Skip to content
DMARC

You're viewing the July 2026 edition (archived). See the latest edition →

banks · United States

10% of banks in the United States are not protected against email spoofing

Public DMARC posture of 50 banks. Edition of July 2026.

40

Protected

5

Enforcing

4

Monitoring only

1

No DMARC

How it has evolved

At-risk over timeShare not protected against spoofing across 4 monthly editions.20%0%10%2026-0610%2026-0710%2026-0810%2026-09
% at risk

Methodology

We read each organization's public DNS — the DMARC record on its consumer-facing domain — and classify the published policy (none / quarantine / reject). "Protected" means an enforced p=reject policy. Only public data is used; figures reflect the edition date and can change as records are updated.

Previous editions

An extract, status by status

35 of the 50 banks, up to 25 per status, in alphabetical order. The full list — with search, filters and sorting — lives in the Rankings.

The full list of banks lives in the Rankings, with search, filters and sorting. Open the Rankings →

Protected (p=reject)40 organisations

Protected (p=reject): 25 organisations out of 40, in alphabetical order
OrganizationGrade
Allyally.comA
American Expressamericanexpress.comA
Associated Bankassociatedbank.comA
Bank of Americabankofamerica.comA
Bank OZKozk.comA
Barclays USbarclaysus.comA
BMObmo.comA
Capital Onecapitalone.comA
Cash Appcash.appA
Charles Schwabschwab.com(corporate domain : schwabbank.com)A
Chasechase.com(corporate domain : jpmorganchase.com)A
Chimechime.comA
Citibankciti.com(corporate domain : citigroup.com)A
Citizens Bankcitizensbank.comA
Fifth Third Bank53.comA
First Citizens Bankfirstcitizens.comA
First Horizonfirsthorizon.comA
First National Bankfnb-online.comA
Flagstar Bankflagstar.comA
Huntingtonhuntington.comA
KeyBankkey.comA
M&T Bankmtb.comA
Marcusmarcus.com(corporate domain : goldmansachs.com)A
Navy Federalnavyfederal.orgA
Pinnacle Financialpnfp.comA

Protected (p=reject): see the full list in the Rankings →

Enforcing (p=quarantine)5 organisations

Enforcing (p=quarantine): 5 organisations out of 5, in alphabetical order
OrganizationGrade
Currentcurrent.comB
Discoverdiscover.com(corporate domain : capitalone.com)B
East West Bankeastwestbank.comB
Valley Bankvalley.comB
Varo Bankvaromoney.com(corporate domain : varo.com)B

Monitoring only (p=none)4 organisations

Monitoring only (p=none): 4 organisations out of 4, in alphabetical order
OrganizationGrade
Comericacomerica.comD
Frost Bankfrostbank.comD
Old National Bankoldnational.comD
Western Alliancewesternalliancebank.comD

No DMARC1 organisation

No DMARC: 1 organisation out of 1, in alphabetical order
OrganizationGrade
HSBC Bank USAus.hsbc.com(corporate domain : hsbc.com)A