8 in 10 businesses on Google or Microsoft email have no protection against fake emails in their name
We checked the public email settings of 10,000 randomly chosen .com domains that receive email. Most have nothing stopping a scammer from sending invoices, payment requests or password resets that look like they came from them. That includes most businesses paying for Google or Microsoft email.
Published October 22, 2026 · By SenderFix · How we did it
Key findings
- 82% of domains on Google Workspace or Microsoft 365 have no protection against fake emails sent in their name (no DMARC record, or p=none).
- 87% of all email-receiving .com domains we checked have no such protection (no DMARC record, or p=none).
- Only 13% tell Gmail, Outlook and other providers to junk or block fake emails sent in their name (DMARC p=quarantine or p=reject).
- 62% have no protection setting at all (no DMARC record); another 25% have one set to watch only (p=none).
- 21% don't list which services are allowed to send email for them (no SPF record), including 18% of those paying for Google or Microsoft email.
- 19% have neither setting: no sender list (SPF) and no protection (DMARC).
You're welcome to quote these figures. Please credit “SenderFix Small Business Email Report, October 2026” and link to this page.
Most domains can't stop fake emails in their name
A domain can publish a setting (called DMARC) that tells Gmail, Outlook and other providers what to do with email that claims to come from it but doesn't: deliver it anyway, send it to junk, or block it. Without that setting, or with it set to “watch only”, fakes get delivered like any other email.
Paying for business email is a good sign a domain belongs to a working business, so we report this group on its own.
1 in 5 don't say who's allowed to send their email
The second setting is a list of the services allowed to send email for a domain (called SPF): the email provider, the invoicing app, the website's contact form. Gmail and Outlook use it to tell real email from fakes. Without it, a business's own invoices are more likely to land in junk.
A third setting, email signing (DKIM), isn't in these numbers. It can't be confirmed from public settings alone; see How we did it.
By email provider
In every provider group, at least three in four domains had no protection. Microsoft 365 customers were the most likely to be protected, and even there 77% weren't.
| Email provider | Domains checked | No protection (no DMARC or p=none) |
|---|---|---|
| IONOS | 152 | 99.3% |
| Hostinger | 352 | 98.9% |
| Cloudflare Email Routing | 176 | 91.5% |
| Zoho Mail | 150 | 90.0% |
| Google Workspace | 1,865 | 84.8% |
| GoDaddy | 824 | 84.5% |
| Microsoft 365 | 1,087 | 76.6% |
“No protection” means no protection setting, a broken one, or one set to watch only. Providers with fewer than 150 domains in the sample aren't shown. Some domains on GoDaddy, Hostinger and IONOS may still have the host's default settings and send little email.
Why it matters for a small business
Fake invoices work because they look like they came from someone the customer already pays. When a business's domain has no protection setting, a scammer can put that business's address on the “from” line and the email arrives looking normal. The business often doesn't find out until a customer asks why the bank details changed.
The same two settings (SPF and DMARC) decide whether a business's real email is trusted. Google, Yahoo and Microsoft now require large senders to have them, and email from domains without them is more likely to be filtered.
Neither setting costs anything. Neither changes how a business sends or receives email day to day. Both are a few lines added where the domain is managed, usually the same place the website address was bought.
What to do about it
- Check your own domain (the part after the @ in your email). It takes about 90 seconds and you don't need to sign up.
- Make a list of every tool that sends email for you: your email account, invoicing app, website forms, newsletter tool.
- Add the sender list and the protection setting where your domain is managed, starting with “watch only” so nothing breaks, then move to junk or block once every tool passes.
Steps 2 and 3 are where most businesses get stuck: finding every tool that sends email for you, and getting the settings exactly right for each one. That's the part SenderFix does for you.
How SenderFix fixes this
SenderFix is built for small businesses with no IT department. You don't need to know what any of the settings above are called.
- We check every tool that sends your email: Outlook or Gmail, QuickBooks, Mailchimp, your website and the rest
- A plain-English answer for each one: working, or exactly what's wrong
- Simple numbered steps to fix it, written for the sites you actually use (GoDaddy, Mailchimp, and so on)
- A ready-to-forward version for whoever looks after your website, with click-by-click instructions
- A check of whether your business is on any spam blocklists
If we can't find what's wrong with your email settings, you get your $299 back.
Fix my email- A short weekly email: is everything still working?
- An alert if one of your tools stops working
- An alert if someone starts sending email pretending to be you
- An alert if your business lands on a spam blocklist or a setting gets changed
First month included with the Email Fix. On its own, $29 a month. Cancel any time.
See how monitoring worksSee in about 90 seconds whether your email settings look healthy. No signup needed.
Or have SenderFix watch it for you every day →How we did it
- We started from the full list of registered .com domains (the October 2026 .com zone file from ICANN's Centralized Zone Data Service): 167,982,917 domains.
- We drew a random sample of 100,000 of them.
- We kept the 45,905 that are set up to receive email, then removed 752 that only point to parking or “for sale” services, leaving 45,153.
- We picked 10,000 of those at random and checked each one's public email settings on October 22, 2026.
- We used the same checks as the SenderFix free check, reading only public settings. No email was sent to any domain and nobody was contacted.
- Email provider is worked out from where each domain's email is delivered.
- We don't publish or share the domains we checked, only the totals.
- “Protection setting” is a DMARC record. “Watch only” is p=none; “junk” is p=quarantine; “block” is p=reject.
- “No protection” counts a missing DMARC record, an unreadable one, or p=none.
- “Sender list” is an SPF record.
- We left email signing (DKIM) out of the findings because it can't be confirmed from public settings without knowing each sender's selector.
Limits: .com is used worldwide, so the sample isn't limited to US businesses or to businesses at all. That's why we report domains on Google Workspace and Microsoft 365 separately. Percentages are of the 10,000 domains checked (or of the provider group shown).
SenderFix. “Small Business Email Report, October 2026.” https://www.senderfix.com/research/email-protection-2026
Writing about this? Get in touch for more detail on the method.
Find out where your business stands in about 90 seconds, then fix it with plain-English steps for the tools you actually use.