Germany’s DMARC push stalls: more reject, errors persist

Germany’s biggest brands have nudged more of their domains to DMARC reject, which stops spoofing cold. But a new review says too many are still misconfigured.

Security firm dmarcian re-ran its scan of Germany’s top 250 parent domains in August 2026 and found progress with caveats. Stronger policies are up; basic errors are up, too.

What happened

dmarcian’s August 2026 snapshot shows 40% of the top 250 German parent domains at p=reject, the strictest Domain-based Message Authentication, Reporting and Conformance (DMARC) policy that tells receivers to reject unauthenticated mail. Another 15% sit at p=quarantine, which diverts unauthenticated mail to spam rather than blocking it outright (source).

The same dataset reports 18% of domains at p=none, the monitoring phase that collects reports without enforcing. That’s a 12‑point drop from October 2025, suggesting many monitoring domains advanced to enforcement over the past year, even if not all reached rejection (source).

The share of parent domains at p=reject rose by 3 points since the October 2025 baseline. Meanwhile, the portion at p=quarantine was unchanged, which implies the biggest net movement came from deprecating p=none or error states rather than from quarantining domains stepping up to reject (source).

Alongside policy movement, error rates didn’t improve. In 2026, 34% of the 250 domains had SPF or DMARC problems, up from 32% the year before. Of those 2026 errors, 55% were tied to Sender Policy Framework (SPF) records and 45% to DMARC record issues; the 2025 split was 56% SPF and 44% DMARC (source).

The most common DMARC mistake was a missing RUA tag. rua= tells mailbox providers where to send aggregate reports that detail who is sending on your domain and how messages authenticate. A DMARC record without rua= is valid, but it blinds operators to abuse patterns and misaligned mail (source).

SPF problems ranged from missing records to syntax errors and unsupported mechanisms. Multiple SPF records and excessive DNS lookups also appeared frequently. SPF processing is capped at 10 DNS lookups; beyond that, receivers treat SPF as a permerror, effectively ignoring it—leaving mail unauthenticated (source).

The review ties the stakes to 2026 incidents affecting German targets. In April, Signal‑themed phishing tried to steal lawmakers’ PINs via bogus support messages and malicious QR codes. In July, a Lidl breach exposed customer data in Germany, Belgium, and the Netherlands; the concern is follow‑on phishing and vishing. An Austrian hotel IT vendor also disclosed a network compromise that led to fake payment requests to guests in Germany (source).

The background

DMARC builds on SPF and DomainKeys Identified Mail (DKIM) by adding an alignment check with the visible From domain and a policy (none, quarantine, reject). With DMARC at p=reject, a receiver is instructed to block messages that fail authentication and alignment.

Germany’s “Year of Email Security” push in 2025 set a backdrop for hardening policies. dmarcian’s October 2025 baseline of the same 250 parent domains established reference points: how many had a record, how many enforced, and where misconfigurations clustered. The 2026 follow‑up shows enforcement did rise—but not dramatically (source).

The share tagged as “do not follow best practices or have errors” within the policy snapshot was 15% in August 2026. Separately, a deeper configuration audit counted 34% with SPF or DMARC mistakes that could blunt protection or visibility. That gap signals two lenses: a high‑level policy state and a lower‑level config health view, both relevant for risk (source).

This tracks with what we’ve reported elsewhere: logos via BIMI demand DMARC enforcement, not just design. Providers and certificate flows won’t bless a brand mark without p=quarantine or p=reject in place. Our explainer on how BIMI starts with DMARC enforcement lays out those dependencies end‑to‑end.

SPF’s fragility is a recurring culprit. Long vendor chains, accumulated include: mechanisms, and stray records push programs over the 10‑lookup cap. We covered practical cleanup steps in our 30‑day playbook to lock down your email without breaking sends.

Blocklist pressure also rewards clean authentication. Spamhaus reported surges in risky domains in late 2026; trimming shadow senders and tightening SPF/DKIM alignment reduces collateral listings. See our rundown of how Spamhaus flagged record risky domains and why that matters for cold or gray mail.

If you want more pieces like this, we track protocol changes, sender requirements, and adoption trends in our Authentication coverage hub at /category/authentication.

What people are saying

dmarcian, which conducted the research, characterizes Germany’s progress as marginal: “Spoiler alert: Not much has changed,” the team writes, while noting a 3‑point rise in p=reject and a 12‑point drop in p=none (source).

Their analysis attributes many DMARC record issues to missing aggregate report addresses (rua=). That omission leaves operators unable to see spoof attempts, third‑party sends, or authentication failures at scale—data you need to push toward enforcement without breaking legitimate mail (source).

On SPF, the study highlights absent records, syntax mistakes, and structural missteps—like multiple SPF TXT records or too many includes—that cause receivers to ignore the record. When SPF fails this way, DMARC has only DKIM to lean on; if DKIM isn’t aligned to the From domain, DMARC fails outright (source).

The report also connects posture to real‑world threats, pointing to 2026 phishing waves touching German political, retail, and hospitality contexts. Those episodes don’t prove causation with any single domain’s config, but they underline why enforcement plus sound configuration is the goal state (source).

We’ve also heard from deliverability pros that enforcement done sloppily can spike complaints and blocklists. Our guide to Gmail’s changing reputation signals explains how to watch authentication failure rates and spam folder placement as you increase policy strength.

What happens next

For German enterprises at p=none, the immediate next step is adding rua= reporting, validating SPF/DKIM alignment with the From domain, and charting a measured move to p=quarantine and then p=reject. The 12‑point drop in p=none over the last year shows that playbook is doable at scale (source).

Domains lingering at p=quarantine should use aggregate data to hunt stray platforms and marketing tools sending out of alignment. Prune includes to respect the 10‑lookup SPF cap and consolidate multiple SPF records into a single, syntactically clean TXT entry (source).

Given the 34% error rate, audit cadence matters as much as one‑time fixes. Add checks for missing rua=, sp= subdomain policy needs, and DKIM selector hygiene. When vendor rosters change, re‑verify alignment before turning up volume on new traffic sources (source).

With phishing continuing to exploit recognizable brands and vendor weak points, the combination of DMARC at reject, healthy SPF, and aligned DKIM reduces spoofing and helps mailbox providers trust your legitimate mail. dmarcian’s year‑over‑year view suggests Germany is moving—just not fast enough to outrun attackers yet.