Research
Can They Email As Me? periodically publishes aggregate, de-identified research on email authentication adoption across Australian organisations — never a directory of individual domains and their weaknesses.
Snapshot as of 2026-09-23 08:00 UTC (3 hours ago) · refreshed every few hours, not live · counts each distinct domain once, using its most recent completed check.
Domains checked
25
Distinct domains with at least one completed check.
Publish an SPF record
72%
18 of 25 domains.
Publish a DMARC record
72%
18 of 25 domains.
DMARC set to enforce
48%
Policy is quarantine or reject, not just monitoring (p=none).
Detectable DKIM signing
0%
Best-effort only — DKIM selectors aren't discoverable without sending mail, so this understates real adoption.
SPF + enforcing DMARC together
40%
The combination that meaningfully blocks email spoofing of the domain.
These figures come from domains people have voluntarily checked with this tool — not a random or representative sample of Australian organisations — so they describe this tool's userbase, not the whole economy.
A deeper study — methodology, limitations, versioned data files — will be linked here once published.