We scanned every Y Combinator company. 60.5% can be email-spoofed.

Published by notspoofed.com — August 14, 2026. Re-scanned in full on September 3, 2026; every figure below is from the September run, and what moved in between has its own section.

Email spoofing is still one of the cheapest ways to impersonate a company. A domain is protected only if it publishes a DMARC record set to enforce — p=quarantine or p=reject. Without that, anyone can send mail that appears to come from the company's exact address, and receiving servers will deliver it.

So we checked every company in the Y Combinator directory. Here's what we found.

The headline

Of 6,049 YC companies whose DMARC status we could resolve conclusively, 3,657 (60.5%) can be spoofed — they publish no DMARC record at all, or a DMARC policy of p=none, which only monitors and still lets forged mail through. 2,392 (39.5%) are at enforcement.

The split inside that spoofable group is close to even: 1,733 publish no DMARC record whatsoever, and 1,924 publish p=none. On the protected side, 1,358 are at quarantine and 1,034 at reject.

We pulled 6,157 unique company domains in total. Ten were dropped because the directory pointed them at somebody else's DNS — an app-store listing, a Crunchbase profile, a hosting subdomain — leaving 6,147. Of those, 98 did not return a conclusive DNS answer after three attempts and are excluded from every percentage on this page rather than being counted either way.

Method in one line: we read each domain's public _dmarc DNS record. Spoofable = no DMARC or p=none. No email was sent and nothing was actually spoofed — it's the same public check notspoofed.com runs on one domain at a time.

Three weeks later: what moved

We first ran this scan on August 14, 2026, when the figure was 61.0%. Re-running it on September 3 gives a rare look at how fast this actually changes. Restricting to the 5,959 domains that were conclusively classified in both runs, so directory churn doesn't confound the comparison:

• 56 companies moved to enforcement. 29 went from p=none to quarantine, 6 from p=none straight to reject, and 21 published their first DMARC record already at enforcement.
• 16 went the other way. They were at quarantine or reject in August and are at p=none or have no record at all today — three of them had been at reject. Protection is a DNS record, and DNS records get edited.
• Net, the stable cohort went from 60.9% to 60.2% spoofable: 0.7 points in 20 days.
• 82 companies were new to the directory, almost all from the Summer and Fall 2026 batches. 75.6% of them are spoofable — the newest arrivals are materially worse than the population they join, which is what you'd expect if enforcement happens by decision rather than by default.
• Every domain whose verdict changed was re-verified against two independent public resolvers and, where those disagreed, against the domain's authoritative nameserver. One row was corrected on that basis; the audit trail itemises it. The full list of changed domains is published with the dataset.

The five companies named below as not yet at enforcement were re-checked on September 3. None had changed.

The finding we didn't expect: it isn't a new-company problem

Going in, we assumed the exposure would be concentrated in the newest batches — young teams that simply haven't gotten to email security yet. The data says otherwise. Once you exclude domains that no longer receive mail at all, the spoofable rate is essentially flat across fifteen years of YC batches:

The last column restricts to domains that publish MX records — companies actually running email today. Read down it:

A company from the 2024–2026 batches is no more likely to be spoofable than one from 2011–2015. DMARC enforcement is not something startups drift into as they mature. Absent a deliberate decision, it doesn't happen at all.

The earliest era, 2005–2010, sits higher at 74.3%, but we'd treat that as directional rather than a finding: it covers just 194 companies in total — 9 to 61 per year — and the individual years swing between 72% and 88%, which is what samples that small do. The claim the data actually supports is the flat line from 2011 onward. What the early era does contain is a large share of domains whose companies no longer exist, which points at a separate result.

Abandoned domains are the most spoofable of all

Of the 531 classified domains publishing no MX records — no live mail, typically a company that exited or shut down — 88.3% are spoofable, against 57.8% for domains with live mail.

These are the quietest risk in the dataset. An acquired startup's old domain still carries brand recognition with its former customers, still passes a casual eye test in an inbox, and has nobody monitoring it. If you've wound a company down and still own the domain, publishing v=DMARC1; p=reject; on it costs nothing and closes the door permanently.

SPF is giving people false confidence

82.3% of the domains we scanned publish an SPF record. Among the spoofable domains, 73.1% publish SPF.

That gap is the single most useful takeaway here. Nearly three-quarters of the companies that can be spoofed have already done the piece of email authentication that feels like the fix — and SPF alone does not stop the attack people actually care about. SPF validates the hidden envelope sender, not the From: header your recipient sees. Without a DMARC policy at enforcement, a forged message showing your exact address still lands in the inbox. A lot of these teams believe this is handled.

By industry

Fintech and B2B lead, which tracks — both tend to face compliance pressure and enterprise security reviews that put DMARC on the checklist. Consumer is the laggard at 74.2%, and it's arguably the worst place for it: consumer brands have large, non-technical user bases who have no way to tell a forged support@ message from a real one. Healthcare at 67.2% is a close second concern for the same reason.

The well-known names mostly get it right

To sanity-check the scanner, we separately checked 21 of the best-known YC alumni by hand before the first full run. 20 of 21 — Stripe, Airbnb, Coinbase, DoorDash, Dropbox, Reddit, Zapier, Supabase and others — are at quarantine or reject. The single exception was Warp, the terminal company, at p=none, and it still is. Fifteen of those 21 appear in the directory under the same domain we checked by hand, and both full scans returned an identical verdict for all fifteen; the other six are listed under a different domain or not listed at all, so there was nothing to compare.

Scale and technical maturity clearly correlate with enforcement. But note what the batch table above says: it isn't age that gets companies there. It's someone deciding to do it.

A few companies not yet at enforcement

These are established, active YC companies whose domains were at p=none or had no DMARC record when we scanned, each re-verified against two independent DNS resolvers before publishing and again on September 3. This is not a wall of shame — and the detail worth noticing is that four of the five have already started: they publish a rua= reporting address, meaning someone deliberately set up DMARC monitoring and is collecting data. That's the correct first move. The rollout just hasn't reached enforcement yet, which is where the protection actually begins.

• Rappi (W16, on-demand delivery, LatAm) — p=none, with aggregate reports going to an internal safemailgroup@ address. Monitoring is live; the policy isn't.
• GrubMarket (W15, food supply chain) — no DMARC record published. Live mail on Google Workspace, so a monitoring record is a few minutes of work.
• Nowports (W19, LatAm logistics) — p=none with both aggregate and forensic reporting configured to a cyber-sysadmin@ address. This is a team clearly working the problem.
• SmartAsset (S12, personal finance marketplace) — p=none, with sp=none set explicitly for subdomains and full rua/ruf reporting.
• Bellabeat (W14, women's wellness hardware) — p=none, no reporting address configured.

If you're at any of these companies: the next step is the same one for all of you, and we'd be glad to help — no pitch, just the DNS record.

If your domain is on the wrong side of this

1. Check it in 5 seconds: notspoofed.com.
2. If you have no DMARC, publish a monitoring record first: v=DMARC1; p=none; rua=mailto:you@yourdomain.com and watch the reports.
3. Once your legitimate mail passes, move to p=quarantine, then p=reject. That last step is the one that actually stops spoofing.

Step 3 is the whole ballgame. Based on this data, 1,924 YC companies have done steps 1 and 2 and stopped — they are sitting at p=none, collecting reports nobody may be reading, with the same exposure as the companies that did nothing.