In short
- In a sample of 3,688 domains of Czech manufacturers (25 to 249 employees), 79% have either no DMARC record or only p=none, which blocks nothing.
- Enforcement (p=quarantine or p=reject) is in place on 13% and 7% of domains respectively.
- You can check your own status with one DNS query for the _dmarc record of your domain. Your IT administrator can do it in a few minutes.
- The measurement sees only public DNS records. It says nothing about a company's overall security.
What we measured
On 26 October 2026 we measured the public DNS records of Czech manufacturing companies with 25 to 249 employees. DNS is the internet's public phone book, where every domain stores its technical details. We took the companies from public business registers and the domains from their websites. From 3,716 companies we obtained 3,688 domains. We looked at two records: MX, which tells the world where a domain's email is delivered, and _dmarc, discussed below.
Who delivers their email
Most domains, 2,039 (55%), point to the company's own servers or another hosting provider. Microsoft 365 handles 1,208 domains (33%), Google Workspace 163 (4%) and Seznam, a Czech email and search provider, 124 (3%). Another 154 domains (4%) have no MX record at all.
The Microsoft figure is a lower bound. Companies that run a mail filter in front of Microsoft show up in our data under another provider, so Microsoft's real share is probably higher.
What DMARC is and why it matters
DMARC is a DNS record that tells receiving mail servers what to do with an email that claims to come from your domain. A fraudster can write to your customer or supplier "from your address", for example with a new bank account number on an invoice. A properly configured DMARC stops such a message before anyone opens it.
The record has three modes:
- p=none only monitors. Forged messages get through, and you receive reports.
- p=quarantine sends suspicious messages to the spam folder.
- p=reject refuses them outright.
Protection starts with the second mode. None is a first step, not a goal.
What we found
| DMARC status | Domains | Share |
|---|---|---|
| no record | 1,961 | 53% |
| p=none | 967 | 26% |
| p=quarantine | 483 | 13% |
| p=reject | 265 | 7% |
For 8 domains the query failed. A further 4 domains did not fit any category. Without enforcement, meaning no record or p=none, are 79% of domains.
Most manufacturers therefore have nothing in place that would stop a forged email sent in their name. Only 7% of domains use the strictest mode, p=reject.
What this means for your company
It does not mean you have been attacked. It means anyone can try to write in your name and nothing stands in the way.
Nor does p=reject mean a company is safe. Our measurement sees only public records and says nothing about a company's overall security. It cannot see passwords, two-factor authentication, backups or staff training. DMARC is one layer that can be checked from outside and fixed cheaply.
How to check your own domain
Your IT administrator or IT supplier can do this. Ask for the TXT record at _dmarc.yourcompany.com. On Windows the command is nslookup -type=TXT _dmarc.yourcompany.com. In the answer, look for the p= part:
- No record, or p=none. You are in the same position as 79% of the companies we measured.
- p=quarantine or p=reject. You have enforcement. Ask whether anyone monitors it.
Do the same for domains you do not use for email, such as old company or brand names. They are just as useful to fraudsters.
How to get to enforcement
You do not jump from p=none straight to p=reject. Switching to p=reject without preparation can block your own messages. Typical victims are invoices from the accounting system, newsletters, or emails from an online shop that are sent by a different server than your regular mail.
A safe approach has three steps:
- Deploy p=none and read the reports for a few weeks. They show everyone who sends email in your name.
- Configure all legitimate senders so they can prove their identity (technically, SPF and DKIM records).
- Move to p=quarantine, and after verifying, to p=reject.
If you run your own mail hosting, you will need to coordinate with whoever administers it.
Limits of the measurement
We measured the public DNS records of 3,688 domains at a single point in time. The domains come from company websites found through registers, so companies without a website, or with email on a different domain, may have entered the sample differently or not at all. The Microsoft share is a lower bound, and the 154 domains without MX cannot be explained further from public data.
AI agent use cases in manufacturingData security when you deploy AI in your company
Prepared by AI from the listed sources and checked automatically against them. Not legal advice.