Email security in five Irish sectors: 4,101 domains, read on 29 October 2026

Anyone can send an email that claims to come from your domain. Whether it lands in an inbox depends on records you publish: SPF lists the servers allowed to send for you, DKIM lets your mail carry a signature, and DMARC tells receiving servers what to do with mail that fails both.

Of the 3,555 domains in our study that receive email, 345 (9.7%) publish DMARC at quarantine or reject, which asks receiving servers to junk or refuse mail that fails. 1,057 (29.7%) publish DMARC at p=none, which asks for reports and leaves delivery to each receiving server's own judgement. 2,153 (60.6%) publish no DMARC record at all.

Recruitment agencies and solicitors are furthest ahead, at 23.1% and 20.2%. Dental practices follow at 8.2%, hair and beauty salons at 5.0%, and physiotherapy and allied health practices at 4.3%.

DMARC is now RFC 9989, published in May 2026, which replaces the 2015 RFC 7489. It defines three policies. At p=none, in the RFC's words, the domain owner "offers no expression of preference". At quarantine, the owner considers failing mail suspicious. At reject, the owner considers every failure "a clear indication that the use of the domain name is not valid". A record without a valid policy is treated as p=none.

p=none has a use: it collects reports while a business finds every service that sends as its domain. Google's sender guidelines accept it, too. Since 1 February 2024, anyone sending more than 5,000 messages a day to Gmail accounts must publish DMARC, and Google's page says the policy "can be set to none". That meets Gmail's rule and asks receiving servers for nothing: whether a forged invoice in your name is delivered is left to each one's own judgement.

The provider is read from the domain's MX records, the servers that receive its mail. A filtering service in front of Microsoft 365 or Google is counted under the filter.

456 of the 3,555 domains (12.8%) publish no SPF record, so a receiving server has no list of who may send for them. 30 publish more than one, which receiving servers treat as an error, so none of them counts. 39 publish a single record that needs more than the ten DNS lookups SPF allows, which also ends in an error; our guide to the lookup limit explains the fix. No domain in the study published +all, which would let any server in the world send as it.

546 of the live domains publish no MX record, so they are not set up to receive email. 478 of them (87.5%) publish neither SPF nor DMARC, which leaves a receiving server nothing that says mail from them is fake. 37 publish DMARC at quarantine or reject.

The UK's National Cyber Security Centre calls protecting a domain that sends no email easy, and its guidance on parked domains gives four records, in order: an SPF record that allows no sender (v=spf1 -all), DMARC at p=reject, a null MX record (0 .) where the domain has a website but no mail, and a DKIM record with an empty key. The NCSC says the DKIM record is not strictly required, and that once protected, these domains need no maintenance.

One reading of public DNS, with the code behind our free check, cross-checked through two public resolvers.

Run the free email security check on your domain. It reads the same records as this study and says, for each, what a receiving server does with mail forged in your name. If DMARC is missing or set to p=none, our guide to DMARC for an Irish business sets out the order: SPF and DKIM for every service that sends as you, DMARC at p=none to collect reports, then quarantine and reject once the reports show your own mail passing.