Datahorses data report · summary
Email security of Slovak companies 2026
Almost half of Slovak companies give receiving mail servers no instruction on what to do with mail that impersonates them. We analyzed the email DNS records of 8,177 Slovak companies to see how well they are protected against sender spoofing.
Key findings
46.5%
of companies publish no DMARC record at all, so receivers get no instruction on what to do with spoofed mail.
21.7%
enforce DMARC (quarantine or reject).
20.6%
are protected against sender spoofing: strict SPF together with an enforced DMARC policy.
32.9%
end their SPF record with a neutral ?all, which tells receivers nothing.
0.4%
publish MTA-STS to protect mail in transit.
36.7%
have the DNS records Gmail, Yahoo and Microsoft require from bulk senders (lower bound).
Strict SPF is common among companies on Microsoft 365 (97.9%), because Microsoft sets it up, but only 25.6% of them enforce DMARC, which the company has to add itself. Enforcement grows with company size, yet even among large companies (250 employees and more) it stays below half.
p=none (monitoring only)
31.5% (2,575)
p=quarantine (to spam)
10.5% (862)
p=reject (refuse)
11.2% (916)
Gmail, Yahoo and Microsoft requirements
Since February 2024 Gmail and Yahoo require bulk senders to publish SPF, DKIM and DMARC. Since May 5, 2025 Outlook.com, Hotmail and Live reject mail from senders of more than 5,000 messages a day that fail these checks with error 550 5.7.515. We confirmed the DNS part of these requirements for 36.7% of Slovak companies (a lower bound, because DKIM selectors cannot be listed from DNS). Most Slovak companies do not send in bulk, but the requirements show where the common standard is going.
Method
We analyzed the DNS records that domains publish for mail delivery (MX, SPF, DMARC, DKIM under 9 common selectors, DNSSEC, MTA-STS and TLS-RPT) on October 30 and 31, 2026. We did not connect to company servers and did not access their systems. The sample covers companies from the register of the Statistical Office of the Slovak Republic whose domain we verified, either because the company website shows its company ID or because the organization lists the domain in the Slovak public procurement journal. The sample is not random and is not weighted; companies that look after their website are likely to be better protected than average. Only aggregated shares are published, no company names or domains, and groups of fewer than 30 companies are not shown separately.
The full report in Slovak, with tables by company size, industry, region and mail provider, the legal context (Slovak Act 366/2024 transposing NIS2 and NBÚ Decree 227/2025) and all limitations, is at datahorses.com/sk/sprava-posta-2026/.
Citation and license
The report and data are licensed under Creative Commons Attribution 4.0 (CC BY 4.0). Please cite:
Datahorses, Stav zabezpečenia pošty slovenských firiem 2026 (Email security of Slovak companies 2026), https://datahorses.com/sk/sprava-posta-2026/