Home / Cybersecurity / Email security barometer 2026 — France and Germany
More than half of organisations in Germany can still be impersonated by email — more than 4 in 10 in France.
We checked the public email protection of 3346 organisations headquartered in France or Germany. 44.1% of those that receive email in France and 60.6% in Germany enforce no DMARC policy (missing or p=none): anyone can send email in their name; whether it reaches the inbox then depends on the receiving server's filters. For comparison, the Netherlands, Belgium and Luxembourg edition measured 26.9%.
→ Check your own domain (free)
By country
| Country | Organisations | Spoofable | DMARC reject | DKIM found | MTA-STS | DNSSEC | Median score |
|---|---|---|---|---|---|---|---|
| France | 535 | 44.1% | 29.0% | 77.8% | 1.1% | 17.8% | 64 |
| Germany | 2601 | 60.6% | 20.4% | 44.7% | 2.6% | 7.8% | 57 |
By size
In this sample, the smaller the organisation, the more exposed it is. Whether NIS2 applies also depends on sector and activity; we did not assess it organisation by organisation.
| Size | Organisations | Spoofable | DMARC enforced | MTA-STS | Median score |
|---|---|---|---|---|---|
| 50-999 staff | 1944 | 65.6% | 34.4% | 1.5% | 57 |
| 1,000-9,999 staff | 868 | 49.8% | 50.2% | 2.5% | 60 |
| 10,000+ staff | 324 | 32.7% | 67.3% | 6.8% | 69 |
A blind spot: German financial institutions
Of the 615 German financial and insurance institutions checked — largely cooperative and regional banks — 84.4% enforce no DMARC policy. Yet a bank's domain is the first target of phishing.
What this means
- Impersonation is the first step of invoice fraud and phishing. Without an enforced DMARC policy, a fraudster can send an email from finance@yourcompany that lands in your customers' inbox.
- NIS2 asks for it. Secured communications and basic cyber hygiene are among the ten minimum measures; email protection is one of the first things auditors and customers check.
- It is cheap to fix. SPF, DKIM and DMARC are DNS changes: a few hours of work, done in steps so that no legitimate email is blocked.
Method
- Population: 3346 organisations headquartered in France or Germany, with 50+ staff and an official website in Wikidata (open data, retrieved October 17, 2026); 3136 receive email and are counted. The sample is not representative of all companies (mostly well-known organisations): the figures describe this group only. Germany is more represented (more organisations listed).
- Checks: SPF, DKIM (20 common selectors — a custom selector may be missed), DMARC, MTA-STS, TLS-RPT, DNSSEC and website headers, with the same engine as our free email security check.
- Passive only: public DNS and a single request to the public website. No scan, no probe.
- Only aggregated results are published. Figures rounded to one decimal.
Related
Frequently asked questions
Which organisations were checked?
3346 organisations headquartered in France or Germany, with at least 50 staff and an official website listed in Wikidata (open data). 3136 of them receive email (MX record) and are counted.
Is this legal and non-intrusive?
Yes. We only read public DNS records and public website headers — the same data every mail server and browser reads.
Can I see the score of a specific company?
We never publish individual results. Any company can check its own domain for free with our email security check.
Can I quote these figures?
Yes, with a link to this page: “Email security barometer 2026 — France and Germany, CyberNovaLabs.io”.
Is your company in the red?
Tell us your domain: an English-speaking advisor replies within one business day with your result and the exact fixes.
- Reply within one business day
- Written scope and price before any work
- Netherlands · Belgium · Luxembourg