DMARC World Map

Latest snapshot of SPF/DMARC coverage by hosting country.

What is this map?

Think of DMARC as a “bouncer” for your inbox: it validates the legitimacy of the “From” address to ensure the email is genuinely from who it claims to be. Every time you receive an email, your mail server has to decide whether it is really from who it says. SPF and DMARC are two small settings that a domain owner (like yourbank.com) adds to their domain so mail servers around the world can verify that messages are genuine and reject impersonators. Without them, scammers can more easily forge the “From” address in phishing emails.

This map shows, for each country, how many websites hosted there actually use these protections, giving you a snapshot of the global state of email security. Greener countries are better protected; while orange and red ones are more exposed.

-
-
-
-
-
-

Map view

How we measure this

SPF coverage (metric)

The percentage of scanned domains that publish an SPF record. SPF helps mail servers confirm which systems are allowed to send email for a domain, reducing spoofing.

DMARC coverage (metric)

The percentage of scanned domains that publish a DMARC policy. DMARC tells receiving mail servers how to handle suspicious mail and provides reporting for domain owners.

Methodology & limitations

  • Domain list source: Tranco (top … domains in this snapshot).
  • SPF/DMARC data gathered via DNS lookups.
  • Registrant country (RDAP) is a best-effort field and not always available.
  • Hosting country derived from IPinfo geolocation (best-effort).
  • Rate limits and network timeouts can reduce coverage in some regions.
  • About ~14% of scanned domains are not placed on the map because their hosting IP is unrouted, returned a 403 from IPinfo (typically Cloudflare or CloudFront anycast edge IPs), or had no A/AAAA record. Those domains still contribute to the global KPIs but not to per-country shading.

Hosting provider data

Each domain's hosting provider is derived from the ASN (Autonomous System Number) stored in the IPinfo Lite response. Domains are grouped into one of these buckets: Cloudflare, Amazon, Google, Microsoft, Akamai, Fastly, OVH, Hetzner, DigitalOcean, Alibaba, Other, Unknown. "Other" covers all providers not in the top-10 list. "Unknown" means no hosting data was available for that domain.