ZeroHook Research
Hungary
Edition 2026-10 2026-10
First edition93.6%of the domains we measured in Hungary do not publish a DMARC policy that rejects mail failing DMARC.
6.4% publish the policy that tells receivers to reject mail failing DMARC: p=reject with pct=100. We read the public DNS of 861 domains across nine sectors with at least 30 domains. 445 publish no DMARC record at all.
What we measured
920 domains scanned on 30 October 2026 through a local caching resolver. Public DNS only: SPF, DMARC, DKIM at 16 common selectors, DNSSEC, MX, NS, CAA, MTA-STS TXT, TLS-RPT TXT, BIMI TXT and DNSBL. No SMTP, HTTP, AXFR or open-resolver probe.
The aggregate covers 861 legal-entity companies. It is a Wikidata-derived sample, not a census, and over-represents domains with an official website.
DMARC full protection
6.4%
p=reject and pct=100. Only this policy tells a receiver to refuse mail failing DMARC.
n=853 measured · 8 not measured
SPF valid
74.6%
One valid record, with no more than ten DNS-querying mechanisms.
n=850 measured · 11 not measured
DKIM at common selectors
43.9%
A key found at one of sixteen common selectors. A lower bound, not a census.
n=852 measured · 9 not measured
DNSSEC validated
9.3%
DS-anchored DNSKEY and answer signature verified against the zone's own key.
n=837 measured · 24 not measured
The gap by sector
DMARC full protection, ranked
Bars are the share of measured domains in each sector with at least 30 domains. Sectors below that threshold are excluded from the breakdowns. Banking and insurance leads 24.3%. The largest group: Research and universities (n=233), 2.6%.
Banking and insurance
n=38
24.3%
1 not measured
Manufacturing
n=81
9.9%
Healthcare
n=93
8.6%
Digital infrastructure and ICT
n=67
7.7%
2 not measured
Media
n=172
5.9%
2 not measured
Food production
n=39
5.1%
Transport
n=85
4.7%
Energy
n=34
2.9%
Research and universities
n=233
2.6%
2 not measured
Only sectors with at least 30 measured domains appear in the breakdowns.
Where the failure sits
One table, six checks
Every cell is the share of measured domains passing that check. The number is printed, so colour is never the only signal.
| Sector | n | DMARC nm | DMARC | SPF | DKIM | DNSSEC | MTA-STS | TLS-RPT |
|---|---|---|---|---|---|---|---|---|
| Research and universities | 233 | 2 | 2.6% | 66.2% | 39.7% | 4.4% | 0.4% | 0.9% |
| Media | 172 | 2 | 5.9% | 74.9% | 44.1% | 10.9% | 0.6% | 0.6% |
| Healthcare | 93 | 0 | 8.6% | 87.1% | 57.0% | 15.6% | 3.2% | 5.4% |
| Transport | 85 | 0 | 4.7% | 61.2% | 35.3% | 12.2% | 1.2% | 1.2% |
| Manufacturing | 81 | 0 | 9.9% | 86.4% | 46.9% | 6.2% | 0.0% | 0.0% |
| Digital infrastructure and ICT | 67 | 2 | 7.7% | 76.6% | 53.8% | 7.8% | 1.5% | 1.5% |
| Food production | 39 | 0 | 5.1% | 79.5% | 38.5% | 10.3% | 2.6% | 2.6% |
| Banking and insurance | 38 | 1 | 24.3% | 78.9% | 44.7% | 21.1% | 2.7% | 2.8% |
| Energy | 34 | 0 | 2.9% | 76.5% | 32.4% | 3.0% | 2.9% | 2.9% |
Domain-level results
The aggregate is public. The rows are not.
The domain-level table is being prepared. The rows below are placeholders, not domains from the sample.
Coming soon: domain-level results are being prepared.
Placeholder rows only. No domain from the dataset is shown.
The policy gap
445 domains have no DMARC record. 240 have one that only monitors.
A p=none record collects reports but does not tell a receiver to block or quarantine a failing message. It is a useful first step and not a shield.
Reject
55(6.4%)
Quarantine
113(13.1%)
p=none
240(27.9%)
No record
445(51.7%)
Not measured
8(0.9%)
Country comparison
This is the first edition, so there is no prior Hungarian series and no cross-country cut in this file. The schema carries a comparison field and the page renders it when an earlier edition exists.
Geography
County-level attribution was not collected. The sample is national and the page makes no regional claim.
Positive Hall of Fame
No entity is named in this edition.
The index publishes aggregates only. A positive Hall of Fame opens with written opt-in from an entity that passes every measured check, and only after it has seen its own row. There is no worst list and no logo wall.
Verify our numbers
Every rate is bound to a hash and a timestamp.
The dataset, the scan output and the aggregated report are hashed with SHA-256 and the manifest is timestamped by FreeTSA. Recompute the hash from the files and check the token with any RFC 3161 tool.
- Manifest SHA-256
- 4717cf53c2222a648b6fcd5fe1dd65704e0c22e03c2609aad1a2414328ebe528
- Timestamp
- Nov 1 17:18:10 2026 GMT
- Serial
- 0x09A16F3F
Token chain verified
Your domain
The national number is not your number.
Check the public DMARC record for one domain. It takes a few seconds and does not need an account.
Press and social
Free to quote with the edition and the sample size.