Email security of India's top websites (2026)
We checked the public DNS of India's 3,000 most visited .in websites, 500 government domains and the global top 3,000 for the two records Gmail, Yahoo and Microsoft now require: SPF and DMARC.
Key findings
- 34.6% of top Indian websites that receive email have no working DMARC record (global top sites: 14.6%): 32.8% have none at all, the rest publish duplicate or invalid records.
- Only 31.1% enforce DMARC (quarantine or reject). For the rest, nothing stops email that fakes their domain in the From address.
- 5.2% have an SPF record that is broken outright: two SPF records, more than 10 DNS lookups, or
+all. - Government domains: 70.1% enforce DMARC and 18.5% have none.
- 32.8% of Indian sites stop at
p=none, which only monitors and blocks nothing.
India vs government vs global
| Share of domains that receive email | India top .in | Government | Global top |
|---|---|---|---|
| Have an SPF record | 88.3% | 93.0% | 93.9% |
| SPF valid (one record, ≤10 lookups, no +all) | 83.1% | 90.5% | 90.7% |
| Have a DMARC record | 67.2% | 82.6% | 85.7% |
| DMARC monitoring only (p=none) | 32.8% | 10.9% | 17.9% |
| DMARC enforced (quarantine/reject at 100%) | 31.1% | 70.1% | 66.0% |
| DMARC reports switched on (rua) | 43.0% | 67.7% | 77.5% |
| SPF + DMARC basics in place | 58.5% | 78.6% | 81.8% |
| MTA-STS | 0.8% | 0.0% | 4.1% |
| TLS-RPT | 1.0% | 0.0% | 5.1% |
| Base: domains that receive email | 2,057 | 201 | 2,071 |
Who runs email for top Indian websites
Why it matters
Since 2024 Gmail and Yahoo, and since May 2025 Microsoft Outlook.com, reject or junk bulk mail from domains without SPF, DKIM and DMARC. A domain without an enforced DMARC policy can also be used for phishing: the From address shows the real brand and nothing stops it. Fixing it takes a few DNS records – see the setup guides, the SPF generator and the DMARC generator.
Check your own domain
Get it fixed on Fiverr
Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 19-page guide, checklist, 20+ providers.
Methodology
- Domain lists come from the Tranco top-1M research ranking (October 2026). "India" = the top 3,000 domains ending in .in, excluding .gov.in, .nic.in, .ac.in, .edu.in, .res.in, .mil.in and .ernet.in. "Government" = the top 500 .gov.in / .nic.in domains. "Global" = the overall top 3,000; it includes CDN and infrastructure domains, which is why fewer of them receive email.
- Scanned on 23 October 2026 from public DNS (Cloudflare, Google and Quad9 resolvers) with the same engine as our checker. Percentages are of domains that receive email (they publish MX records). Domains whose DNS did not answer are left out: 23 India, 7 government, 7 global.
- DKIM is not measured: selector names are not public, so a fair bulk check is not possible.
- Only aggregate numbers are published. We do not list individual domains.
Cite as: “Email security of India's top websites (2026)”, mailpassed.com, https://mailpassed.com/research/india-email-security-2026