Defaults.Exposed › Stats › Email authentication (SPF, DKIM, DMARC)
How many domains can be email-spoofed?
As of July 28, 2026 · census snapshot 2026-07-28
As of July 28, 2026, 243,029,017 domains — 88.2% of the 276 million graded in the Defaults.Exposed census — lack an enforcing DMARC policy, leaving their domain name open to email spoofing.
Spoofable = no DMARC policy of p=quarantine or p=reject. Receivers may still filter on other signals, but the domain itself asserts no enforcement.
Cite this
Statistic current as of July 28, 2026. Recomputed from the live census each edition; the number on this page and the machine-readable twin always match. Please cite Defaults.Exposed and link this page.
Defaults.Exposed, "How many domains can be email-spoofed?" (as of July 28, 2026). https://defaults.exposed/stats/how-many-domains-can-be-email-spoofed
Permalink:https://defaults.exposed/stats/how-many-domains-can-be-email-spoofed · Machine-readable:spoofable-domains.json · Licence:open data
Methodology: how we grade the internet · Source data: defaults.exposed/data. Updated with each census edition.