Outbound
KNK study · October 2026

58% of B2B companies in DACH don't block spoofed senders

We analyzed the public DNS records of 23,488 company domains in Germany, Austria and Switzerland. SPF is standard. DMARC mostly stays in monitoring mode.

23,488 domains · data as of October 19, 2026 · methodology below

Check your domainDownload CSV

41.7%

enforce DMARC

p=quarantine or p=reject

33.1%

sit on p=none

DMARC in monitoring mode

25.1%

have no DMARC at all

no valid _dmarc record

58.3%

have SPF, DKIM and DMARC

lower bound, see methodology

DMARC policy

How DMARC policies are distributed

Only quarantine and reject tell receivers what to do with spoofed mail. p=none at best collects reports.

  • 25.1%no DMARC
  • 33.1%p=none
  • 22.9%p=quarantine
  • 18.8%p=reject

Invalid or duplicate DMARC records (0.3%) count as "no DMARC".

Findings

Eight findings from 23,000+ domains

  1. 1

    Only 41.7% enforce DMARC

    25.1% have no DMARC record at all and another 33.1% sit on p=none. For 58.3% of domains, no DMARC record tells receivers to reject or quarantine mail with a spoofed sender.

  2. 2

    A third never leave monitoring mode

    p=none is meant as a starting point: collect reports, then tighten. Many never do. 15.5% of all domains run p=none without even a report address (rua), so they protect nothing and see nothing.

  3. 3

    SPF is standard, but often soft

    97.5% publish SPF. 62.2% end with -all, 31.3% with the softer ~all. 1.5% allow practically any sender with +all or ?all.

  4. 4

    Four in ten miss a piece Gmail and Outlook require

    Google and Yahoo have required SPF, DKIM and DMARC from bulk senders since 2024, Microsoft for Outlook.com since May 2025. We found all three on 58.3% of domains. DKIM can only be found with a known selector, so this is a lower bound.

  5. 5

    Microsoft 365 dominates with 63.2%

    63.2% of domains receive mail through Microsoft 365, 9.5% through Google Workspace. 15.0% put a security gateway such as Hornetsecurity, Sophos or Proofpoint in front.

  6. 6

    The hosting provider often decides

    On Strato, 80.2% enforce DMARC. On IONOS only 12.6% do, although 89.8% have a record. The records are mostly identical and carry no report address, which points to provider defaults rather than a deliberate choice.

  7. 7

    Switzerland leads, legal and tax trail

    47.1% of Swiss domains enforce DMARC, versus 41.6% in Germany and 39.1% in Austria. By industry, legal and tax firms have the lowest DMARC rate (64.9%), logistics and trade the highest (82.1%).

  8. 8

    Newer standards are rare

    MTA-STS, which enforces encryption for inbound mail, is used by 3.0%. TLS reporting by 3.2%, BIMI for a brand logo in the inbox by 2.3%.

Comparison

DMARC by country, platform and industry

Light bar: DMARC published. Dark bar: DMARC enforced. Segments under 150 domains are not shown.

DMARC enforcedDMARC published

By country

  • Germany41.6% / 74.6%
  • Austria39.1% / 75.2%
  • Switzerland47.1% / 77.7%

By mail platform

  • Microsoft 36542.7% / 74.3%
  • Own or other server39.7% / 71.3%
  • Google Workspace40.7% / 81.7%
  • Gateway, platform unknown56.4% / 79.9%
  • IONOS12.6% / 89.8%
  • Strato80.2% / 95.0%
  • All-Inkl13.2% / 60.5%
  • domainfactory13.0% / 38.5%

By industry

  • IT & software47.0% / 80.5%
  • Machinery & plant engineering41.8% / 69.4%
  • Industry & manufacturing45.0% / 75.3%
  • Marketing & media34.9% / 72.3%
  • Consulting & services36.8% / 71.5%
  • Finance & insurance40.8% / 77.3%
  • Legal & tax34.2% / 64.9%
  • Construction & real estate39.2% / 67.6%
  • Logistics & trade50.5% / 82.1%
  • Healthcare & medtech33.8% / 72.2%

Which platform companies receive mail on

Derived from MX records. Where a security gateway sits in front, we inferred the platform from the SPF record.

  • Microsoft 36563.2%
  • Own or other server14.9%
  • Google Workspace9.5%
  • Gateway, platform unknown4.9%
  • IONOS2.7%
  • Strato1.5%
  • All-Inkl1.0%
  • domainfactory0.7%

Platforms under 150 domains are not listed individually.

What it means

What to do with these numbers

p=none is a starting point, not a goal

Start with a report address (rua), review two to four weeks of reports, then move to quarantine and later reject. If you never tighten, DMARC only exists on paper.

Volume senders need all three

Newsletters, invoices, sales email: above 5,000 messages a day to Gmail or Outlook.com, SPF, DKIM and DMARC are required. Miss one and mail goes to spam or gets rejected.

Spoofing protection is brand protection

Without enforced DMARC, anyone can send email in your domain's name. Your customers get hit first, your reputation next.

Never cold email from your main domain

For outbound we set up dedicated sending domains with SPF, DKIM and DMARC before a single email goes out. Your main domain stays clean even if a campaign underperforms.

Done-for-you outbound

Clean deliverability is our baseline, not an add-on

KNK builds the sending infrastructure, writes and sends the campaigns, handles every reply and calls interested prospects. You get meetings on your calendar.

Book a callCheck your domain

Methodology and limitations

  • Sample: 23,831 company domains in the DACH region that we researched for B2B campaigns (headquarters in DE, AT or CH according to the company profile, otherwise a .de, .at or .ch domain). The analysis covers the 23,488 domains with an MX record.
  • The sample is not representative of all businesses. It consists mostly of B2B companies, with a focus on IT, software, industry and services.
  • We queried public DNS records (MX, SPF, _dmarc, _mta-sts, _smtp._tls, default._bimi and DKIM selectors) via DNS over HTTPS through Cloudflare and Google, as of October 19, 2026.
  • DKIM can only be found when the selector is known. We checked 28 common selectors, including those used by Microsoft 365, Google, IONOS and Strato. DKIM figures are therefore lower bounds.
  • "DMARC enforced" means p=quarantine or p=reject. Invalid or duplicate records count as "no DMARC", multiple SPF records as "no SPF".
  • We do not publish individual domains, only totals. Segments with fewer than 150 domains are not shown.

Cite this study

KNK Outbound (2026): DMARC Adoption Statistics 2026. Analysis of 23,488 company domains in Germany, Austria and Switzerland. https://knkoutbound.com/dmarc-adoption-statistics/

Download CSV

Figures and charts are licensed CC BY 4.0. Use them in articles, decks and reports, with attribution and a link to this page.

Frequently asked questions

What percentage of companies use DMARC?

In our sample of 23,488 B2B company domains in Germany, Austria and Switzerland, 74.9% publish a DMARC record, but only 41.7% enforce it with p=quarantine or p=reject.

How many German companies use DMARC?

Of 20,333 German company domains in our sample, 74.6% have a DMARC record and 41.6% enforce it.

What does p=none mean in DMARC?

p=none is monitoring mode. Receivers treat mail that fails SPF and DKIM as normal and only send reports to the rua address. Protection against spoofing starts with p=quarantine (spam folder) and p=reject (rejection).

Is DMARC mandatory?

Not by law. Google and Yahoo have required it since February 2024 for anyone sending more than 5,000 messages a day to their mailboxes, Microsoft for Outlook.com since May 2025. p=none is enough for that. Security agencies recommend SPF, DKIM and DMARC for every business.

Can I use these numbers?

Yes. Figures and charts are licensed CC BY 4.0. Please credit KNK Outbound and link to this page. The aggregated data is available as a CSV.

Will the study be updated?

Yes. We repeat the analysis with the same method so changes over time stay comparable. The URL stays the same.