DMARC Barometer 2026: Half of French SMEs Have No DMARC

Anyone can send an email that claims to come from your company. What stops them is three free DNS settings called SPF, DKIM and DMARC. We wanted to know where French small and medium-sized businesses (SMEs) really stand. Measured on 21 October 2026 across 5,636 domains: more than one SME in two (52%) has no DMARC record at all, and only 11% have a setting that actually blocks fake emails sent in their name.

The picture matters beyond France: since February 2024, Gmail and Yahoo apply the same sender rules to every company, whatever its country.

How we measured

We did not start from a prospect list, which would have given a flattering picture (more on that below). We drew 56,872 companies at random from SIRENE, the French national business register kept by INSEE, the national statistics office: active companies with 1 to 249 employees, excluding subsidiaries of large groups, across all sectors.

SIRENE does not list a company's website. For each company we tested the most likely web addresses (built from its registered name) and kept a site only if it displays the company's SIREN number, the nine-digit registration number French companies must show in their legal notice. That is strong evidence: a company with a similar name does not display that number. This gave us 5,812 domains, 5,636 of which receive email.

For each domain, we read the public email settings, the ones any mail server checks before accepting a message. Results are reweighted to match the real share of micro, small and medium companies and of each sector in the French economy. The full method and its limits are set out at the bottom of this article.

The three settings in two sentences

• SPF says which servers are allowed to send email on behalf of your domain.
• DKIM adds a signature to every email that proves it was not altered and really comes from you.
• DMARC tells mailbox providers what to do with an email that fails those checks: let it through (p=none), send it to spam (p=quarantine) or reject it (p=reject). It also lets you receive reports about who is sending in your name.

The results

SPF is nearly everywhere. 94% of SMEs have it, and 83% have a correct SPF (a single record that ends with a clear instruction). It is the oldest of the three, and most hosts set it up by default.

DKIM is half installed. We found a DKIM signature on 49% of domains. That is a floor: we tested the most common names, and a company may use a different one.

DMARC is the big gap. 52% of SMEs have none at all. And when it exists, it does not protect: in 78% of cases it is set to p=none, meaning "watch only, block nothing". Overall, only 11% of SMEs have a DMARC that sends fake emails to spam or rejects them, and 4% reject them outright.

DMARC reports, which show who is sending in your name, are requested by only 19% of SMEs. Nearly one DMARC record in two (49%) is a p=none with no address for reports: it is there, but it does nothing.

The smaller the company, the less protected it is

Even among companies with 50 to 249 employees, more than a third (36%) have no DMARC.

Your email provider changes everything

OVHcloud (a French hosting company, with a setup page that is in French only) is the leading email provider for the SMEs in our sample: nearly a third of them, ahead of Microsoft at 17% and Google at 7%. Along with Gandi (18%), it is also where DMARC is rarest: 21% of OVHcloud domains have one, against 51% at Microsoft and 63% at Google.

At the other end, 95% of domains whose email is hosted at IONOS have a DMARC record. That does not mean their customers are more careful: in 86% of cases the record points to IONOS, and it is almost always a p=none with no reporting address. Whether a company has DMARC therefore depends mostly on what the host does by default, not on a decision the company made.

Another example: at Gandi, only 25% of domains have a correct SPF. By far the most common setting there ends in ?all, which means "I take no position": mailbox providers do not know what to do with a suspicious email.

One last sign that DMARC is rarely a deliberate choice: 15% of the DMARC records we found send their reports to Brevo, an emailing tool. The record was clearly added by following the tool's setup steps, not by decision.

By sector

Construction (35%) and health, education and social work (35%) are the least equipped. Business services (56%) and information, finance and real estate (56%) do better, but still only just over one company in two.

What it means for a small business

Since February 2024, Gmail and Yahoo have applied clear rules for senders (Google, Yahoo):

• every sender must authenticate email with SPF or DKIM;
• above roughly 5,000 emails a day to Gmail, you need SPF and DKIM and a published DMARC, plus one-click unsubscribe and a low spam complaint rate.

Our measurement shows that about 89% of SMEs have a correct SPF or a DKIM signature, and that only 33% have a correct SPF, DKIM and DMARC all together, the technical base of the second rule (floors, since we may have missed some DKIM signatures). You probably do not send 5,000 emails a day. But Gmail, Yahoo and Outlook look at these settings for every sender: a domain with no DMARC starts with a handicap, especially for prospecting emails and sales follow-ups, which land with people who do not know you.

And there is the other side of the problem, often forgotten. Without a DMARC that blocks, nothing stops a fraudster from sending your customers a fake invoice "from you", with your address as the sender. That is the situation for 89% of the French SMEs in our sample.

How to get in order, in four steps

1. Take stock. Our free diagnostic reads your settings in a few seconds and tells you exactly what is missing. Nothing to install.
2. One SPF record, ending in ~all or -all. It must list every service that sends in your name (your mailbox, your emailing tool, your invoicing software). Two SPF records is an error: they must be merged.
3. Turn on DKIM at your provider. With Google Workspace, Microsoft 365, OVHcloud or IONOS it is an option in the admin console, which gives you one or two records to copy into your DNS zone.
4. Publish a DMARC, then tighten it. Start with v=DMARC1; p=none; rua=mailto:[email protected] to collect reports for two to four weeks. When they show that all your legitimate email passes, move to p=quarantine, then to p=reject.

It is an hour of work for an IT provider, often less. Our SPF, DKIM and DMARC guide covers each step, our article on Google and Yahoo sender requirements explains the rest of the obligations, and our email deliverability guide (in French) puts it all in perspective.

Why we did not use our own files

We ran the same measurement, on the same day, on 869 company-owner domains from a prospecting file. Result: 67% have a DMARC, against 48% in the randomly drawn sample. A prospect list selects companies that are more active online, and so better equipped. That is why a barometer must start from a random draw, and it is also why our figures lean optimistic: the companies with no website, which we could not measure, are probably even less protected.

Methodology in brief

Random draw of 56,872 active companies with 1 to 249 employees from the SIRENE register as of 1 October 2026. A domain is kept only if the company's SIREN number is displayed on it. DNS read on 21 October 2026 through public resolvers (Cloudflare, Google, Quad9), with retries on failure. Results weighted by size and sector, across the 5,636 domains that receive email. Margin of error on the overall figures: about 2 to 3 points. No personal data collected: only domain names and public settings.

Main limits: only companies with a website in their own name showing their SIREN are measured; the website's domain is not always the one that sends email; DKIM is detected on only 24 common names. Full methodology below.

Methodology

A complete box, for anyone who wants to check or reproduce the measurement.

Population. Active, publicly listed legal units from the SIRENE register as of 1 October 2026 (INSEE, data.gouv.fr), private-law legal entities with 1 to 249 employees, excluding subsidiaries of mid-sized and large groups and excluding public administration. Population: 1,226,294 companies (1,035,924 micro, 173,498 small, 16,872 medium), grouped into eight broad sectors.

Sampling. Random, stratified by size: 20,000 micro companies, 20,000 small companies and all the medium ones, 56,872 companies in total. The larger ones are deliberately over-represented so that each size has enough domains; weighting corrects for this.

Finding the website. SIRENE does not contain the website address. For each company we built up to 10 candidate addresses from its registered name and acronym (in .fr and .com), then loaded the home page and the legal notice, terms of sale or contact pages. A domain is kept only if the company's SIREN is displayed on it. Result: 5,812 distinct domains, 5,636 of them with at least one mail server record (MX). A visual check of 25 randomly chosen domains found 25 matches consistent with the company's registered or trading name.

DNS measurement. On 21 October 2026, through Cloudflare, Google and Quad9, with up to 6 attempts after a failed answer (no domain remained in failure). We recorded SPF, DMARC (policy, reports), mail servers (MX) and 24 common DKIM signature names.

Definitions.

Weighting. Each domain carries the weight of its stratum (size crossed with sector, 24 strata) in the SIRENE population. 95% confidence intervals are computed with the Wilson method on Kish's effective sample size.

Limits.

• Only companies that have a website in their own name, with their SIREN displayed, are measured. The others are probably less well equipped: our rates lean optimistic.
• We measure the website's domain, which is not always the one that sends email.
• The email provider is inferred from the receiving server; an anti-spam gateway can hide the real provider.
• A snapshot of 21 October 2026: a domain may have changed since.
• For 7,217 companies, at least one candidate address never responded. Domains found on the second pass, slower or better protected, have DMARC slightly less often: one more bias that makes our figures optimistic.
• The Gmail and Yahoo rules also cover domain alignment, one-click unsubscribe and a low complaint rate, which cannot be read from DNS.

Data. Only domain names and public DNS records were kept, no personal data. Aggregated data, with no domain names (file contents are in French): results by indicator (CSV), detailed results (JSON) and population counts by size and sector (CSV). Text version of this methodology (in French): methode.md.