We examined the email security of 58,769 active South African business domains and recorded one thing above all: whether someone else can send email in their name. This is the full report: the numbers, how they were measured, and what they cannot tell you. The plain-English version is on the blog. You can check any domain against these results.
Base for every percentage on this page: 58,299 email-enabled domains (valid MX records), unless stated otherwise.
Key findings
- 84.3% of domains publish no enforcing DMARC policy. A receiving server has been given no instruction to reject a forged message in their name.
- 92.2% publish SPF, but only 26.0% end it in a hard fail. 50.7% end in a soft fail, 16.5% publish something broken or neutral, and 7.8% have no SPF at all.
- 41.1% publish DMARC. 61.7% of those are set to
p=none. 7.6% of all domains reachp=reject. - Only 16.1% of domains request DMARC aggregate reports, so most domains in monitoring mode cannot see the forgeries they are monitoring for.
- 26.0% have the full stack (SPF, DMARC and DKIM present). 5.6% have no authentication of any kind.
- DKIM was detectable on 47.3% of domains, a lower bound. Two thirds of those use only the default selector that shared hosting provisions automatically.
- The mail operator decides the outcome. The two largest hosts in the country, xneelo and Afrihost, enforce DMARC on 12.4% and 3.1% of their domains. RDSA, running inside xneelo's own network, enforces on 95.7%.
The protection funnel
Adoption looks respectable at the top and collapses at the bottom. Each row is a subset of the one above it.
| Stage | Domains | Share |
|---|---|---|
| Email-enabled domains (valid MX) | 58,299 | 100.0% |
| Publish SPF | 53,725 | 92.2% |
| SPF and a DMARC record | 23,205 | 39.8% |
| SPF and a valid DMARC record | 22,885 | 39.3% |
| DMARC enforcing (quarantine or reject) | 8,908 | 15.3% |
DMARC p=reject | 4,302 | 7.4% |
Fully closed: p=reject and SPF -all | 2,091 | 3.6% |
Method
Population. 58,769 active South African business domains, each confirmed in September 2026 to belong to an operating business with a live website. Parked, dormant, for-sale and placeholder domains were excluded, as were clusters of near-identical sites that do not represent real businesses. 58,299 of the domains (99.2%) have valid MX records, and those form the base for every percentage in this report.
Why exclusions make the result conservative. The domains we set aside scored lower on every measure: DMARC present on 37.1% of them against 41.1% in the census, enforcing on 12.6% against 15.7%. Had they been counted, South African email security would look worse than it does here.
Identifying the mail operator. Each operator is identified by who owns the network its mail servers run on, not by the MX hostname. That distinction matters in South Africa, where the largest hosts issue vanity MX records under the customer’s own domain (mail.yourcompany.co.za). Judged by hostname, 38% of domains look self-hosted and xneelo appears to host six. Judged by network ownership, xneelo is the largest business mail host in the country.
Measurement. Live DNS only. No mail was sent and no host was probed. For each domain: MX records including null-MX detection, every TXT record at the apex for SPF, the TXT record at _dmarc, and roughly twenty common DKIM selectors plus provider-specific extras. SPF is classified by its actual all qualifier. Duplicate SPF and DMARC records are detected by examining every TXT record rather than stopping at the first match.
Reliability. Scanning the same 300 domains twice at full concurrency produced 0.10% field-level disagreement. Every domain that failed the first HTTP pass was retried through public resolvers, and every rate-limited or bot-challenged domain was retried again at low concurrency, recovering 726 sites a single pass would have wrongly discarded.
Definitions
- Enforcing: a valid DMARC record with
p=quarantineorp=reject. - Fully closed: DMARC
p=rejectand SPF ending in-all. - Spoofable: no valid DMARC record, or a record with
p=none. - Published: a syntactically recognisable record exists, regardless of what it does.
SPF
92.2% of email-enabled domains (53,725) publish SPF. Only 26.0% end it in -all. 50.7% end in ~all, which asks receivers to accept unlisted senders and merely mark them. 16.5% publish something broken or neutral, and 7.8% publish nothing. Genuine defects, as distinct from merely weak records, affect 17.9% of published records (9,614 domains):
| Defect | Domains | Of SPF records |
|---|---|---|
Neutral ?all: explicitly no protection | 8,240 | 15.3% |
No all mechanism: incomplete record | 757 | 1.4% |
| Duplicate SPF records: permanent error | 699 | 1.3% |
Deprecated ptr mechanism | 309 | 0.6% |
Multiple all mechanisms: ambiguous | 27 | 0.1% |
+all: permits anyone to send | 5 | 0.0% |
| Exceeds 10 DNS lookups: permanent error | 2 | 0.0% |
DMARC
41.1% of domains (23,988) publish a DMARC record. Among them, 61.7% are set to p=none, 19.7% to p=quarantine and 18.6% to p=reject. Across all email-enabled domains that is 15.7% enforcing and 7.6% at reject. Only 16.1% of domains include a rua= reporting address.
Invalid DMARC is rare but real. 327 domains (0.6%) publish a record that will not parse: 279 with duplicate records, 28 missing the required p tag, and a scattering of typos including p=quarentine, p=quarntine and p=policy. Receivers ignore these records entirely.
DKIM
A DKIM public key was found for 47.3% of domains (27,592). Of those, 65.8% use only the default selector, which cPanel-style shared hosting provisions automatically. The distinction matters: domains whose DKIM was deliberately configured enforce DMARC at 37.1%, while domains with only the default selector enforce at 14.8%. Auto-provisioned DKIM reflects a hosting default, not a security programme.
Results by mail operator
The two largest mail hosts in the country are among the weakest enforcers. xneelo runs more South African business email than Microsoft does and enforces DMARC on 12.4% of it. Afrihost enforces on 3.1%.
| Operator | Domains | Share | SPF | DMARC | Enforcing | DKIM |
|---|---|---|---|---|---|---|
| xneelo (SA) | 9,841 | 16.9% | 96.1% | 21.2% | 12.4% | 19.2% |
| Microsoft 365 | 8,897 | 15.3% | 98.6% | 49.7% | 26.4% | 51.6% |
| Afrihost (SA) | 6,651 | 11.4% | 96.4% | 29.5% | 3.1% | 57.1% |
| Google Workspace | 5,666 | 9.7% | 75.2% | 43.5% | 14.2% | 47.7% |
| Diamatrix (SA) | 4,229 | 7.3% | 96.0% | 25.6% | 5.1% | 78.8% |
| Hetzner | 1,481 | 2.5% | 93.9% | 57.3% | 32.5% | 33.3% |
| Host Africa (SA) | 1,294 | 2.2% | 98.0% | 30.4% | 13.5% | 78.0% |
| GoDaddy | 1,282 | 2.2% | 68.0% | 55.6% | 43.9% | 4.1% |
| 1-grid (SA) | 1,151 | 2.0% | 97.0% | 44.9% | 27.9% | 89.6% |
| Elitehost / Optify Systems (SA) | 876 | 1.5% | 83.8% | 95.7% | 7.1% | 96.6% |
| Cloudflare (email routing) | 796 | 1.4% | 96.9% | 79.9% | 6.3% | 8.9% |
| IONOS (1&1) | 733 | 1.3% | 95.8% | 87.4% | 9.3% | 9.1% |
| Zoho | 567 | 1.0% | 92.9% | 42.7% | 13.8% | 70.7% |
| Oracle Cloud | 553 | 0.9% | 95.5% | 19.9% | 5.4% | 72.3% |
| Mimecast SA (filtering gateway) | 520 | 0.9% | 95.0% | 67.1% | 48.1% | 43.5% |
Operators below 0.9% of domains are omitted. Mimecast is a filtering gateway and Cloudflare a routing service, not mail hosts. Mimecast customers' domains enforce DMARC at three times the national rate, yet half still do not. A gateway protects the inbox it sits in front of. It does not publish the customer's DNS, so it does nothing for that customer's name in anyone else's inbox.
Proof that this is a choice, not a constraint
RDSA, a mail service for 682 of these domains, enforces DMARC on 95.7% of them, the highest rate in the study. Its servers run inside xneelo's network. The other 9,160 xneelo-hosted domains enforce at 6.2%. Same data centre, same country, same customer base, and a fifteen-fold difference that comes down entirely to what the platform configures by default.
The mirror image is just as clear. Elitehost (Optify Systems) publishes DMARC for 95.7% of its domains but enforces on 7.1%. IONOS, the former 1&1: 87.4% published, 9.3% enforcing. Cloudflare: 79.9% and 6.3%. These providers auto-publish p=none at signup, which registers as adoption in every survey while instructing receivers to reject nothing.
Limitations
- DKIM figures are a lower bound. Detection requires guessing selector names, so custom selectors are invisible to any passive survey.
- The census covers verified, active business domains. It is a large, well-defined sample of South African business email, not every domain registered in the country.
- Domains with no MX may still send mail and remain spoofable.
- A small number of working businesses that block automated visitors will have been excluded as inactive.
- This is a single snapshot from September 2026. DNS changes daily.
- This census measures published policy, which is the only signal available to a third-party receiver. Large receivers also apply their own filtering to unauthenticated mail, so a domain at
p=noneis not forged with equal ease everywhere. That filtering varies by receiver, is not guaranteed, and cannot be observed from DNS. - A gateway or filter in front of a domain's own mailboxes can reject forgeries arriving there. It cannot protect that domain's name in inboxes it does not control; only the published record does that.
- An enforcing policy stops forgery of the domain itself. It says nothing about mail sent from a compromised real mailbox, which passes every check.
Citing this work
CyberFrame, South African Email Security Census 2026, September 2026, https://cyberframe.co.za/research/sa-email-security-2026.html. 58,769 verified South African business domains. Figures may be quoted with attribution. Aggregate data by operator is available on request at info@cyberframe.co.za. We do not publish per-domain results.