Defaults.Exposed › Research › Domain Exposure by Country
Domain Exposure by Country
Data as of 2026-06-29 · 69 countries · "spoofable" = lacks an enforcing DMARC policy (`quarantine`/`reject`). Aggregate only.
Across the whole census, 89.4% of domains can be impersonated in email, 42.7% accept mail with no authentication at all, and 8.8% have none of the five core protections. Here's how national domain endings (ccTLDs) compare — lower is better.
| # | Country | Domains | Spoofable | Mail, no auth | Fully exposed |
|---|---|---|---|---|---|
| 1 | Switzerland | 1,386,298 | 67.1% | 17.3% | 0.7% |
| 2 | Netherlands | 2,936,673 | 70.6% | 17.8% | 1% |
| 3 | Poland | 1,539,259 | 76.6% | 16.4% | 0.7% |
| 4 | Norway | 431,786 | 78.1% | 29.3% | 2.8% |
| 5 | Kenya | 87,586 | 78.3% | 13.8% | 0.4% |
| 6 | Germany | 8,732,116 | 78.6% | 24.8% | 2.5% |
| 7 | Denmark | 609,198 | 80.1% | 47.3% | 1.1% |
| 8 | India | 2,153,225 | 80.7% | 38.2% | 3.5% |
| 9 | Colombia | 1,972,068 | 81.5% | 34% | 5.2% |
| 10 | Luxembourg | 52,948 | 81.5% | 26.2% | 3.1% |
| 11 | Greece | 356,641 | 81.7% | 16.9% | 0.5% |
| 12 | European Union | 1,544,510 | 81.8% | 29.7% | 1.8% |
| 13 | Singapore | 101,012 | 82.8% | 28.6% | 1.5% |
| 14 | Thailand | 53,788 | 83.2% | 18.1% | 0.9% |
| 15 | Slovakia | 277,662 | 83.3% | 17.3% | 1% |
| 16 | Turkey | 492,598 | 84.1% | 20.4% | 1.1% |
| 17 | South Africa | 989,753 | 84.3% | 14.3% | 1.9% |
| 18 | Spain | 1,077,199 | 85% | 23.6% | 1.4% |
| 19 | Belgium | 922,442 | 85.1% | 29.9% | 2.7% |
| 20 | Australia | 2,235,693 | 86.3% | 27.2% | 2% |
| 21 | France | 2,457,627 | 86.3% | 22.6% | 1.6% |
| 22 | United Kingdom | 5,577,918 | 86.6% | 37.3% | 8% |
| 23 | Portugal | 278,664 | 86.8% | 17.7% | 0.7% |
| 24 | Mexico | 659,905 | 87% | 29.1% | 4% |
| 25 | Canada | 2,059,738 | 87.5% | 38.5% | 5.1% |
| 26 | Estonia | 120,411 | 87.6% | 33% | 1.1% |
| 27 | Nigeria | 121,678 | 87.7% | 21.6% | 0.8% |
| 28 | Peru | 95,859 | 88.2% | 21% | 2.1% |
| 29 | New Zealand | 425,195 | 88.5% | 33% | 3.2% |
| 30 | Brazil | 3,192,221 | 88.7% | 30.2% | 1.6% |
| 31 | Latvia | 83,406 | 88.8% | 37% | 1.8% |
| 32 | Austria | 717,361 | 88.9% | 25.5% | 2.6% |
| 33 | Saudi Arabia | 53,976 | 89.2% | 23.3% | 1.3% |
| 34 | Romania | 451,757 | 89.2% | 17.3% | 2.1% |
| 35 | Croatia | 97,597 | 89.3% | 11.7% | 0.4% |
| 36 | Montenegro | 708,065 | 89.3% | 47.8% | 3.8% |
| 37 | Indonesia | 630,611 | 89.7% | 45.1% | 2.2% |
| 38 | Sweden | 804,056 | 89.8% | 41.6% | 1.7% |
| 39 | Bulgaria | 64,723 | 90.8% | 13.7% | 0.6% |
| 40 | Czechia | 888,568 | 90.8% | 50% | 4.5% |
| 41 | Chile | 424,826 | 90.9% | 19.6% | 1.5% |
| 42 | Hong Kong | 79,488 | 91% | 37.2% | 2.5% |
| 43 | Taiwan | 191,255 | 91.2% | 51.5% | 3.7% |
| 44 | United Arab Emirates | 131,048 | 91.2% | 25.5% | 1.5% |
| 45 | Ireland | 165,701 | 91.2% | 25.4% | 2.7% |
| 46 | United States | 956,808 | 91.3% | 39.7% | 12% |
| 47 | Malaysia | 304,129 | 92.2% | 54.4% | 2.6% |
| 48 | Finland | 358,834 | 92.7% | 26.7% | 0.9% |
| 49 | Kazakhstan | 113,324 | 93% | 22.3% | 1.1% |
| 50 | Hungary | 491,148 | 93.1% | 21.1% | 2.7% |
| 51 | Slovenia | 117,446 | 93.2% | 20% | 0.4% |
| 52 | Serbia | 109,284 | 93.5% | 18% | 1% |
| 53 | Argentina | 377,574 | 93.7% | 26.1% | 2.5% |
| 54 | Belarus | 91,251 | 93.7% | 28.3% | 0.6% |
| 55 | Lithuania | 139,241 | 94.1% | 24.2% | 0.7% |
| 56 | Japan | 1,090,022 | 94.1% | 15.2% | 0.5% |
| 57 | Uzbekistan | 67,056 | 94.2% | 29.2% | 1.1% |
| 58 | Morocco | 64,969 | 94.3% | 25.2% | 3.4% |
| 59 | Pakistan | 116,046 | 94.7% | 30.4% | 0.6% |
| 60 | Israel | 167,356 | 94.8% | 35.4% | 1.6% |
| 61 | Italy | 2,036,325 | 94.8% | 17.9% | 1.1% |
| 62 | Iran | 442,854 | 95.3% | 38.4% | 3.9% |
| 63 | Ukraine | 300,500 | 95.4% | 42.8% | 2.3% |
| 64 | Nepal | 69,393 | 96% | 49.1% | 2.2% |
| 65 | Vietnam | 320,457 | 96% | 59.5% | 9% |
| 66 | Russia | 2,938,356 | 96.8% | 46.8% | 2.6% |
| 67 | South Korea | 377,606 | 98.1% | 58.3% | 3.8% |
| 68 | China | 2,140,750 | 98.5% | 92.4% | 5.8% |
| 69 | Philippines | 4,313,047 | 99.8% | 99% | 0.1% |
"Spoofable" = share of domains with no enforcing DMARC policy, so the visible "From" address can be forged. "Mail, no auth" = has MX records but no working SPF/DMARC. "Fully exposed" = zero of five core protections (SPF, enforced DMARC, DNSSEC, HTTPS, HSTS). The domain ending is a proxy for the country/sector, not company registration.
Averages don't tell you about your domain. Check yours free → — owner-only, with exactly what to fix.
By country · By industry · By TLD · The exposure score → · Can someone spoof your domain? →