64%
143 of 222 companies can be spoofed. Nothing asks Gmail or Outlook to block an email that uses their domain without authorization: they either have no DMARC, or have it in monitoring mode only.
Only 15% reject fake emails
DMARC is the record that tells a receiver what to do with an email that claims to come from your domain but fails verification. This is how the 222 companies break down, from least to most protected:
- No DMARC61 · 27%Nothing tells the receiver what to do with a fake email.
- p=none82 · 37%Monitoring only: the fake email still gets through.
- p=quarantine46 · 21%The fake email goes to spam.
- p=reject33 · 15%The fake email is rejected.
View as table
| Policy | What happens to a fake email | Companies | % |
|---|---|---|---|
| No DMARC | Nothing tells the receiver what to do with a fake email. | 61 | 27% |
| p=none | Monitoring only: the fake email still gets through. | 82 | 37% |
| p=quarantine | The fake email goes to spam. | 46 | 21% |
| p=reject | The fake email is rejected. | 33 | 15% |
By industry
IT services
70%
81 of 116 can be spoofed
Software
60%
36 of 60 can be spoofed
Cybersecurity
5 of 7
Too small a sample for a percentage, but the pattern holds even among companies that sell security.
Industry is as reported by each company's commercial data source. 39 companies had no industry or a different one, and count only toward the total.
Other findings
- 31 companies (14%)
- have an SPF record with serious errors. 25 of them have none at all: nothing declares which servers may send on their behalf.
- 8 companies
- have no mail servers configured on their domain.
- 55% on Google · 29% on Microsoft 365
- and the remaining 16% on other providers or their own servers.
- 78% sign their emails
- with DKIM, at least. It's a lower bound: the signature is published under a name that can't always be guessed from the outside.
Why it matters
Spoofing. Without a DMARC policy that blocks, someone can send your clients an email with your exact domain as the sender: an invoice with a different bank account, a link to a fake portal. For a tech company, it's also a credibility problem.
Deliverability. Since 2024, Google and Yahoo require DMARC from bulk senders, and filters distrust domains that don't protect their identity. An exposed domain is also a domain whose own emails reach the inbox less often.
It takes an afternoon to fix. It's a TXT record in DNS. The prudent path is to start at p=none to receive reports, confirm all legitimate email passes, then move to quarantine and later to reject.
Methodology
- Date: September 11, 2026.
- Sample: 223 Chilean software, IT services and cybersecurity companies with 10 to 50 employees, according to their commercial data source. It is Ovantly's prospecting database, not a random sample of the market: the figures describe this group, not every company in the country. One company couldn't be checked because of a DNS error.
- What was checked: each domain's public MX, SPF, DKIM and DMARC records, queried through Cloudflare's and Google's public resolvers. Anyone can repeat the lookup.
- How it was classified: "can be spoofed" means the domain publishes no DMARC record, or publishes it with p=none. DKIM was looked up under the most common selectors, so its figure is a minimum.
- Privacy: we don't publish the name of any company or the result for any specific domain.
- Tool: it's the same engine as our domain checker, which you can use for free on your own domain.