Brazil email security report

87% of 2,912 domains that receive email do not reject fake email in their name.

Only DMARC with p=reject makes the receiver refuse it. Without it, a fake bill or payment request can reach the inbox.

Measured on October 20, 2026

Group			No DMARC	Monitor only	Spam folder	Reject
State governments	553	91%	46%	21%	24%	9%
City halls	1,657	91%	34%	30%	27%	9%
Federal government	100	86%	9%	25%	52%	14%
Listed companies	440	77%	9%	29%	39%	23%
Listed retailers	41	71%	2%	27%	42%	29%
Banks	188	64%	14%	23%	27%	36%

Groups overlap: every listed retailer is also a listed company, and some banks are listed too or use a government domain. So the groups add up to 2,979 domains, more than the total of 2,912, which counts each domain once.

Method

Sample: 3,080 domains, list of October 20, 2026
Government lists: Receita Federal open company registry: public bodies with an active head office and a .gov.br email, by legal nature (city, state or federal) and public administration activity code
Bank list: Receita Federal open company registry: active head offices of commercial, multiple, investment and development banks, savings banks and development agencies (CNAE 6421-2, 6422-1, 6423-9, 6431-0, 6432-8, 6433-6 and 6434-4)
Listed companies: CVM register of listed companies, with an active registration; the retailers are those in the trade sector
Reading: Public DNS: MX, SPF and DMARC of each domain, once a month
Classification: Only the DMARC policy decides: p=reject rejects, p=quarantine sends to spam, p=none only monitors. SPF is read and counted in the API, but it does not change the class: without p=reject, the receiver gets no order to refuse.
What counts: Only domains that receive email (with MX). Free email providers and accounting firms are left out of the list. No domain is published.
Rounding: Each row adds up to 100%, by the largest remainder. “Do not reject” is the sum of no DMARC, monitor only and spam folder.

Looking for something else?Open email Email questions Get setup help