Home › Blog › Fintech email security benchmark 2026: how 478 fintechs set up DMARC, SPF and more
We checked 478 ranked fintechs' email records. 97.5% publish DMARC, 46.7% enforce p=reject, 16.5% don't enforce at all. Full data by segment and region.
By Moe Alhosni · Published 30 October 2026 · 9 min read
Short answer: On 30 October 2026 I checked the email records of 478 fintech and financial-services companies taken from four public rankings. 97.5% publish a DMARC record, but only 46.7% have it at p=reject, the setting that tells receivers to refuse forged mail. One in six (16.5%, 79 domains) either has no DMARC or sits at p=none, which asks receivers to do nothing with mail that fails. And only 8.4% publish MTA-STS, the record that stops mail to them being read in transit.
The same check gave 72.4% of these domains an A on our free email setup checker. So most of the industry has done the basics. The gaps are in the last step, and they are not evenly spread. Lenders, insurtechs and Middle East fintechs lag; digital banks and crypto firms lead.
I'm Moe Alhosni, founder of ROI Maximizer. I run B2B outbound, and before that I spent four years and seven months at Moody's in London selling to banks and asset managers. I ran this study because the same records decide two things a fintech cares about: whether its own email lands, and whether someone can send email that looks like it came from them. Below: the method, the numbers by segment and region, how they compare with published benchmarks, and what to do with them.
Six things, all public, all readable by anyone with a DNS lookup.
| Record | What it does | Why a fintech should care |
|---|---|---|
| MX | Says where mail for the domain is delivered | No MX, no replies |
| SPF | Lists the servers allowed to send as the domain | Missing or broken SPF fails authentication |
| DMARC | Tells receivers what to do with mail that fails SPF and DKIM, and sends reports | p=reject is what stops a forged invoice or payment request reaching the inbox |
| DKIM | Signs each message with a key published in DNS | Required by Gmail and Yahoo for bulk senders, and needed for DMARC to pass when mail is forwarded |
| BIMI | Shows the brand logo next to authenticated mail | Only works on top of an enforcing DMARC policy |
| MTA-STS | Tells other mail servers to use encrypted, verified connections when delivering to you | Without it, mail to you can be downgraded to plain text in transit |
Gmail has required SPF or DKIM from every sender, and DMARC from anyone sending more than 5,000 messages a day to Gmail accounts, since 2024 (Google's sender guidelines). Its minimum is p=none. That is a deliverability floor, not a security one. The US federal government set its own bar at p=reject for every agency domain back in 2017 (CISA BOD 18-01).
| Measure | Share of 478 domains |
|---|---|
| Publishes a DMARC record | 97.5% |
| DMARC at p=reject | 46.7% |
| DMARC at p=quarantine | 36.8% |
| DMARC at p=none | 14.0% |
| No DMARC record at all | 2.5% |
| Not enforcing (no DMARC or p=none) | 16.5% |
| Enforcing with a gap (pct below 100, or sp=none leaving subdomains open) | 6.5% |
| DMARC reports switched on (rua=) | 91.0% |
| One SPF record | 100% |
| SPF ending in -all (hard fail) | 52.3% |
| SPF ending in ~all (soft fail) | 46.9% |
| SPF over the 10-lookup limit (estimate) | 4.8% |
| DKIM key found on 10 common selectors (lower bound) | 96.4% |
| BIMI record | 27.6% |
| BIMI with a verified mark certificate (a= tag) | 23.0% |
| MTA-STS record | 8.4% |
| MTA-STS policy set to enforce | 4.0% |
| TLS reporting (TLS-RPT) record | 9.2% |
Three things stand out.
DMARC is nearly universal; enforcement is not. Almost everyone has the record. Only 83.5% have it set to quarantine or reject, and only 77.0% enforce with nothing left open. The 6.5% "with a gap" either apply the policy to a fraction of failing mail (pct=10 was common) or exempt every subdomain with sp=none. Both leave a route for spoofing that the main policy hides.
SPF breaks quietly. 4.8% of domains need more than ten DNS lookups to evaluate their SPF record. RFC 7208 caps it at ten (section 4.6.4). Past the cap, receivers that count the same way return an error, and SPF fails for mail that should pass. Each extra marketing, support or billing tool adds an include. Nobody notices until a payment reminder lands in spam.
The transport layer is mostly bare. MTA-STS (RFC 8461) is at 8.4%, and fewer than half of those are past testing mode. For firms whose inboxes receive bank details, KYC documents and contracts, that is the weakest number in the set.
The grade comes from the code that runs /tools/email-setup-checker, unchanged. MX, SPF and DMARC are each pass, warn or fail. The grade is capped by the worst finding, not averaged: one warning is a B, two a C, one fail a D, two fails an F. DKIM is reported but never graded, because a key we cannot find may still exist.
| Grade | Share |
|---|---|
| A | 72.4% |
| B | 24.3% |
| C | 0.8% |
| D | 2.5% |
| F | 0% |
Of the 116 B grades, 94 were down to DMARC (66 at p=none, the rest enforcing with a gap) and 22 to SPF (over the lookup limit, or a neutral ?all ending). The 12 D grades were all domains with no DMARC record.
Segments follow the categories the source lists use. Groups under 20 domains would be suppressed; none were.
| Segment | n | DMARC published | p=reject | p=quarantine | p=none | Not enforcing | Grade A |
|---|---|---|---|---|---|---|---|
| Payments | 131 | 96.9% | 41.2% | 40.5% | 15.3% | 18.3% | 71.8% |
| Lending and alternative finance | 71 | 95.8% | 39.4% | 35.2% | 21.1% | 25.4% | 63.4% |
| Wealth, investing and trading | 73 | 98.6% | 47.9% | 39.7% | 11.0% | 12.3% | 78.1% |
| Insurtech | 43 | 95.3% | 34.9% | 39.5% | 20.9% | 25.6% | 60.5% |
| Enterprise fintech (regtech, data, banking infra, finance software) | 80 | 98.8% | 52.5% | 36.3% | 10.0% | 11.3% | 71.3% |
| Digital banks and banking-as-a-service | 48 | 97.9% | 62.5% | 25.0% | 10.4% | 12.5% | 79.2% |
| Crypto and digital assets | 32 | 100% | 59.4% | 34.4% | 6.3% | 6.3% | 90.6% |
Crypto firms and digital banks are the most locked down. That fits: both are frequent targets for impersonation, and their customers expect it. Lenders and insurtechs are the weakest. One in four still does not enforce DMARC. Both segments send large volumes of customer mail about money, which is exactly what a phisher wants to copy.
BIMI follows the same pattern: 43.8% of digital banks and 40.6% of crypto firms publish it, against 12.7% of lenders and 16.3% of insurtechs.
Region is the company's country as given by the source list.
| Region | n | DMARC published | p=reject | p=quarantine | p=none | Not enforcing | Grade A |
|---|---|---|---|---|---|---|---|
| United States | 158 | 99.4% | 52.5% | 34.2% | 12.7% | 13.3% | 77.8% |
| United Kingdom | 147 | 99.3% | 46.3% | 40.8% | 12.2% | 12.9% | 73.5% |
| EU, EEA and Switzerland | 42 | 92.9% | 45.2% | 38.1% | 9.5% | 16.7% | 73.8% |
| Middle East and North Africa | 52 | 94.2% | 30.8% | 32.7% | 30.8% | 36.5% | 51.9% |
| Asia-Pacific | 50 | 94.0% | 42.0% | 42.0% | 10.0% | 16.0% | 70.0% |
| Canada, Latin America and Africa | 29 | 96.6% | 55.2% | 27.6% | 13.8% | 17.2% | 75.9% |
The US and UK are close. Europe outside the UK has more firms with no DMARC record at all (7.1%), which is why its "published" figure is lowest. The Middle East is the outlier: more than a third of the region's ranked fintechs do not enforce DMARC, and fewer than one in ten publish BIMI. Asia-Pacific has the highest share of SPF records over the lookup limit (10%).
| Group | DMARC published | Quarantine or reject | Source |
|---|---|---|---|
| Fintech rankings (this study), n=478 | 97.5% | 83.5% | ROI Maximizer, 30 October 2026 |
| Fortune 500 | 95% | more than 80% | EasyDMARC 2026 report, published 23 March 2026 |
| Fortune 500 | not given | 81.2% | Red Sift global DMARC guide, updated January 2026 |
| FTSE 100 | not given | 74% | Red Sift, as above |
| SEC-regulated firms (14,286) | not given | 30.8% | Red Sift, as above |
| Top 1.8 million domains | 52.1% | 22.9% | EasyDMARC, as above |
Ranked fintechs are level with the Fortune 500 on enforcement and ahead of the FTSE 100. They are far ahead of the wider population of SEC-regulated firms, where Red Sift found fewer than a third enforcing. EasyDMARC found 8.9% of the top 1.8 million domains combine p=reject with DMARC reporting. In this sample it is 44.6%.
Read that comparison carefully. The other studies use different samples, dates and definitions, and these are award-list companies: larger, better funded and more visible than the average fintech. The figure for "fintech" in general is almost certainly worse.
If you sell to banks, insurers or asset managers, your domain is checked before your email is read. Four practical points.
Whether your outbound is legal is a separate question from whether it lands. The country-by-country rules are in is cold email legal for financial services.
Email records are a small part of a vendor security review. They are also one of the few things a bank can verify from the outside in under a minute, without asking the vendor anything.
For EU financial entities, the Digital Operational Resilience Act made ICT third-party risk a formal obligation from 17 January 2025 (Regulation (EU) 2022/2554). It does not name DMARC. But a vendor that will email your staff about payments, logins or contract changes, and whose domain can still be spoofed, is a risk your team can see today. This is general information, not legal advice; check with your compliance team or counsel.
A short outside-in check for a fintech vendor:
On this sample, 16.5% of ranked fintechs would fail the first line. If you sell to banks yourself, how to sell to banks and your first bank pilot cover the rest of the review.
Sources. Four public rankings, all read on 30 October 2026:
Sample. 550 list entries. 13 were left out because I could not confirm the company's domain. Duplicates across lists were merged, leaving 482 domains. Four more were dropped because the listed web domain was parked or accepted no mail, so the company plainly mails from somewhere else. That leaves n = 478.
Domains. Each company's main web domain, matched by hand and confirmed against the live website. A company may send some mail from subdomains or other domains; those were not checked.
Segments and regions. CNBC's own seven segments where the company came from a CNBC list. For the two Forbes lists I assigned the closest of the same seven. Region is the country the source list gives.
Lookups. Public DNS-over-HTTPS: Cloudflare's resolver, with Google's as the fallback, at most eight requests in flight. Grading uses the same code as the free checker. DKIM was looked for on ten common selectors: google, selector1, selector2, default, k1, s1, s2, resend, mail and dkim. BIMI was read at default._bimi, MTA-STS at _mta-sts and its policy file, TLS-RPT at _smtp._tls. Every domain returned a complete, graded result.
Limits. One day's snapshot; records change. DKIM is a lower bound: a provider can use any selector name, and DNS has no way to list them. The SPF lookup count is an estimate, the same one the tool shows. A record is not proof of how mail is actually handled. Award lists favour larger firms, so this is a best-case view of the sector. No company is named and no individual grade is published; results are shown only for groups of 20 or more.
Data. The aggregate tables and the method are available on request for journalists and researchers. Email moe@roimaxi.com.
The email setup checker runs the same checks in your browser in about ten seconds. Nothing is stored. It shows each record, the grade and the exact value to publish if something is missing. If you sell into financial institutions, the wider picture is on the financial services hub and in fintech lead generation.
If an agency or SDR team will send email for you, ask three things first.
Moe Alhosni, founder, ROI Maximizer (M Ventures LTD, 4 Beau Street, Bath BA1 1QY). Book 30 minutes or email moe@roimaxi.com.
About the author: Moe Alhosni, founder of ROI Maximizer. Before that he spent four and a half years in sales at Moody's in London, most recently as Assistant Director, Sales, working with banks, asset managers and private equity firms. He runs the campaigns behind the first-hand data on this site. LinkedIn
Or run the free GTM teardown on your own site for the ICP, cold email and numbers specific to your company.
ROI Maximizer is a trading name of M Ventures LTD, registered in England and Wales, company no. 15554493. Registered office: 4 Beau Street, Bath BA1 1QY, United Kingdom. moe@roimaxi.com
© 2024–2026 M Ventures LTD. Privacy notice