2,199,572 | 95% | 8% | 1.3% |
| 63 | Ukraine | 300,982 | 95.3% | 17.7% | 1.8% |
| 64 | Nepal | 72,152 | 95.5% | 6.5% | 1.8% |
| 65 | Vietnam | 322,458 | 95.9% | 17.1% | 8.1% |
| 66 | Russia | 2,952,318 | 96.9% | 8.2% | 2.7% |
| 67 | South Korea | 400,259 | 98.2% | 9.1% | 3.2% |
| 68 | China | 2,417,236 | 98.5% | 2.1% | 5.4% |
"Spoofable" = share of domains with no enforcing DMARC policy, so the visible "From" address can be forged. "Mail, no auth" = has MX records but no working SPF/DMARC. "Fully exposed" = zero of five core protections (SPF, enforced DMARC, DNSSEC, HTTPS, HSTS). The domain ending is a proxy for the country/sector, not company registration.
Averages don't tell you about your domain. Check yours free → — owner-only, with exactly what to fix.
By country · By industry · By TLD · The exposure score → · Can someone spoof your domain? →