banks · Spain
28% of Spain's banks are not protected against email spoofing
Public DMARC posture of 44 banks. Edition of June 2026.
20
Protected
11
Enforcing
7
Monitoring only
5
No DMARC
Where each one stands
| Organization | DMARC status | Grade |
|---|---|---|
| Abancaabanca.com | Protected (p=reject) | A |
| Banco Sabadellbancsabadell.com(corporate domain : grupbancsabadell.com) | Protected (p=reject) | A |
| Banco Santanderbancosantander.es(corporate domain : santander.com) | Protected (p=reject) | A |
| Bankinterbankinter.com | Protected (p=reject) | A |
| BBVAbbva.es | Protected (p=reject) | A |
| CaixaBankcaixabank.es(corporate domain : caixabank.com) | Protected (p=reject) | A |
| Caja Rural de Aragóncajaruraldearagon.es | Protected (p=reject) | B |
| Caja Rural de Navarracajaruraldenavarra.com | Protected (p=reject) | A |
| Caja Rural de Soriacajaruraldesoria.com | Protected (p=reject) | B |
| Cajasurcajasur.es | Protected (p=reject) | A |
| Deutsche Bank Españadeutsche-bank.es | Protected (p=reject) | A |
| Eurocaja Ruraleurocajarural.es | Protected (p=reject) | A |
| EVO Bancoevobanco.com | Protected (p=reject) | A |
| Globalcajaglobalcaja.es | Protected (p=reject) | A |
| imaginimagin.com | Protected (p=reject) | A |
| ING Españaing.es | Protected (p=reject) | A |
| Kutxabankkutxabank.es | Protected (p=reject) | A |
| MyInvestormyinvestor.es | Protected (p=reject) | A |
| Openbankopenbank.es | Protected (p=reject) | A |
| Unicaja Bancounicajabanco.es | Protected (p=reject) | A |
| Banca Marchbancamarch.es | Enforcing (p=quarantine) | B |
| Banco Mediolanumbancomediolanum.es | Enforcing (p=quarantine) | B |
| Banco Pichincha Españabancopichincha.es | Enforcing (p=quarantine) | B |
| Bnextbnext.es | Enforcing (p=quarantine) | D |
| Caixa Ontinyentcaixaontinyent.es | Enforcing (p=quarantine) | C |
| Caixa Popularcaixapopular.es | Enforcing (p=quarantine) | C |
| Cajamarcajamar.es | Enforcing (p=quarantine) | B |
| Cajasietecajasiete.com | Enforcing (p=quarantine) | B |
| Laboral Kutxalaboralkutxa.com | Enforcing (p=quarantine) | B |
| Renta 4 Bancor4.com(corporate domain : renta4banco.com) | Enforcing (p=quarantine) | B |
| WiZinkwizink.es | Enforcing (p=quarantine) | C |
| Andbank Españaandbank.es | Monitoring only (p=none) | D |
| Caja Rural de Teruelruralteruel.com | Monitoring only (p=none) | D |
| Cajalmendralejocajalmendralejo.es | Monitoring only (p=none) | D |
| CBNKcbnk.es(corporate domain : bancocaminos.es) | Monitoring only (p=none) | D |
| Colonya Caixa Pollençacolonya.com | Monitoring only (p=none) | F |
| Ibercajaibercaja.es | Monitoring only (p=none) | D |
| Singular Banksingularbank.es(corporate domain : singularbank.com) | Monitoring only (p=none) | D |
| Caixa Enginyerscaixaenginyers.com | No DMARC | F |
| Caja Rural de Asturiascajaruraldeasturias.com | No DMARC | F |
| Caja Rural de Granadacajaruralgranada.es | No DMARC | F |
| Caja Rural del Surcajaruraldelsur.es | No DMARC | F |
| Cajaviva Caja Ruralcajaviva.es | No DMARC | F |
| Caja Rural Centralruralcentral.es | Not measured | F |
Previous editions
Methodology
We read each organization’s public DNS — the DMARC record on its consumer-facing domain — and classify the published policy (none / quarantine / reject). “Protected” means an enforced p=reject policy. Only public data is used; figures reflect the edition date and can change as records are updated.