Email at French SMBs: what their domain allows

Name: Email at French SMBs: operators, SPF and DMARC, monthly survey
Creator: Simafri
License: https://creativecommons.org/licenses/by/4.0/

Almost every one of these domains publishes an SPF record. This survey looks at the line after it: the policy that tells receiving servers what to do when the check fails.

Published on 3 September 2026, updated on 3 October 2026 By Simon Vasconcelos Lee 1,730 French SMB domains that receive mail, surveyed on 23 September 2026

96 %of domains publish an SPF record

71 %have no DMARC policy that acts on the result

28 %line both up: an SPF that decides and a policy that acts

Half the population publishes a policy that asks for nothing to be done

DMARC is the DNS line that tells the receiving server what to do with a message sent in the domain's name that fails the check. It takes three values, and one of the three is to do nothing.

Published policy	Domains	Share
No policy	355	21 %
p=none, do nothing	866	50 %
p=quarantine, set aside	274	16 %
p=reject, refuse	235	14 %

1,221 domains out of 1,730, or 71%, fall in the first two rows: the check happens, and its result leads to nothing. The last two rows hold 509 domains, 29% of the population.

From one survey to the next, on the same domains

A change can only be measured on the same domains. Of the 1,731 domains that received mail in the 3 September survey, 1,723 can be compared from one survey to the next: they still receive mail, and their DMARC policy reads without ambiguity. The comparison covers them alone, read on both sides by the same rules, set out in the method.

Across the same 1,723 domains	3 September 2026	23 September 2026
A DMARC policy that acts	29.3 %	29.5 %
of which p=reject, refuse	13.5 %	13.6 %
p=none, do nothing	49.9 %	50.3 %
No DMARC policy	20.8 %	20.2 %
An SPF record published	95.9 %	95.9 %
An SPF that decides and a policy that acts	28.4 %	28.6 %

1,701 domains publish exactly the same policy as in the previous survey. 10 have tightened it, 4 have relaxed it, and 8 that had none have published a p=none policy. No domain has withdrawn its policy.

The share of policies that act is rising, from 29.3% to 29.5%: tightenings outnumber relaxations, by a few domains per survey. The starting finding therefore holds: the DMARC policy is decided domain by domain, and 71% of domains have yet to make that decision.

SPF is everywhere, and on its own it decides nothing

SPF is the list of servers allowed to send in the domain's name. 96% of the domains surveyed publish one, which makes it one of the best established settings in the population. 38% end it with a strict qualifier, declaring every other server illegitimate, and 52% with a soft one, which flags the message without declaring it illegitimate.

Either way, SPF describes a situation, it asks for nothing. The DMARC policy is what carries the request, and it is the one missing or left at zero on 71% of domains. 493 domains, 28% of the population, publish both settings pointing the same way.

Why the two settings are read together

A domain that publishes an SPF record has made the first move: it has named its servers. That is the move an email provider offers during setup, and the 96% figure says it is almost always made.

The second move belongs to the domain and to it alone: saying what is expected of recipients. Publishing p=none explicitly asks for nothing to change in how mail is handled, which is useful while observing, and this survey does not say how long these policies have been in place.

That is what explains a population well equipped with SPF and thinly covered in practice, without assuming any neglect: the first move is offered by the tool, the second is decided.

Where these companies receive their mail

Operator	Domains	Share
Microsoft 365	460	27 %
Google Workspace	347	20 %
OVHcloud	240	14 %
Gandi	64	4 %
IONOS	50	3 %
Infomaniak	24	1 %
Other operators, widely scattered	386	22 %
Filtering gateway in front of the operator	159	9 %

The first two carry 47% of the population between them, and 22% of domains are spread across a large number of operators holding a few domains each. 159 domains, 9% of the population, route their incoming mail through a filtering gateway placed in front of their operator. The DMARC policy, for its part, does not follow the operator: across the three most common ones, the share of policies that act ranges from 13% to 34%.

Simafri Suite, plainly

Simafri Suite is your company's professional email on your own domain name, with calendar, contacts and files, set up and kept running by Simafri, which has been creating, hosting and maintaining the tools of businesses since 2012.

The SPF, DKIM and DMARC records are set up and kept current by Simafri.
The account is billed per company, with an unlimited number of users.
The domain name is registered in the customer's name, and can be transferred whenever they decide.
Mailboxes, calendar, contacts and files sit on the same account.

See the offer and prices

Method

Frame: the same 1,778 SMBs as the 1 September survey on WordPress, drawn from the Tranco list GQJJK, established on 31 August 2026, and qualified by the SIREN number published in their legal notices. The sample stays the same from one survey to the next, so the same domains can be followed over time.

Survey chain: for each domain, one MX query, one TXT query on the domain and one TXT query on _dmarc, made on 23 September 2026 against public DNS resolvers. A query left unanswered is replayed on another resolver, and every query received an answer. 1,730 domains out of 1,778 declare a mail server; the other 48 receive none and fall outside the percentages on this page.

What was read: the names of the declared mail servers, the final qualifier of the SPF record, and the value of p= in the DMARC record. A domain that publishes two DMARC records has no valid policy under the standard, and counts as such (7 domains). The operator is recognised from the name of the lowest-priority server that matches a known family. Since October, this list recognises six more filtering gateways, which September counted among the other operators.

What was not read: no message, no mailbox, no header. DNS is public and is read without touching the domain, three queries per company.

Scope: DKIM cannot be surveyed from the outside, its selector not being published at a fixed place, so it does not appear here. A policy set on a subdomain is not followed either. The frame being a list of the most visited domains, the smallest organisations are under-represented in it, and the share of domains without a policy is probably lower here than across the wider economy. A change is read on the domains present in two successive surveys: a domain that no longer receives mail, or that publishes two contradictory policies, leaves the comparison.

Data and reuse

Each survey is published in full, one row per company, with its domain, its SIREN number, its headcount band, the recognised operator, the SPF qualifier, the DMARC policy and the declared mail servers. These figures may be reused with attribution to Simafri and a link to this page.

Download the 23 September 2026 survey (CSV)

Download the 3 September 2026 survey (CSV)

Next survey planned for 3 November 2026, on the same sample, which will show whether the rise is confirmed.

Have your email run for you

Simafri has been the technical ally of businesses since 2012: we set up your professional email on your own domain name, with calendar, contacts and files, and we keep it running. Write to us and we'll look at your case together.