E-commerce & retail
Email security of 31 retailers & marketplaces
Fake order confirmations and delivery scams all start with a spoofed retail domain — this is how the big marketplaces and brands hold up.
Across these 31 domains, 100% publish SPF, 100% publish DMARC and 96.8% enforce it (reject or quarantine), 3.2% sit on p=none, and 77.4% sign with DKIM. Scanned June 24, 2026.
Every domain in this cohort
| Domain | SPF | DMARC | DKIM | MTA-STS | TLS-RPT |
|---|---|---|---|---|---|
| adidas.com | Hardfail | Reject | Yes | No | No |
| ajio.com | Hardfail | Reject | No | No | No |
| alibaba.com | Hardfail | Reject | No | No | No |
| aliexpress.com | Hardfail | Reject | No | No | No |
| asos.com | Hardfail | Reject | Yes | No | No |
| bestbuy.com | Softfail | Reject | Yes | No | No |
| costco.com | Hardfail | Reject | Yes | No | No |
| ebay.com | Softfail | Reject | Yes | No | No |
| etsy.com | Hardfail | Reject | Yes | No | No |
| flipkart.com | Softfail | Quarantine | Yes | No | No |
| hm.com | Softfail | Reject | Yes | No | No |
| homedepot.com | Softfail | Reject | Yes | No | No |
| ikea.com | Hardfail | Reject | Yes | No | No |
| instacart.com | Softfail | Reject | Yes | No | No |
| lowes.com | Softfail | Reject | Yes | No | No |
| lululemon.com | Hardfail | Reject | Yes | No | Yes |
| mercadolibre.com | Softfail | Reject | Yes | No | No |
| myntra.com | Hardfail | Quarantine | Yes | No | No |
| nike.com | Softfail | Reject | No | No | No |
| overstock.com | Hardfail | Reject | Yes | No | No |
| puma.com | Hardfail | Quarantine | Yes | No | No |
| rakuten.com | Softfail | Reject | Yes | No | No |
| taobao.com | Hardfail | Quarantine | Yes | No | No |
| target.com | Softfail | Reject | Yes | No | No |
| underarmour.com | Softfail | Quarantine | Yes | No | No |
| uniqlo.com | Softfail | Reject | Yes | No | No |
| walmart.com | Softfail | Reject | No | No | No |
| wayfair.com | Hardfail | Quarantine | Yes | No | No |
| zalando.com | Hardfail | Reject | Yes | No | No |
| zara.com | Hardfail | Reject | No | No | No |
| jd.com | Hardfail | None (monitor) | No | No | No |
Where does your domain stand?
Run the same 15 checks on your own domain — free, no signup. If you need the result as evidence, the signed Domain Audit Report turns it into a dated artifact your auditor can verify.