We scanned all 4.7 million .fr domains: DMARC has nearly doubled, real protection has not

Every year, Afnic, the .fr registry, publishes the state of email authentication across French domains. In 2025, one domain in five had a DMARC record. We wanted to know where things stand today, and above all to look behind the headline number: does having a DMARC record mean being protected?

In October 2026 we queried the DNS of every one of the 4,675,747 active .fr domains: MX, SPF, DMARC and name server records, then a full resolution of every SPF record. More than 18 million DNS queries, public data only.

The result fits in one sentence: DMARC has nearly doubled in a year, but more than half of those DMARC records protect nothing.

Key figures

DMARC goes from one domain in five to one in three. That is real progress. But only 6.5% of .fr domains ask receiving mail systems to reject messages that spoof their name.

Half of all DMARC records are a thermometer nobody reads

DMARC has three policy levels:

• p=none: monitor only, block nothing;
• p=quarantine: fraudulent messages go to the junk folder;
• p=reject: they are refused.

p=none only makes sense if someone reads the reports that mail providers send (the rua tag). It is the diagnostic step before tightening the policy.

Among .fr domains that publish DMARC:

More than half of .fr DMARC records are p=none with no reporting at all: no protection and no visibility. A thermometer on the wall that nobody looks at.

Where does the growth come from? Largely from some consumer web hosts that publish v=DMARC1; p=none; by default on their customers' domains. Two hosts alone account for roughly 500,000 domains. That is good news for overall DNS hygiene. But the customer is often unaware they even have DMARC, and nobody drives the next steps.

DMARC takes five minutes to publish. What protects you is driving it all the way to p=reject.

Domains that actually send email

Keeping only the 3.7 million domains with a mail service (a real MX record or an SPF record that declares senders):

• 85.7% have SPF;
• 41.4% have DMARC, but only 16.9% have a "useful" DMARC, meaning blocking or with reports being collected;
• 11.6% have a blocking policy (quarantine or reject), 6.0% are at reject.

The mail provider makes a big difference. Among domains hosted on Microsoft 365, 18.4% have a blocking DMARC policy. Among those whose mail sits with a consumer web host, the figure often falls below 2%. This is not about technology: Microsoft 365 does not turn DMARC on for you. It is about who owns the topic. A company with an IT team or a provider looking after its email is more likely to have dealt with it.

98,000 broken SPF records, and nobody knows

A badly written SPF record raises no alarm: the domain "has SPF" and everything looks fine. Yet when we resolved every SPF record all the way down, include by include, nearly 98,000 .fr domains turned out to have an invalid SPF record (permerror). For receivers that evaluate it, it is as if there were no SPF at all.

On top of that, 18,593 domains publish two SPF records, which makes both invalid. Two SPF records do not mean twice the protection: they mean zero SPF.

You can check yours, including an SPF record you have not published yet, with our SPF checker: the 10-lookup ceiling, syntax and the classic traps. And to understand why that ceiling breaks a domain without warning: the SPF ten-lookup limit.

562,853 .fr domains anyone can impersonate

Finally, there are domains that send no email at all: a name reserved to protect a brand, an old website, a domain bought "just in case". They get forgotten, which is exactly what makes them attractive to fraudsters.

Of the 734,185 active .fr domains without a mail service, 562,853 have neither SPF nor DMARC. Anyone can send email "from" them, and no receiving system has a reason to refuse it. Only 10% are properly locked down.

Locking them takes two minutes and breaks nothing, since these domains send nothing:

domain-name.fr.          TXT  "v=spf1 -all"
_dmarc.domain-name.fr.   TXT  "v=DMARC1; p=reject;"

.fr versus the world's top sites

Is .fr lagging behind? To find out, we ran exactly the same analysis on the top 1 million most visited websites in the world, according to the Tranco list. This academic ranking, designed by researchers at KU Leuven, TU Delft and Université Grenoble Alpes, combines several sources over 30 days to resist manipulation. It is the reference list for web security research.

Same method, same indicators, mail-sending domains only:

The verdict is clear: .fr sites in the top 1M do at least as well as the global top 1M, and better on useful DMARC. They are 2.7 times more likely to be at p=reject than .fr domains overall, and 3.4 times more likely to have a useful DMARC.

So the problem is not .fr. It is size. Same extension, same DNS, same tools: what changes is that an organization ranking among the world's top sites has someone whose job is to run its email. In a small or mid-sized company, that topic is often in nobody's job description.

And the higher you go, the wider the gap: in the global top 10,000, more than one domain in three is at p=reject, nearly six times the rate for .fr as a whole.

Our takeaways

1. Having DMARC is not enough. The question to ask your team or provider is not "do we have DMARC?" but "are we at p=reject, and who reads the reports?"
2. SPF must be verified, not assumed. A typo or a cancelled tool is enough to break it, with no visible symptom.
3. Dormant domains are the easiest door to close. It is the best return on effort on this list: two DNS records, zero risk.
4. The DNS change takes five minutes; the inventory takes six weeks. Moving from p=none to p=reject means identifying everything that sends email on your behalf (CRM, invoicing, marketing email, business tools) and authenticating each one. That work is what makes the difference, not the record itself. We walk through the method in reaching p=reject safely.

Methodology

• .fr scope: 4,675,747 active .fr domains (retired domains excluded). 4,419,997 respond in DNS; 3,685,812 have a mail service (real MX or an SPF record declaring senders).
• Global scope: the Tranco top 1 million list (downloaded on October 17, 2026), scanned with the same method on October 18, 2026. 973,671 domains respond in DNS, 682,339 have a mail service. Oversized SPF responses were re-queried over TCP, leaving 0.1% undetermined. For the comparison, domains whose SPF or DMARC response remained undetermined are excluded on both sides.
• Collection: passive DNS queries on October 18, 2026, from our own resolver, at a deliberately limited rate. MX, TXT (SPF), _dmarc TXT and NS records; recursive resolution of every SPF include and redirect to count lookups and detect errors.
• Failures: every query that failed temporarily was retried. Domains with no definitive answer (2.3%) are classed as "undetermined" and never counted as "unprotected".
• Not measured: DKIM. The DKIM selector cannot be discovered through DNS, so any measurement would have been a low estimate.
• Public data only; no domain is named individually.

What about your domain?

In one minute, our domain reconnaissance tool tells you which group yours falls into: DMARC actively managed or published by default, SPF valid or broken, subdomains and MTA-STS, with a score out of 100. To build a clean record that complies with the new standard, use the DMARC generator.

These figures were presented during the webinar "Email security 2026: state of play, blind spots and best practices", hosted by Hexadream with Hamza Kondah, on October 22, 2026.