How common are email security gaps among the kind of businesses MSPs serve? We took a small, honest sample: professional firms in one US city, checked with the same public DNS lookups every mail server performs.
Results
| Finding | Firms | Share |
|---|---|---|
| No DMARC record | 41 of 64 | 64% |
| DMARC p=none (monitoring only) | 15 of 64 | 23% |
| DMARC p=quarantine | 6 of 64 | 9% |
| DMARC p=reject | 2 of 64 | 3% |
| No SPF record | 19 of 64 | 30% |
Put simply: 56 of 64 firms (87.5%) did not enforce DMARC, so email that pretends to come from them is not blocked by DMARC. Only 8 firms had a policy of quarantine or reject.
Method
- Sample: businesses tagged as lawyers, dentists or accountants with a website inside the city limits of Columbus, Ohio, in OpenStreetMap. That gave 65 entries and 64 unique domains (42 law, 20 dental and 3 accounting entries).
- Checks: a TXT lookup for each domain (SPF) and for
_dmarc.plus the domain (DMARC), through Cloudflare's public DNS-over-HTTPS resolver, on 18 October 2026. - Passive only: no systems were contacted beyond public DNS. No individual firms are named here.
Limitations
- It is a small sample from one city and three verticals, and OpenStreetMap's business coverage is incomplete. Treat the numbers as indicative, not as a national statistic.
- Some firms' websites use a different domain from their email, so a few "no DMARC" results may belong to website-only domains.
- DNS changes over time. These numbers describe one day.
What it means for MSPs
If two thirds of a vertical have no DMARC at all, you are not hunting for rare prospects. You can pick a vertical you already know, check 30 local firms, and expect most of them to have a concrete, explainable gap. The DMARC prospecting playbook shows how to turn that into a first meeting.
Want to see your own local market? A bulk check gives you the same picture for any list of domains in a few minutes.
Keep reading
MSP DMARC prospecting · 7 min read
How MSPs use DMARC gaps to book first meetings (with templates)
Find prospects with missing or weak DMARC, explain the risk in one sentence, and ask for 15 minutes. Templates included.
DMARC p=none vs reject · 5 min read
DMARC p=none vs quarantine vs reject, in plain English
What each DMARC policy does to fake email, and a safe path from p=none to p=reject.
SPF too many DNS lookups · 6 min read
The SPF 10-lookup limit: why adding one more email tool breaks it
Why SPF silently fails after a few include: entries, how to count lookups, and how to fix it without breaking mail.