Email at French SMBs: what their domain allows

Almost every one of these domains publishes an SPF record. This survey looks at the line after it: the policy that tells receiving servers what to do when the check fails.

Published on 3 September 2026 1,731 French SMB domains that receive mail, surveyed on 3 September 2026

96 %of domains publish an SPF record
71 %have no DMARC policy that acts on the result
28 %line both up: an SPF that decides and a policy that acts

Half the population publishes a policy that asks for nothing to be done

DMARC is the DNS line that tells the receiving server what to do with a message sent in the domain's name that fails the check. It takes three values, and one of the three is to do nothing.

Published policy Domains Share
No policy 358 21 %
p=none, do nothing 865 50 %
p=quarantine, set aside 274 16 %
p=reject, refuse 234 14 %

1,223 domains out of 1,731, or 71%, fall in the first two rows: the check happens, and its result leads to nothing. The last two rows hold 508 domains, 29% of the population.

SPF is everywhere, and on its own it decides nothing

SPF is the list of servers allowed to send in the domain's name. 96% of the domains surveyed publish one, which makes it one of the best established settings in the population. 38% end it with a strict qualifier, declaring every other server illegitimate, and 53% with a soft one, which flags the message without declaring it illegitimate.

Either way, SPF describes a situation, it asks for nothing. The DMARC policy is what carries the request, and it is the one missing or left at zero on 71% of domains. 492 domains, 28% of the population, publish both settings pointing the same way.

Why the two settings are read together

A domain that publishes an SPF record has made the first move: it has named its servers. That is the move an email provider offers during setup, and the 96% figure says it is almost always made.

The second move belongs to the domain and to it alone: saying what is expected of recipients. Publishing p=none explicitly asks for nothing to change in how mail is handled, which is useful while observing, and this survey does not say how long these policies have been in place.

That is what explains a population well equipped with SPF and thinly covered in practice, without assuming any neglect: the first move is offered by the tool, the second is decided.

Where these companies receive their mail

Operator Domains Share
Microsoft 365 460 27 %
Google Workspace 349 20 %
OVHcloud 240 14 %
Gandi 64 4 %
IONOS 50 3 %
Infomaniak 24 1 %
Other operators, widely scattered 436 25 %

The first two carry 47% of the population between them, and a quarter of domains is spread across a large number of operators holding a few domains each. 95 domains, 5% of the population, route their incoming mail through a filtering gateway placed in front of their operator. The DMARC policy, for its part, does not follow the operator: across the three most common ones, the share of policies that act ranges from 12% to 33%.

Simafri Suite, plainly

Simafri Suite is your company's professional email on your own domain name, with calendar, contacts and files, set up and kept running by Simafri, which has been creating, hosting and maintaining the tools of businesses since 2002.

See the offer and prices

Method

Frame: the same 1,778 SMBs as the 1 September survey on WordPress, drawn from the Tranco list GQJJK, established on 31 August 2026, and qualified by the SIREN number published in their legal notices. Two surveys of one population are read together.

Survey chain: for each domain, one MX query, one TXT query on the domain and one TXT query on _dmarc, made on 3 September 2026 against public DNS resolvers. 1,731 domains out of 1,778 declare a mail server; the other 47 receive none and fall outside the percentages on this page.

What was read: the names of the declared mail servers, the final qualifier of the SPF record, and the value of p= in the DMARC record. The operator is recognised from the name of the lowest-priority server that matches a known family.

What was not read: no message, no mailbox, no header. DNS is public and is read without touching the domain, three queries per company.

Scope: DKIM cannot be surveyed from the outside, its selector not being published at a fixed place, so it does not appear here. A policy set on a subdomain is not followed either. The frame being a list of the most visited domains, the smallest organisations are under-represented in it, and the share of domains without a policy is probably lower here than across the wider economy.

Data and reuse

The full survey is published, one row per company, with its domain, its SIREN number, its headcount band, the recognised operator, the SPF qualifier, the DMARC policy and the declared mail servers. These figures may be reused with attribution to Simafri and a link to this page.

Download the full survey (CSV)

Next survey planned for 3 October 2026, on the same sample, which will say whether the share of policies that act is rising or falling.

Have your email run for you

Simafri has been the technical ally of businesses since 2002: we set up your professional email on your own domain name, with calendar, contacts and files, and we keep it running. Write to us and we'll look at your case together.