The main findings
- 86% enforce DMARC (28 refuse failing mail, 10 send it to spam). 5 have no DMARC record at all, and 1 only watches.
- Nearly 1 in 5 has an SPF problem: 4 have no SPF record, 3 need more than the 10 DNS lookups SPF allows (receivers may then fail their genuine mail), and 1 has an SPF record that refuses nobody.
- 61% receive mail on Microsoft 365, 2 on Google Workspace, and 15 through their own servers or a security gateway.
- Encryption rules are rare: only 2 publish MTA-STS and 2 TLS reporting. 36% publish BIMI, the record that shows a logo beside their mail.
The numbers
| Check | Companies | Share |
|---|---|---|
| DMARC set to reject | 28 | 64% |
| DMARC set to quarantine | 10 | 23% |
| DMARC only watching (p=none) | 1 | 2% |
| No DMARC record | 5 | 11% |
| SPF correct | 36 | 82% |
| SPF over the 10-lookup limit | 3 | 7% |
| No SPF record | 4 | 9% |
| DKIM found (at least) | 35 | 80% |
| MTA-STS published | 2 | 5% |
| BIMI published | 16 | 36% |
What it means for a smaller business
Fake invoices and “please pay to this new account” emails work best when the sender looks exactly like a real supplier. DMARC at quarantine or reject is what stops a stranger sending mail that looks like it is from your domain. Most of India’s largest companies have it. Many smaller businesses do not — and they are the ones whose customers are easiest to fool.
The good news: the same three records cost nothing and take minutes.
- One SPF record listing your email provider, ending in ~all or -all, under 10 lookups.
- DKIM signing turned on at your provider, with its record published.
- DMARC, starting at p=none with reports, then moving to quarantine.
Method and questions
Which companies were checked?
The main web domains of 50 large Indian listed companies across banking and finance, IT services, energy, manufacturing, pharmaceuticals and consumer goods. Six were left out because those domains do not receive email, which leaves 44. We do not name companies: the point is the overall picture, and every company can check itself in seconds.
How was it measured?
On 30 October 2026 we read each domain’s public DNS records (MX, SPF, DKIM at common names, DMARC, MTA-STS, TLS reporting and BIMI) with the same code as our free email domain checker. The unusual results were confirmed with a second, independent lookup.
Why might DKIM be under-counted?
A DKIM key is published under a name the company or its provider chooses. We tried the names common providers use; a key under a custom name cannot be seen from outside. So “at least 80%” is a floor, not an exact figure.
Does a missing record mean a company was hacked?
No. It means mail pretending to come from that domain is easier to deliver, so customers and suppliers are more exposed to fake invoices and payment requests. It says nothing about the company’s own systems.
You may quote these figures with a link to this page.