India Email Authentication Census 2026: DMARC, SPF and BIMI at Banks, Insurers and the Nifty 100

Key numbers

1. Of 45 Indian public sector, private, small finance and payments banks scanned on 2026-10-04, 38 (84%) publish a DMARC policy of p=reject, and all 45 enforce DMARC at either reject or quarantine.
2. Of 113 scheduled commercial banks on the RBI list scanned on 2026-10-04 (including regional rural banks and the group domains of foreign banks), 74 (65%) publish p=reject and 5 (4%) publish no DMARC record at all.
3. The .bank.in web domains lag the banks' main email domains: of the 49 .bank.in domains the RBI lists for domestic commercial banks, scanned on 2026-10-04, 8 (16%) have no DMARC record, even though all 8 of those banks publish DMARC on their main email domain. Across all 93 .bank.in domains that resolve, 20 (22%) have no DMARC record.
4. Of 96 Nifty 100 companies scanned on 2026-10-04, 57 (59%) publish p=reject and 8 (8%) publish no DMARC record.
5. Of 60 insurers registered with IRDAI scanned on 2026-10-04, 34 (57%) publish p=reject, 22 (37%) stop at p=quarantine and 2 (3%) have no DMARC record.
6. Of 17 NBFCs in the RBI upper layer for 2026-27 scanned on 2026-10-04, 9 (53%) publish p=reject; 1 publishes a DMARC setup that mail receivers must ignore (two records on one domain).
7. Brand logos in the inbox are still rare outside private banks: on 2026-10-04, 13 of 18 private sector banks (72%) publish a BIMI record, against 2 of 12 public sector banks (17%) and 26 of 96 Nifty 100 companies (27%).
8. MTA-STS, which stops attackers from forcing mail in transit onto an unencrypted connection, is almost absent: on 2026-10-04, 1 of 45 domestic commercial banks, 3 of 96 Nifty 100 companies and 3 of 60 insurers publish it.
9. SPF is near universal but often soft: on 2026-10-04, 28 of 45 (62%) domestic commercial banks end their SPF record with a hard fail (-all) and 17 use a soft fail (~all). Among insurers the split is 27 hard fail and 30 soft fail out of 60.

DMARC by sector

"Listed" is the number of organisations on the official list. "Scanned" is the number whose domain we could verify; only these count in the percentages. "Broken record" means a DMARC setup receivers must ignore, such as two records on one domain. "Enforced" means p=reject or p=quarantine applied to 100% of mail.

SPF, BIMI, MTA-STS and DKIM by sector

The DKIM column is best effort: we looked for a key at five common selectors, and a domain can sign with a selector we did not try. Do not quote it as adoption.

The groups overlap on purpose. Banks, insurers and NBFCs that are also in the Nifty 100 appear in both their sector row and the Nifty 100 row. The .bank.in rows are a second view of the same banks, using the web domain the RBI links to rather than the main email domain.

Download the sector table (CSV)Sector rows only, no organisation names. Licensed CC BY 4.0.

What this means for a bank or insurer security team

• Finish the move to p=reject. Quarantine sends spoofed mail to the spam folder, where a customer can still find it and act on it. If your aggregate reports show every legitimate sender passing, going from quarantine to reject is a one-line DNS change. Among insurers, 22 of 60 stopped at quarantine.
• Put DMARC on every domain you own, starting with .bank.in. A domain with no DMARC record gives receivers no instruction to refuse mail that claims to come from it. A domain that never sends mail can carry p=reject and an SPF record of v=spf1 -all from day one.
• Keep reporting on. A rua address is how you see who is sending as you, including the vendor nobody told you about.
• Publish MTA-STS and TLS-RPT. They are two small DNS records and a policy file, and they stop a network attacker from quietly stripping encryption off mail sent to you.
• Add BIMI once you are at enforcement. BIMI only works with DMARC at quarantine or reject, and most large mailbox providers also want a mark certificate before they show the logo. A verified logo is a cue customers can check at a glance.
• Tighten SPF to -all once your reports are clean. With DMARC at reject a soft fail is not an open door, but a hard fail is clearer to receivers that do not apply DMARC.

None of this stops lookalike domains, which pass every check because the attacker owns them. That needs monitoring and takedown, covered by our DMARC+ and brand protection agents.

Email spoofing is one exposure class among several. To track it next to exposed assets, leaked credentials and supplier risk, see exposure management (UEMP) and our guide to continuous threat exposure management (CTEM).

Method

Limitations

• A snapshot. Records can change any day. Every figure is as of 2026-10-04.
• Policy is not protection. DMARC tells receivers what to do with mail that fails checks. It does not prove a domain is never spoofed, and it does nothing about lookalike domains.
• Unverified rows are excluded. 15 rows could not be verified and are not counted: 8 bank primary domains, 1 bank .bank.in domain, 2 insurers and 4 Nifty 100 companies. Most are sites that block automated requests, or a listed website domain with no MX where we could not tie a mail domain to the site.
• Parent and group domains. Foreign banks are scanned on their global group domain, so those rows describe the parent group, not an India-only setup. The same applies to Nifty 100 subsidiaries of global companies that use the parent's domain.
• One domain per organisation. Large groups send from several domains. A strong record on the main one does not mean every brand or subsidiary domain is covered.
• Shared domains. Some organisations share an email domain, and each one counts separately. In the Nifty 100, 96 scanned companies map to 89 distinct domains; among insurers, 60 map to 58.
• DKIM is best effort. Selectors cannot be listed through DNS. A domain with no key at our five selectors may still sign every message with another one.
• List coverage. The RBI page as fetched lists 5 payments banks; any bank missing from that page is missing here.
• Not mapped to regulation. We report what the DNS says, not whether any organisation meets a regulator's expectations.

We publish sector totals only. We have not named any organisation and will not.