86% of small businesses can have their email forged

In October 2026 we checked the public email records of 19,113 small-business domains across more than 100 US cities and 21 states. 57% publish no DMARC policy at all, and another 29% publish one that tells Gmail and Outlook to deliver forged mail anyway. Only 14% tell receivers to send forged email in their name to spam or refuse it.

57.2%no DMARC policy: nothing tells receivers to refuse a forgery

28.8%DMARC set to p=none: monitored, forged mail still delivered

14.0%protected: forged mail goes to spam or is refused

20.4%no valid SPF and no DMARC: nothing at all

Why it matters

The most expensive email scam for a small business is not spam. It is a message that looks exactly like it came from the business: "our bank details have changed, please send this month's payment here." Tenants pay rent to it, patients pay invoices to it, suppliers pay refunds to it. The FBI's Internet Crime Complaint Center has ranked this kind of fraud (business email compromise) among the costliest it tracks, year after year. A DMARC policy at quarantine or reject is the record that makes receivers check, and refuse, mail that claims to be from a domain but was not sent by it. It costs nothing to publish.

Check your own domain in ten seconds: the free email forgery check runs in your browser and shows the exact records to add. Rather have it done? The records go in at your domain company for a fixed $75, paid only after the check shows you protected - email me your domain.

Sell email security to small businesses (MSP, IT provider)? The exposed domains behind these numbers are listed by metro, with the mail host and records: email-security prospects for MSPs, 10 rows free.

By type of business

Share of domains that receive email, by OpenStreetMap business type (types with at least 150 domains).

no DMARC monitor only (p=none) protected

Restaurants, bars, salons and bakeries are least protected; clinics, larger companies and marketing agencies most. The worrying middle is the trades whose customers pay them on an email's say-so: 58.8% of property managers, 57.5% of dentists, 60.7% of vets and 65.6% of auto repair shops publish no DMARC policy at all.

By email host

Email host	Domains	No DMARC	Protected	No valid SPF
Microsoft 365	4,238	47.1%	26.7%	1.9%
Google Workspace	6,570	58.7%	8.1%	36.2%
GoDaddy email	1,017	85.4%	8.6%	83.2%
All other hosts	7,288	57.9%	12.6%	17.3%

Microsoft 365 domains are the best protected: its setup wizard asks for SPF, and an SPF record is nearly universal there. Google Workspace domains are protected least often - only 8.1% - and more than a third have no SPF record at all. On GoDaddy email, 83% have no valid SPF record; in the ones we inspected by hand, a common cause was a record that begins with the hosting server's name instead of v=spf1, which receivers ignore.

The rest of the scan

The same scan loaded the websites of 29,412 small businesses listed on OpenStreetMap:

7.0% of the websites businesses list did not load at all (timed out, refused or failed the secure connection, on two tries).
3.9% of the sites that loaded have no mobile viewport tag, so phones show a shrunken desktop page.
2.2% of the sites that loaded still have no working https.

Method

Sample: businesses with a website listed on OpenStreetMap, pulled by city and state across the US between 6 and 13 October 2026. Some pulls targeted specific business types (property managers, agencies, medical and legal offices), so the national figure over-represents them; the by-type chart is the fairer comparison. It is not a random sample of all US businesses.
Domains: one per website, with www. removed; website-builder subdomains (for example name.wixsite.com) were excluded because they share their builder's records. 25,223 domains were checked; 19,113 have a mail server (MX record) and are the base for every email figure. 11 lookups failed and are excluded.
Records: MX, the TXT record starting v=spf1 at the domain (a record that does not start that way does not count), and the TXT record starting v=DMARC1 at _dmarc. plus the domain, read on 13 October 2026 through public resolvers (1.1.1.1 and 8.8.8.8). "Protected" means p=quarantine or p=reject.
Not measured: DKIM (its key lives under a name only the email host knows), and whether a domain's real mail would pass. Subdomain policies (sp=) were not considered.
Who: the scan and this write-up were made by an AI system that Stephen Psaradellis runs for small-business website and email fixes (who and how). No business is named here and none was contacted for this report. Journalists and researchers can have the aggregate tables on request.