92% of the world's top email domains are reported to remain unprotected against phishing and spoofing.

May 29, 2025

92% of the world's top email domains are reported to remain unprotected against phishing and spoofing. — This cybersecurity statistic was published by EasyDMARC in May 2025. It covers topics including DMARC, Phishing, Spoofing. The original data appears in EasyDMARC 2025 DMARC Adoption Report. For the full methodology and detailed findings, refer to the original report.

Source

View Original Report

Published on 5/29/2025

Share or Copy this stat

Frequently Asked Questions

What does this statistic say?

92% of the world's top email domains are reported to remain unprotected against phishing and spoofing. This data was published by EasyDMARC and covers DMARC, Phishing, Spoofing.

Where does this data come from?

This statistic comes from EasyDMARC 2025 DMARC Adoption Report, published by EasyDMARC on May 29, 2025. You can view the original report at https://easydmarc.com/blog/ebook/easydmarc-dmarc-adoption-report-2025/.

What cybersecurity topics does this cover?

This statistic relates to DMARC, Phishing, Spoofing. Browse more statistics on DMARC or from EasyDMARC.

CYBERSTATS

92% of the world's top email domains are reported to remain unprotected against phishing and spoofing.

Source

Share or Copy this stat

Frequently Asked Questions

Want More Statistics Like This?

Related Statistics

77% of advanced email attacks failed SPF, DKIM, or DMARC authentication yet still reached inboxes.

79% of breached healthcare organizations have ineffective DMARC protection. This is up dramatically from 65% in 2024.

More than half (52.2%) of the domains analysed in the report still lack even a basic DMARC record.

In the US, the percentage of phishing emails accepted dropped from 68.8% in 2023 to just 14.2% in 2025 following strict DMARC mandates.

Among domains with DMARC records, over 40% fail to include reporting mechanisms like RUA tags.

Only 7.7% of the world’s top 1.8 million email domains are fully protected against phishing and spoofing by having implemented the most stringent DMARC policy, 'p=reject'1.

Browse by Topic

Stay Ahead of Cyber Threats