The State of Email Security in Poland 2026
We scanned 66 of Poland's biggest companies. 27% can still be spoofed, twice the rate of the world's largest brands.
27%
of Poland's biggest companies can be spoofed
no enforced DMARC policy (p=none or missing)
<2%
deploy MTA-STS
the rest leave inbound mail unprotected in transit
36%
enforce p=reject
the strongest DMARC policy; two thirds stop short
58%
have no DKIM at common selectors
their messages are harder to authenticate
What we found
Poland lags the global leaders. 27% of its biggest companies can be spoofed (p=none or no DMARC), more than double the 13% we found among 107 of the world's best-known brands. Only 36% enforce the strongest policy, p=reject, against 66% globally.
DKIM and transport security are the biggest gaps. 58% of these companies publish no DKIM key at the selectors mail providers commonly check, and under 2% deploy MTA-STS. Both are records that can be fixed in a day.
The basics mostly work, but that is not enough. 94% have a valid SPF record and the average grade was an A. Yet a single gap anywhere in the chain still lets legitimate mail land in spam and leaves customers exposed to brand impersonation.
The takeaway
If Poland's biggest companies, with large IT teams, still leave these gaps, smaller organizations have more. Email authentication is not a one-time setup: records drift, providers change, and a single edit can undo years of work. The fix is to check regularly and enforce the strongest policy your senders allow.
How we measured this
In July 2026 we ran the SPFWise engine against 66 of Poland's biggest companies (Warsaw Stock Exchange listed firms and the largest consumer brands), using only their public DNS records. Every figure reflects exactly what a receiving mail server sees. No private data and no cooperation from the companies was involved.
Check your own domain
Get the same grade and the exact records to fix, free and in seconds.