Email spoofing in Belgium: can anyone send mail as your business?

Out of 25,813 Belgian small business domains that receive mail, only 13.5 percent were set up in November 2026 to have a forged sender blocked. The other 86.5 percent leave the door open: anyone can send a message that shows the company's own address, and the customer's inbox will usually deliver it. We measured 31,123 domains across every sector and province.

How a forged sender gets through

Every email carries two sender addresses. One is handed to the receiving server during delivery. The other is the From line your reader sees, and nothing in the mail protocol stops someone from typing any address there, much like the return address on a paper envelope. Putting a real company's address in that line is email spoofing. Nobody breaks into the company's mailbox; the name is simply borrowed.

Three DNS records let a domain owner state who may send on its behalf. Together they are known as SPF, DKIM and DMARC:

• SPFis a list of servers allowed to send for the domain.
• DKIMadds a cryptographic signature to each message, checked against a public key published in DNS.
• DMARCtells the receiver how to treat a message that fails those checks: nothing (p=none), route it to spam or quarantine (p=quarantine), or refuse it (p=reject).

A forged message is only stopped once DMARC asks for quarantine or reject. At p=none the owner receives reports while the fake message still arrives. This study therefore counts a domain as protected only at quarantine or reject, the same line DNS Belgium, the registry behind .be, draws in its email security reports. You can see what your own domain publishes with our free DMARC checker.

Most DMARC records only watch

On 5 November 2026, 47.9 percent of the 25,813 domains with mail published a DMARC record. That sounds better than it is. 71.5 percent of the valid records sit at p=none, which blocks nothing. Quarantine accounts for 7.9 percent of all domains with mail and reject for 5.6 percent, adding up to 13.5 percent: about one domain in 7.

SPF is far more common, at 82.8 percent, and 75.4 percent of domains with mail have one that is technically sound. On its own, though, SPF does not stop spoofing. It checks the delivering server against the envelope address, not against the From line people read. Without DMARC, each receiver decides alone what a failed check means, and many deliver anyway. 15.5 percent of the domains with mail had neither SPF nor DMARC.

DKIM is harder to count because owners choose the key name. Looking under the defaults of the large providers and a handful of common names, we found a key for 29.0 percent of domains with mail; the real figure is higher. All three in place, with DMARC enforcing, applied to 8.3 percent.

Why do so many domains stop at p=none? Moving to reject means knowing every system that sends mail in the company's name: the mailbox, the website, accounting software, the newsletter tool, a booking system. Owners who never map those senders hold back, afraid their own invoices will bounce. A DMARC record at p=none with no report address then mostly records that somebody once started. Among valid DMARC records, 57.9 percent had no address for reports at all.

Where your mail lands matters

The MX record shows where a domain's inbound mail is handled, and from that we can tell which provider runs the mailbox. The gaps between providers are large, and largest for SPF.

Among domains whose mail arrives at Microsoft 365, 21.4 percent blocked forged senders. Google Workspace domains reached 11.6 percent and domains on a hosting package or other provider 9.1 percent. The small group behind a dedicated security gateway scored highest at 36.2 percent, though businesses that buy such a gateway already care about security, so this tells us about who chooses the service as much as about the service.

SPF shows the widest spread. Microsoft 365 asks for an SPF record when a custom domain is connected, and 93.6 percent of its domains have a valid one. On hosting packages the figure is 65.9 percent, and 23.7 percent publish neither SPF nor DMARC. With such packages much depends on what the host puts in DNS by default, and for nearly a quarter that stopped at an MX record with no sender check at all.

None of the large providers switch DMARC on for you. Microsoft states there is no admin portal for DMARC on custom domains; the record is created at the registrar or DNS host, and Google gives the same instruction for Workspace. Whoever manages your DNS is the person who turns protection on. If that is unclear, look at the invoice for your domain name or the contract with your web agency; our page on website maintenance explains who usually holds which keys.

Sector by sector

We sorted the domains into seven sectors based on the type of business recorded in OpenStreetMap. Business services such as accountants, lawyers and insurance brokers lead clearly at 30.5 percent. Hospitality comes last at 8.9 percent. The remaining five sectors sit close together, between 11.9 and 14.3 percent.

Part of this follows the choice of provider: 53.5 percent of business service domains receive mail through Microsoft 365, against 17.6 percent in hospitality. Yet a gap remains within the same provider. On hosting packages, 18.9 percent of business services (970 domains) block forged mail, compared with 7.5 percent of hospitality businesses (5,983 domains). On Microsoft 365 the split is 34.3 against 14.3 percent.

For an accounting firm, a spoofed message announcing new bank details is the textbook invoice fraud. Our data cannot say why the sector does better; an IT partner who looks after DMARC is one plausible reason. A restaurant sends booking confirmations, gift vouchers and reminders, frequently through a reservation platform that mails in the restaurant's name. That means more senders to configure. Our page on restaurant websites covers what to check when a new site goes live, and the one on websites for accountants covers the client-facing side.

Regions and provinces

Provinces differ less than sectors. Among provinces with at least 100 domains with mail, Liège ranks highest (16.9 percent of 1,729) and Luxembourg lowest (11.3 percent of 707). By region, Flanders reaches 12.8 percent, Wallonia 14.8 percent and Brussels 15.9 percent, within 5 points of each other, which we treat as roughly equal.

One pattern stands out. Flanders has the largest share of domains on Microsoft 365 (32.2 percent, against 22.6 percent in Wallonia and 21.6 percent in Brussels), yet not the highest protection rate, so provider and protection do not move together across the country. Ghent, which we studied separately in October, comes in at 13.1 percent of 1,413 domains with mail, close to the national figure. That earlier study of Ghent business websites looked at search visibility rather than mail.

Common configuration mistakes

Publishing a record and publishing one that works are two different things. These are the errors we came across most:

Two SPF records on one domain is the classic case: someone adds a second line for a newsletter tool instead of extending the first, and receivers then treat both as an error. An SPF record ending in ?all or +all effectively allows any server to send. A DMARC record without a report address leaves the owner blind to who is sending in their name, which is why such domains rarely move on to reject.

Fraudsters are not the only ones affected. Conflicting records also push a company's own newsletters and quotes into spam; the common causes are covered in why are my emails going to spam.

Domains that never send mail

Of the 28,331 domains with a usable answer, 2,518 receive no mail: they have no MX record, or a null MX that states outright that no mail is accepted. Such a domain can still appear as the sender of a fake message. Microsoft advises SPF set to v=spf1 -all and DMARC at p=reject for domains that never send. 50 domains, or 2.0 percent, had done both.

The same goes for secondary names: the brand under another extension, a pre-merger name, a typo registered defensively. Our guide on choosing a domain name helps with picking and budgeting such names, and when moving a domain to another provider, bring the mail records along, as explained in transferring a domain name.

Comparison with October

Our October 2026 study checked mail records on 427 working small business websites: 79.9 percent had SPF, 44.3 percent DMARC and 12.4 percent a DMARC record that blocks forged mail. This study is far wider. Restricting it to the 23,657 domains with a working website, the closest match to the October group, gives 78.2 percent SPF, 46.1 percent DMARC and 12.7 percent protection. Two weeks is too short to show a trend, but with a denominator fifty times larger the numbers now rest on much firmer ground.

Whether the website itself works makes little difference to mail: 13.3 percent of domains with a working site block forged senders, against 14.8 percent of those without one. The extension does show a gap, though it says nothing about cause: .be domains reach 12.1 percent (22,058 domains) and .com domains 20.9 percent (2,750 domains).

Why mailbox providers now care

Since 2024, Gmail and Yahoo require every sender to pass at least SPF or DKIM. Above 5,000 daily messages to Gmail, Google wants all three records, DMARC included. Microsoft followed: from 5 May 2025, Outlook.com sends mail from such high-volume senders to Junk when the records are missing. Few small firms reach that volume, but the newsletter platform they use does, and it will ask for a properly set up domain. Our email marketing strategy guide and the post on how to write a newsletter cover the rest of the work.

In Belgium the subject reached the policy agenda as well. On 11 December 2025, DNS Belgium and the Centre for Cybersecurity Belgium (CCB) published joint DNS guidelines that name SPF, DKIM and DMARC as a defence against email fraud. Febelfin, the Belgian banking federation, put losses from phishing at 93 million euros for 2025, and part of that fraud relies on messages that appear to come from a known sender.

What does this mean for your business?

Someone sending mail in your name damages trust with customers and suppliers, often before you notice. Domain spoofing protection takes these steps, usually spread over a few weeks:

1. See what your domain publishes today. Enter it in our DMARC checker to view SPF and DMARC and what they ask of receivers.
2. List every system that sends as you. Mailbox, website contact form, accounting or invoicing software, newsletter platform, booking or point-of-sale system. Website forms are easy to forget; stopping contact form spam covers them.
3. Publish one SPF record covering all of them, ending in ~all or -all. One record, never two.
4. Turn on DKIM in each service. In Microsoft 365, Google Workspace and most newsletter tools this means a switch plus two DNS records.
5. Start DMARC at p=none, have reports sent to an address you watch, and follow them for several weeks. Fix any legitimate sender that fails.
6. Move to quarantine, then to reject. Only now are forged messages actually stopped.
7. Protect domains that never send with v=spf1 -all and DMARC at p=reject.

If a supplier emails new bank details, call them on the number you already had. Business-to-business invoices in Belgium have had to be structured e-invoices since January 2026, mostly sent over Peppol, so a real invoice should no longer arrive as a mail attachment. Our Peppol statistics for Belgium show how far small firms have come.

For anyone sending newsletters or campaigns, these records belong to the basics, just like a clean list. Our email marketing service sets them up as part of the work, and if you pick a platform yourself, start with our overview of Mailchimp alternatives.

How we measured

The population was every one of the 31,123 Belgian small business domains with a website listed in OpenStreetMap, the same source as our October study. On 5 November 2026 we looked up MX, TXT and DMARC records for each, and DKIM keys under common names. No mail was sent and no website was opened. 2,654 domains had lapsed and 138 gave no usable answer; they are left out.

Every detector was checked by hand on 50 random domains, queried again through another resolver and judged with separately written rules. The provider label matched in 50 of 50 cases, SPF in 50 of 50, DMARC in 50 of 50 and DKIM in 49 of 50. For DKIM we also sampled 300 domains where DNS reports that nothing exists under _domainkey and found a key in 19 of them.

DNS records state what a domain requests, not how every receiving server behaves. Businesses mailing only from free webmail addresses have no domain to protect and are not covered. The DKIM figure is a floor. For the comparison between working and broken websites, 532 sites behind a bot check drop out, since we did not try to get past it. Counts by sector, province and provider are attached as a CSV without any domain names.