Italian Domain Email Security Adoption Study 2026

Most of what the internet publishes about DMARC adoption comes from scanning .com domains or the Alexa top one million. Those numbers are useful, but they obscure what is actually happening in regional TLDs. A passive measurement study of 10,020 Italian (.it) domains provides a different picture -- one where SPF runs at roughly 67%, DKIM at about 23%, and DMARC enforcement (p=quarantine or p=reject) touches fewer than 2% of domains. If you have been benchmarking your email security program against .com-centric studies, those numbers are probably making you look better than you are.

This article summarizes what the study measured, what it found, and what the findings mean for anyone responsible for email security outside the .com mainstream.

What the Study Measured

The research team collected data from 10,020 domains registered under the .it country code top-level domain. They used passive observation, collecting DNS records and email headers as they traversed the network, rather than sending test messages or actively probing domains. This distinction matters: active probing can trigger rate limits or blocks, and it measures what domains say they do rather than what actually happens in live email traffic.

Passive measurement captures production behavior, which tends to be more representative of real-world email security posture.

The study measured six email security technologies: SPF, DKIM, DMARC, MTA-STS, DANE, and BIMI.

SPF Adoption: Sender Policy Records Are Common, But Often Misconfigured

The study found SPF records present on roughly 67% of scanned .it domains. That is higher than many people expect, but it comes with a significant caveat: having an SPF record is not the same as having a correct one.

Common problems include SPF records that include too many mechanisms and push the DNS lookup count past the 10-lookup limit, records that authorize third-party sending services without proper alignment, softfail (~all) used in production instead of hardfail (-all), and SPF records that have not been updated after migrating to a new email provider.

The practical implication is that a domain with an SPF record can still fail DMARC alignment if the RFC5321.MailFrom domain does not match the RFC5322.From domain. SPF passing while DMARC fails is one of the most common authentication mismatches in real deployments.

DKIM Adoption: Signing Is the Exception, Not the Rule

Only about 23% of the scanned .it domains had at least one valid DKIM record published. This is consistent with other regional TLD studies that consistently find DKIM adoption running well below SPF adoption.

The gap matters because DMARC alignment requires either SPF alignment or DKIM alignment, or both. A domain that publishes SPF but not DKIM is relying entirely on SPF alignment. If that domain sends email through multiple third-party providers -- a marketing platform, a CRM, an internal relay -- getting SPF alignment across all of them is technically difficult and operationally fragile.

DKIM signing, when properly implemented, is more durable than SPF because it authenticates the specific sending service rather than the envelope MAIL FROM, which changes as email routes through different infrastructure.

DMARC Adoption: Most Domains Still at p=none

The study found approximately 8% of .it domains had a published DMARC record. Of those, the majority were set to p=none, meaning monitoring mode: the domain publishes a policy but takes no action on failures.

Only a small fraction had reached p=quarantine or p=reject. Roughly 1.5% of all scanned domains had reached p=reject.

These numbers are lower than the often-cited "top 1 million domain" studies, which overrepresent large organizations and security-mature companies. A regional TLD snapshot gives a more honest view of where most organizations actually are. They have heard of DMARC, many have tried it in monitoring mode, and very few have moved to enforcement.

The practical implication: if your organization is struggling to move from p=none to p=reject, you are not alone. The Italian data suggests that most domains that start the journey never complete it.

MTA-STS: TLS Policy for Email Transport

MTA-STS (Mail Transfer Agent Strict Transport Security) was present on approximately 3% of scanned domains. Unlike SPF and DKIM, which authenticate the sender and the message content, MTA-STS encrypts the transport channel between mail servers and prevents downgrade attacks.

The low adoption rate is not surprising. MTA-STS requires a specific DNS record, a policy file hosted on the domain itself, and ongoing maintenance as certificates expire. Many organizations are not aware of it, and most have not prioritized it relative to DMARC.

The security case is real, however. Without MTA-STS, email can be intercepted in transit between servers that advertise STARTTLS support but fall back to plaintext if the receiving server does not respond correctly. This is not theoretical: STARTTLS stripping is an documented attack vector.

If you handle sensitive email or operate in a regulated industry, MTA-STS is worth adding. It is less operationally complex than DANE and provides meaningful transport security.

DANE: Certificate-Pinned Email Transport

DANE (DNS-based Authentication of Named Entities) was found on less than 1% of scanned .it domains. DANE ties SMTP TLS certificates to DNS TLSA records, making it harder for attackers to impersonate a domain with a fraudulent certificate.

DANE adoption is near-zero across every TLD studied so far. The main barrier is operational complexity: TLSA records must be kept synchronized with certificate renewals, and unlike MTA-STS, there is no automated fallback if a TLSA record is misconfigured. Mail delivery simply fails rather than falling back to opportunistic TLS.

For most organizations, MTA-STS is the more practical target.

BIMI: Brand Indicators in Email Are Rare Everywhere

BIMI (Brand Indicators for Message Identification) appeared on fewer than 0.5% of scanned domains. BIMI displays a brand logo next to authenticated email in supporting mail clients.

The requirements for BIMI are steep: the domain must have DMARC at p=quarantine or p=reject, must have a DKIM key signed with a domain selector that matches the BIMI record, and must host a Verified Mark Certificate (VMC), which is a paid certificate that verifies logo ownership. Most organizations have not cleared these hurdles.

BIMI is a forward-looking indicator of email authentication maturity, not a near-term goal for most domains.

What This Means for Your Email Security Strategy

The Italian domain study gives security teams a more honest baseline than the .com-centric numbers often quoted in vendor marketing. The practical takeaways:

If you are comparing your domain to benchmarks, use the right benchmark. If you operate primarily in .it or another European ccTLD, the Italian data is more representative than the "top 1 million domain" studies. Your peer group is probably less mature than the headline DMARC adoption numbers suggest.

SPF is necessary but not sufficient. Getting SPF right is the first step, but without DKIM and DMARC alignment, you are only solving part of the problem. Focus on DKIM signing across all your authorized sending services.

Getting to p=reject is harder than the guides suggest. The Italian data shows that even among domains that published DMARC, the majority stayed at p=none. The transition requires identifying all legitimate senders, updating their authentication, and monitoring aggregate reports before making the switch. Plan for weeks or months of monitoring, not a single weekend.

MTA-STS is worth adding, especially if you handle sensitive email. It is less complex than DANE, provides meaningful protection against transport-level downgrade attacks, and is increasingly supported by major email providers.

How to Run Your Own Domain Measurement

The Italian study was a one-time snapshot. Most organizations need ongoing measurement, to track their own authentication posture over time, or to assess vendors and partners.

DMARCFlow can scan any domain list across all major email authentication standards, producing the same kind of breakdown that academic studies publish. The measurement methodology matters: passive collection of DNS records and email headers, rather than active probing, gives you the most accurate picture of what is actually happening in production traffic.

You can measure your own TLD, your supply chain, or your customer domains on a recurring schedule. If you want to benchmark your own domain against the Italian data, DMARCFlow gives you the tools to do that with your specific domain set rather than relying on a study that may not reflect your threat model or regional context.

FAQ

How was this data collected?

The study used passive measurement, collecting DNS records and email headers as they traversed the network. This approach captures real-world email behavior without the biases that active probing can introduce, such as servers that rate-limit or block repeated queries.

Is .it representative of other European TLDs?

Italian .it domain data is one snapshot. Other European ccTLDs (like .de, .fr, .nl) may show different patterns depending on local hosting culture, regulatory environment, and email operator maturity. However, the gap between .com benchmark studies and regional TLD data is likely consistent across most European markets.

How does this compare to US and .com adoption rates?

Studies of .com and US-focused TLDs consistently show higher authentication adoption rates, particularly for DMARC. This reflects the composition of .com, which overrepresents large enterprises, tech companies, and organizations with mature security programs, rather than a true picture of internet email infrastructure as a whole.

How can I measure my own TLD or domain list?

DMARCFlow supports scanning any domain or domain list across SPF, DKIM, DMARC, MTA-STS, DANE, and BIMI. You can set up recurring scans for your own domains, your ccTLD of interest, or a list of vendors and partners you want to assess.