The Half-Locked Door: India's MSME Email Authentication Gap, Measured

What this study measured, and what it deliberately does not claim

Over August 2026, Raveneye Global's field study measured eight local service trades, chartered accountant, dentist, gym, interior designer, digital marketing agency, coaching institute, physiotherapist, and wedding photographer, across six ordinary, non-metro Indian cities: Jaipur, Indore, Lucknow, Surat, Kochi, and Nagpur. The underlying data came from live APIs, Google Search results and AI Overview data, Google Places, Google Ads search volume, the Google Knowledge Graph, Google PageSpeed Insights, and direct DNS lookups, run against the same set of businesses that appeared ranking for local searches across the wider study. This piece is one cut of that dataset, and it asks a single, narrow, machine-checkable question: does the domain a locally ranking business sends its email from actually declare who is allowed to send mail on its behalf, and does it tell a receiving mail server what to do when someone else tries anyway.

The businesses examined here are the same ninety-six whose domains surfaced ranking in the wider study. Seventy-nine of those ninety-six resolved cleanly enough under a direct DNS lookup to be analyzed for email authentication; the other seventeen returned no usable DNS response at all, ordinarily a sign that the domain had lapsed, was misconfigured, or was never genuinely the business's own registered property in the first place. Every figure that follows describes those seventy-nine domains unless stated otherwise, and every figure carries that sample size beside it, because seventy-nine is a real but modest number and none of what follows should be read as a national statistic.

State plainly, before a single number appears, what this measurement is not. SPF and DMARC are not a Google ranking factor. Google has never listed either protocol in its published ranking documentation, and nothing in this study tests, implies, or claims that a business's search or AI Overview placement depends on its email configuration. What the two protocols measure is narrower and, for a different reason, still useful: whether a business has done the unglamorous, invisible work of configuring its own domain correctly. That is a deliverability control, a fraud-prevention control, and, read across many domains at once, a proxy for whether a business's digital operations were set up with attention or simply left at whatever default a hosting provider happened to ship.

This narrow focus is deliberate. The wider field study already examines whether these businesses show up in a local search or an AI Overview at all; this piece assumes a business has already cleared that bar. Every domain measured here is one that surfaced ranking for a real local query, so the population is, if anything, a survivorship-biased best case rather than a representative cross-section of all MSMEs. Email authentication was chosen as a separate cut precisely because it sits outside the visibility question entirely: a business can rank perfectly and still leave its own domain open to impersonation, and the two facts, whether an engine finds a business and whether that business's own infrastructure is configured correctly, turn out to be close to independent of each other in this sample.

A method note: why the first measurement was discarded

The first pass at this measurement did not use a direct DNS lookup. It used an off-the-shelf, open-source email-security scanning tool of the kind built to return a fast, plain-language verdict on a domain's authentication posture: protected, weak, or critical. Run across the sample, that tool returned a discouraging picture, with a large share of domains coming back flagged as having no SPF or DMARC records at all, several marked with the tool's own worst label, critical.

That picture did not survive a spot check against the underlying DNS. Justdial.com, one of the largest and most technically resourced properties anywhere in the sample, came back flagged by the tool as missing records it in fact publishes; a direct query showed a valid SPF record and a configured DMARC policy sitting in the domain's own DNS the entire time. A chartered-accountancy firm elsewhere in the sample was flagged the identical way, and it too, on direct inspection, published both records. Two confirmed false negatives inside a spot check of a few dozen domains is not a rounding error in a tool meant to check exactly two things, and a tool that misses the two things it exists to verify cannot be trusted for the ninety-plus domains it graded without a second, independent look.

The tool's output was discarded in full, and the measurement was rebuilt from the DNS record itself. Every figure in this piece comes from a direct DNS-over-HTTPS query against Google's own public resolver, dns.google, requesting the TXT records on each domain's apex for SPF (the record beginning v=spf1) and on the domain's _dmarc subdomain for DMARC, with the resulting policy tag parsed directly rather than summarized by a third party. That method is slower than trusting a packaged tool's headline verdict, and it is the only version of this measurement worth publishing under Raveneye Global's own name.

What SPF and DMARC actually check

Both standards live inside the domain's own public DNS, as plain-text TXT records that anyone, a competitor, a customer, an AI crawler, can look up without permission. Both exist to answer a version of the same underlying question: when a message claims to come from a given domain, is that claim actually true. They answer it differently, and a domain can have one without the other, which is precisely what most of the domains measured here do.

The measured gap, domain by domain

Layered together, the seventy-nine domains split into a rough hierarchy of effort, and the hierarchy itself is the finding. SPF is close to a default: 83.5% of the seventy-nine publish a valid SPF record, the lighter of the two controls to configure and, on many hosting platforms and website builders common among small businesses, closer to a checkbox than a technical project. DMARC is closer to a coin flip: 49.4% of the same seventy-nine domains, thirty-nine of them, publish any DMARC record at all, which means the remaining 50.6% have made no move toward the newer, more capable standard whatsoever.

The more telling number sits inside that thirty-nine. Among the domains that did take the second step and publish a DMARC record, the policy actually set breaks down as follows:

• p=none, monitor only, no protection: 30 of the 39 domains, the clear majority of anyone who has gone this far.
• p=quarantine, failing mail routed to spam: 6 of the 39 domains.
• p=reject, failing mail refused outright: 3 of the 39 domains.

What p=none actually buys a business

It would be unfair to describe p=none as pointless, and this study does not make that claim. It is, by the standard's own design, the correct first move: a domain owner who has never configured DMARC before is expected to start in monitor mode, read several weeks of aggregate reports, confirm that every legitimate system the business actually uses to send mail, its own office account, an invoicing tool, a booking or scheduling platform, an accountant's practice-management software, is passing alignment cleanly, and only then advance the policy forward. Thirty of the thirty-nine domains with any DMARC record in this sample, roughly three in four of them, are sitting at exactly that starting point.

What the data cannot show is whether that three-in-four is still in progress or has simply stopped moving. A domain owner who set p=none eighteen months ago and never returned to the setting looks, from outside, identical to one who set it eighteen days ago and is still actively reading reports; a single DNS lookup, run once, cannot distinguish patience from abandonment. What is measurable, and what matters more for the purpose of this study, is the outcome rather than the intent. A p=none record protects no one. A forged invoice, sent from a look-alike server using a real MSME's real domain name, passes through a receiving inbox exactly as easily with p=none set as it would through a domain carrying no DMARC record at all. Reading a DMARC report every week and never advancing the policy produces, in practice, the identical level of protection as never having set one up.

How the gap compares, with two real caveats

This study also pulled a contrast set: seventeen resolvable domains belonging to larger chains and aggregators operating across the same eight trades, rather than single-location MSMEs. DMARC enforcement in that set runs to 47%, roughly four times the MSME enforcement rate of 11.4%. Read this directionally rather than precisely. Seventeen domains is a small and mixed group, spanning national chains with a dedicated IT function and regional aggregators that may or may not have one, and the set was never built or sized to support a confident point estimate. What it does support is a plausible ordering: bigger, more resourced operations enforce DMARC at a meaningfully higher rate than the MSME domains in this sample, not a precise, load-bearing multiple.

A second, external comparison point sits entirely outside this study. EasyDMARC's 2026 DMARC Adoption and Enforcement Report, an industry analysis of 1.8 million of the world's most-visited domains, a very different population from a locally ranking Indian MSME, found 52.1% of that set publishing a valid DMARC record, a rate close to this study's 49.4% among MSME domains. The two populations diverge sharply past that point. Among the global domains that do publish a record, roughly 44% have moved to an enforcing policy, against roughly 23% among the MSME domains that took the same step in this study, meaning the MSME domains that started the DMARC process finish it at something close to half the rate the world's most-visited sites do. Fortune 500 domains, tracked separately in the same report, show 95% DMARC adoption with more than 80% of adopters already enforcing, the version of this picture that follows when a dedicated security team, rather than a small business's contract web developer, owns the domain. The same report's Inc. 5000 figures sit closer to this study's own numbers than the Fortune 500 figures do: among the fast-growing mid-size American companies on that list, 4,066 held a valid DMARC record, but more than half of those remained at p=none, the same stalling point found among the MSME domains in this sample, which suggests the gap between adopting DMARC and finishing it is not unique to India, or to businesses without a dedicated security budget.

Why the pressure to finish the job is weaker for a five-person firm

Some of this gap has a structural explanation rather than a mysterious one. Since February 1, 2024, Google has required any sender pushing more than 5,000 messages a day to Gmail addresses to publish SPF and DKIM, plus at least a DMARC record at p=none, with noncompliant mail risking rejection or the spam folder. That threshold created a genuine forcing function, and it is aimed squarely at bulk senders, marketing platforms, newsletter services, transactional-email providers moving thousands of messages daily on a client's behalf. A five-person chartered-accountancy firm sending client invoices and engagement letters is nowhere near 5,000 messages a day and never trips the rule that pushed larger senders to act.

What deliberate, finished enforcement looks like when someone actually owns the outcome is visible in Binding Operational Directive 18-01, issued by the US Department of Homeland Security in October 2017. It gave federal civilian agencies ninety days to get every internet-facing domain to at least DMARC p=none, and one full year to reach p=reject, the fully enforcing setting, across every second-level domain the agency operated. That is a mandate with a fixed deadline, a named compliance owner, and real consequences for missing it, the combination this study's MSME domains mostly lack. Left to a voluntary decision inside a business with no dedicated IT function, the natural resting point looks exactly like what the data shows: SPF gets turned on because a hosting platform defaults to it, DMARC gets set to p=none because a setup guide said to, and the second, harder decision, actually moving to quarantine or reject, never gets made because nothing outside the business is forcing it to.

The stakes of leaving that second decision unmade are not abstract. Business email compromise, the specific family of fraud that a working DMARC enforcement policy is built to close off, cost $2.77 billion across 21,442 complaints reported to the FBI's Internet Crime Complaint Center in 2024 alone, second only to investment fraud on that year's reported loss table. A domain sitting at p=none, or carrying no DMARC record at all, offers no technical resistance to the specific version of that fraud where the forged message appears to come from the company's own name, addressed to its own clients, using its own domain.

None of this requires assuming an Indian MSME is the typical target of a large international wire-fraud ring. The far more common version is local and mundane: a client emailed what looks like an updated bank account number from the firm's own domain, a vendor invoice with the account details quietly changed, a forged payment reminder timed around a real filing deadline. A domain that enforces DMARC does not make a business immune to a look-alike domain a letter off from its own, but it does close off the specific, higher-trust version of the fraud where the forged message carries the business's actual, verified domain name.

One proxy for operational maturity, not a ranking factor

Return, to close, to what this measurement is actually for. Nothing in it moves a business up a Google results page or into an AI Overview; authentication protocols play no role in how either system decides what to rank or cite, and this study does not suggest otherwise anywhere in its numbers. What email authentication offers instead is closer to a credit check than a ranking signal: a small, machine-checkable, publicly verifiable fact about whether a business's digital operations were configured with intention, standing in for dozens of similar small facts, a security header set correctly, a certificate renewed on schedule, a stray DNS record cleaned up rather than left to rot, that are each individually minor and collectively describe how a business treats its own infrastructure.

Read that way, an 11.4% enforcement rate sitting under an 83.5% SPF rate says something coherent about where these seventy-nine businesses actually stand. The easy, largely automatic first step gets taken almost everywhere. The harder, deliberate second step, the one that genuinely requires someone to decide the domain is ready and change a setting, gets taken by roughly one in nine. That specific pattern, start strong on the automatic part, stall before the part that requires an actual decision, recurs often enough across a business's digital presence that it is worth treating as one instance of a general habit rather than an isolated fact about email specifically. SPF is frequently configured once, automatically, by whichever platform sends a business's transactional mail, a website contact form, a booking system, an email marketing tool, each nudging an owner to add one record and move on. DMARC has no equivalent single moment that forces the decision, which may be the simplest explanation for why it is adopted at roughly half the SPF rate and enforced at a small fraction of that.

This is also, like every figure in this dataset, a snapshot rather than a fixed verdict. A DMARC policy is a single line in a DNS record; any of the seventy-nine businesses measured here could move from p=none to p=reject in the time it takes to edit a text file and wait for the change to propagate. What this study measured was the state of that record in August 2026, not a permanent judgment on any one business in the sample, and a repeat measurement six months later would be a different, and equally legitimate, snapshot of the same surface.