Research · Data as of 28 September 2026
One in four of Spain's IBEX 35 companies does not block email that spoofs its domain
As of September 2026, 9 of the 35 companies in Spain's IBEX 35 index (26%) have no DMARC policy that rejects or quarantines email spoofing their domain: 8 sit at p=none and 1 publishes no record. 63% enforce p=reject, the strictest setting, 25 points more than large Spanish companies overall (38%).
Led by Thilina Manana, Director of Operations and Security at Hard2bit
- do not reject or quarantine mail that spoofs their domain
- 9 of 35 do not reject or quarantine mail that spoofs their domain
- at p=none receive reports showing the problem and still do not block it
- 6 of 8 at p=none receive reports showing the problem and still do not block it
- enforce the strictest policy, p=reject
- 63% enforce the strictest policy, p=reject
- requires inbound mail to arrive encrypted (MTA-STS)
- 1 of 35 requires inbound mail to arrive encrypted (MTA-STS)
Why it matters
Why the email security of Spain's largest companies matters outside Spain
The IBEX 35 is Spain's benchmark stock index: the country's largest listed banks, utilities, telecoms, infrastructure and consumer groups, most of them with operations and suppliers across Europe and Latin America.
When one of them leaves its domain open to spoofing, the people most exposed are not its own staff but its counterparties: the supplier who receives a fake remittance notice, the partner asked to change bank details, the customer sent a convincing invoice. DMARC is the control that lets a company tell the rest of the internet to refuse that mail.
Results
Which DMARC policy do IBEX 35 companies use?
We checked the primary mail domain of each of the 35 companies in the index on 28 September 2026. Nearly two thirds enforce p=reject. Just over a quarter publish nothing that makes receivers act on spoofed mail.
That enforcement rate is well above the 38% we measured across 219 large Spanish companies three weeks earlier, yet the share left unprotected is almost identical (26% against 27%).
- p=reject Receivers reject mail that fails the check. 22 62.9%
- p=quarantine Receivers divert it, usually to spam. 4 11.4%
- p=none Receivers deliver it as normal; the owner only gets reports. 8 22.9%
- No record No DMARC policy published at all. 1 2.9%
Inbox rules
Passing the mailbox providers' rules is not the same as blocking spoofing
Since 2024 Google and Yahoo, and since 2025 Microsoft for Outlook.com, require high-volume senders to publish a DMARC record. A policy of p=none satisfies that requirement. It keeps a company's newsletters out of the spam folder, but it does not ask anyone to refuse mail that fakes the company's domain.
That makes p=none a comfortable place to stop: the deliverability problem is solved and nothing visibly breaks. It is also where eight IBEX 35 companies are today.
8 of 35
publish DMARC at p=none: enough for the inbox providers, not enough to stop spoofing.
Watching, not blocking
Six companies can see the spoofing and have not switched it off
Six of the eight p=none domains publish an address for DMARC aggregate reports. Every day they receive a list of the servers sending mail in their name, unauthorised ones included. The information needed to move to enforcement is already in their inbox. The other two publish p=none without even collecting the reports.
Other email controls
SPF is universal; encrypted delivery is rare
- SPF published 35/35 Universal. 30 end in -all (fail) and 5 in ~all (soft fail).
- SPF near the lookup limit 4/35 9 or 10 DNS lookups. Past 10, SPF breaks and legitimate mail can bounce.
- BIMI 4/35 Shows a verified logo in supporting mail clients.
- TLS-RPT 2/35 Reports on encryption failures during delivery.
- MTA-STS 1/35 Forces sending servers to deliver over verified, encrypted connections.
DKIM is not reported: its keys sit under selector names each company chooses, which cannot be enumerated from outside, so not finding one does not prove it is missing.
Websites
Half of the homepages have no Content-Security-Policy
We also recorded the security headers returned by one request to each homepage. Thirty responded with the page itself; five answered with a firewall block or an anti-bot challenge and are left out.
-
15/30
No Content-Security-Policy
The browser's main defence against injected scripts.
-
4/30
No HSTS
The first visit can be intercepted before the switch to HTTPS.
-
3/30
No clickjacking protection
Neither X-Frame-Options nor frame-ancestors, so the page can be framed by a hostile site.
What to do
Getting to p=reject without losing real mail, and checking your counterparties
Order matters: tightening the policy before every legitimate sender is signed is what bounces invoices and alerts, and what keeps so many companies parked at p=none. Our domain security guide covers the technical detail.
- 01
Find every service that sends as you
Mail platform, CRM, billing, payroll, marketing and alerting tools. Your DMARC aggregate reports list the ones you forgot.
- 02
Sign all legitimate mail with DKIM
One selector per platform. This is what keeps real mail flowing when the policy tightens.
- 03
Move to quarantine in stages
Use pct to apply the policy to a share of traffic first, and raise it while you watch the reports.
- 04
Finish at p=reject
Including sp for subdomains and np for non-existent subdomains, so nobody can invent one.
- 05
Cover the domains that never send
Parked and secondary domains need SPF -all and DMARC p=reject too; attackers use them.
- 06
Check your counterparties
If you pay Spanish suppliers or partners, add their DMARC posture to your third-party reviews. NIS2 Article 21(2)(d) already asks for supply chain security.
Method
How the study was done
Passive analysis of public information, the same anyone can run from a laptop. No email was sent to any company and nothing was tested for vulnerabilities.
- Sample
- The 35 IBEX 35 constituents as published on 28 September 2026.
- Date
- 28 September 2026. DNS records change; this is a snapshot of that day.
- Domain checked
- Each company's primary mail domain. Secondary domains of 7 companies were also checked but are not in the percentages: one was at p=none and one had no DMARC record.
- DNS lookups of MX, SPF (including nested lookup count), DMARC, MTA-STS, TLS-RPT and BIMI records, plus common DKIM selectors.
- Web
- One HTTPS GET to the homepage, following redirects. We recorded HSTS, Content-Security-Policy, X-Frame-Options and frame-ancestors.
- Anonymity
- Results are published in aggregate. No company is identified.
Open data
Download the data and cite the study
The aggregated indicators are released under Creative Commons Attribution 4.0. Reuse them in articles, reports and talks, citing Hard2bit and linking to this page.
How to cite
Manana, T. (2026). Email spoofing in the IBEX 35. Hard2bit. Data as of 28 September 2026. https://hard2bit.com/en/research/email-spoofing-ibex-35/
Journalists and analysts: for more detail or an interview, contact us through our press page.
FAQ
Questions about the study and DMARC
I run vendor risk for a European group with Spanish suppliers: how do I check whether a supplier's domain can be spoofed?
Does p=none meet the Google, Yahoo and Microsoft sender requirements?
Which IBEX 35 companies are at p=none?
If a company is at p=reject, is it safe from email impersonation?
How was the data collected?
Can I reuse the figures?
Related terms
Concepts from our cybersecurity glossary that connect directly with this service.
Stuck at p=none?
We help companies in Spain and across the EU reach p=reject without losing legitimate mail: sender inventory, DKIM, staged rollout and report monitoring.
Study led by Thilina Manana, Director of Operations and Security at Hard2bit, with data as of . Published . Hard2bit is certified to Spain's National Security Framework (ENS) at HIGH level and ISO 27001.