80.9% of local businesses can be impersonated by email
An email from your accountant asks you to pay this month's invoice into a new bank account. Whether your mail server can tell it is forged depends on a few public records the accountant publishes. We read them for 6,937 local businesses in 10 countries in October 2026.
Study by Guglielmo Paesano, founder of AIGROW · data under CC BY 4.0
- Domains read
- 6,937
- Countries
- 10
- Cities
- 30
- Kinds of business
- 10
- No DMARC record
- 3,458
Can anyone send email in a local business's name? For most, yes. In October 2026, AIGROW read the public DMARC and SPF records of 6,937 local business domains in 10 countries. 80.9% published no record asking receiving mail servers to refuse every forged email, so one claiming to come from them can reach a customer's inbox.
Findings
Each domain read once, from public DNS. Can be impersonated means the free email spoofing checker calls the domain forgeable.
80.9% of the local business domains we read can be impersonated by email: 5,611 of 6,937.
3,458 have no DMARC record at all, 2,093 have one set to p=none, which asks for reports and stops nothing, and 60 have a broken record or one applied to only part of their mail. 1,266 (18.2%) ask receiving servers to quarantine or refuse every forged message.
4,159 of the 5,611 that can be impersonated do publish SPF, and 1,573 of them end it in -all, the strict setting.
SPF lists the servers allowed to send for a domain and checks the return address hidden in the message. The sender a customer sees is checked only when DMARC asks the receiving server to match the two. Across the sample, 5,329 of 6,937 domains publish SPF.
By country, the share ranges from 72.2% in the Netherlands to 94.3% in Italy.
By kind of business, it ranges from 72.5% for lawyers to 89.2% for restaurants. Accountants, whose clients act on emails about payments, stand at 74.2%.
Country by country
Share of each country's domains by DMARC policy, three cities per country, most exposed first.
| Country | Domains | No DMARC | p=none | Quarantine | Reject | Invalid | Can be impersonated |
|---|---|---|---|---|---|---|---|
| Italy | 546 | 43.8% | 49.3% | 3.5% | 2.6% | 0.9% | 94.3% |
| France | 717 | 64.7% | 22.3% | 8.1% | 4.7% | 0.1% | 87.7% |
| Canada | 766 | 56.3% | 28.9% | 10.1% | 4.3% | 0.5% | 86.2% |
| United States | 629 | 61.2% | 23.1% | 8.9% | 6.7% | 0.2% | 84.7% |
| Spain | 689 | 51.1% | 31.2% | 13.2% | 3.8% | 0.7% | 83.3% |
| Australia | 659 | 51.9% | 28.7% | 10.5% | 8.3% | 0.6% | 81.6% |
| United Kingdom | 651 | 43.8% | 31.8% | 10.1% | 14.3% | 0.0% | 77.1% |
| Germany | 996 | 43.4% | 29.2% | 7.6% | 19.7% | 0.1% | 73.2% |
| Switzerland | 618 | 53.1% | 19.4% | 16.5% | 10.8% | 0.2% | 72.8% |
| Netherlands | 666 | 30.0% | 41.4% | 15.9% | 11.9% | 0.8% | 72.2% |
By kind of business
Share of the domains in each kind of business by DMARC policy, all ten countries together, most exposed first.
| Kind of business | Domains | No DMARC | p=none | Quarantine | Reject | Invalid | Can be impersonated |
|---|---|---|---|---|---|---|---|
| Restaurants | 1,190 | 57.8% | 30.5% | 5.7% | 5.6% | 0.3% | 89.2% |
| Hair salons | 940 | 57.4% | 26.9% | 8.4% | 6.3% | 1.0% | 85.5% |
| Hotels | 997 | 47.3% | 32.0% | 11.8% | 8.6% | 0.2% | 80.2% |
| Veterinarians | 411 | 42.6% | 36.7% | 9.0% | 11.2% | 0.5% | 80.0% |
| Dentists | 806 | 47.1% | 31.6% | 12.9% | 7.9% | 0.4% | 79.5% |
| Car repair shops | 549 | 55.9% | 22.2% | 11.7% | 10.0% | 0.2% | 78.7% |
| Architects | 451 | 49.7% | 28.4% | 11.8% | 10.2% | 0.0% | 78.5% |
| Real estate agencies | 653 | 37.4% | 38.4% | 11.3% | 12.3% | 0.6% | 77.0% |
| Accountants | 275 | 49.1% | 24.0% | 11.6% | 14.5% | 0.7% | 74.2% |
| Lawyers | 665 | 44.1% | 27.8% | 13.7% | 14.4% | 0.0% | 72.5% |
How the SPF records end
The last term of an SPF record tells a receiver what to do with mail from a server the record does not list. All 6,937 domains.
| SPF record | Domains | Share | Can be impersonated |
|---|---|---|---|
| Ends in -all, the strict setting | 2,293 | 33.1% | 1,573 |
| Ends in ~all, marked but accepted | 2,842 | 41.0% | 2,401 |
| Ends in ?all, no opinion | 155 | 2.2% | 150 |
| Ends in +all, every server allowed | 3 | 0.0% | 3 |
| No all term | 36 | 0.5% | 32 |
| Broken or duplicated | 53 | 0.8% | 50 |
| No SPF record | 1,555 | 22.4% | 1,402 |
How the study was made
- The businesses
- Businesses listed on OpenStreetMap within 6 km of the centre of 30 cities, three in each country, in 10 kinds of business, each with its own website. The domain of that website is the one read. At most 40 per kind of business and city, picked by a fixed hash of the domain so a rerun picks the same ones. The cities: United States (New York, Chicago, Los Angeles), United Kingdom (London, Manchester, Birmingham), Canada (Toronto, Vancouver, Montreal), Australia (Sydney, Melbourne, Brisbane), France (Paris, Lyon, Marseille), Germany (Berlin, Munich, Hamburg), Italy (Milan, Rome, Turin), Netherlands (Amsterdam, Rotterdam, Utrecht), Spain (Madrid, Barcelona, Valencia), Switzerland (Zurich, Bern, Lausanne).
- Chains left out
- OpenStreetMap listed 34,647 distinct domains. 728 of them appear in more than one city, which marks a chain or a directory, and were left out. A domain listed under two kinds of business in one city counts once.
- The reading
- Read on 28 October 2026 through the public resolvers 1.1.1.1, 8.8.8.8, with the code of the free email spoofing checker: the DMARC record of the domain, or of its parent domain when it has none, the SPF record with its includes and redirects, and the MX record. 47 domains public DNS did not answer for are left out of every count.
- Can be impersonated
- The checker calls a domain forgeable when nothing it publishes asks receivers to stop forged mail: no DMARC record, a policy of none, a broken or duplicated record, quarantine applied to only part of the mail, or an SPF record that lets every server send. Partly protected means reject on only part of the mail, or subdomains left open. Protected means quarantine or reject on all of it.
- What DNS cannot show
- The records say what a domain asks of receiving servers. They do not show whether a given server follows the request, whether the business signs its mail with DKIM, since a signing key is found only under a name the sender picks, or whether a forger uses a lookalike domain instead. 951 of the 6,937 domains have no MX record and may send no mail at all; they are counted with the rest, since a forger does not need the real domain to receive anything.
- Counts only
- No website was opened and no mail server contacted. The data holds counts by country and kind of business, never a business name or a domain: a list of businesses whose email can be forged would be a list of targets. A country and kind of business with fewer than 10 domains is left out of the CSV. Business data © OpenStreetMap contributors, ODbL 1.0.
Data and citation
Guglielmo Paesano, AIGROW. How many local businesses can be impersonated by email, October 2026, aigrow.gg/research/email-spoofing-2026. The figures and the data are published under CC BY 4.0: reuse them with a link to this page.
For the press: Guglielmo Paesano, founder of AIGROW and author of the study, answers questions about it by email at hello@aigrow.gg.
About the author: Guglielmo Paesano founded AIGROW, which makes the free email spoofing checker this study reads domains with, and sets up DMARC for small businesses.
Can someone send email as your business?
The free checker reads your DMARC, SPF and DKIM records and gives you the exact records to publish. If you would rather have it done for you, the DMARC setup service costs $149, paid once.
Edition October 2026 · data under CC BY 4.0