Most phishing mail does not need a hacked server. It only needs a sender address that looks right. Whether a forged mail with @yourbank.com in the From line gets delivered depends largely on one DNS record: the domain's DMARC policy. I read SPF, DMARC and MTA-STS for 102 well-known domains from public DNS. The full result is a sortable heatmap in the e-mail ranking.

The numbers

  • SPF: 100 of 102 domains publish one. 62 end it with -all, which tells receivers to refuse other servers.
  • DMARC with p=reject: 59 of 102. Forged mail in their name gets refused.
  • p=quarantine: 16. Forged mail goes to spam, which is better than nothing.
  • p=none: 21. DMARC only collects reports; forged mail is not blocked by the policy.
  • No DMARC at all: 6, including tim.it, europa.eu, gov.it and faz.net.
  • MTA-STS (TLS enforced for incoming mail): only 10.

Banks: only half reject

Banks are the most imitated senders in phishing, so I expected them on top. Of 22 banks and payment providers, 11 use p=reject. Several large ones in Germany and Italy only monitor with p=none, for example sparkasse.de, dkb.de, postbank.de and poste.it, and two have no DMARC record on their main domain.

In fairness: banks often send customer mail from separate domains, and big mailbox providers filter forgeries with other signals too. A missing reject policy does not mean customers are unprotected, only that the domain itself does not tell receivers to refuse fakes.

Germany and Italy

In Germany, 20 of 40 domains reject forged mail. In Italy, 13 of 30 do; many major Italian news sites and agid.gov.it are still at p=none.

Why p=none is so common

p=none is meant as the first step: collect reports, find every legitimate sender (newsletter tool, CRM, ticket system), fix SPF and DKIM for them, then move to quarantine and reject. Many organisations stop after step one, because moving to reject feels risky. The reports (rua) are already there: 92 of 102 domains collect them.

How to get to reject

  1. Publish DMARC with p=none and a rua address, and read the reports for two to four weeks.
  2. Make every legitimate sender pass SPF or DKIM with your domain aligned.
  3. Switch to p=quarantine, optionally with pct= to start with a share of mail.
  4. When the reports are clean, set p=reject.

The DMARC generator writes the record, and the mail DNS checker shows what your domain publishes today. If SPF breaks on the 10-lookup limit, the SPF checker shows where.

Method

Only public DNS TXT lookups; nothing was sent to the domains. For subdomains the organisational domain was measured. DKIM is not included, because it cannot be checked from outside without knowing the selector. Points: SPF 20, SPF with -all 15 (~all 8), DMARC 20, p=reject 30 (quarantine 20), reports 5, MTA-STS 10. The ranking is rescanned every week, so numbers can change. As of 6 November 2026.

Originally published at daniele-michelin.com. More guides, free checks (SPF, TLS, headers) and an error-message lexicon: daniele-michelin.com/en/.