December 6, 2013

Internet-wide efforts to fight email phishing are working

Editor's Note: This post was updated on February 9th, 2016. Adoption numbers reflect state of authentication as of this date.

Since 2004, industry groups and standards bodies have been working on developing and deploying email authentication standards to prevent email impersonation. At its core, email authentication standardizes how an email’s sending and receiving domains can exchange information to authenticate that the email came from the rightful sender.

Now, nearly a decade later, adoption of these standards is widespread across the industry, dramatically reducing spammers’ ability to impersonate domains that users trust, and making email phishing less effective. 97.4% of non-spam emails sent to Gmail users come from authenticated senders as of 2016, a sharp increase from 2013 when only 91.4% of the emails were authenticated. Authentication helps Gmail prevent billions of impersonating email messages a year landing in users’ inboxes.

More specifically, the 97.4% of the authenticated non-spam emails sent to Gmail users come from senders that have adopted one or more of the following email authentication standards: DKIM (DomainKey Identified Email) or SPF (Sender Policy Framework).

Here are some statistics that illustrate the scale of what we’re seeing:

  • 86.8% of the emails we received are signed according to the (DKIM) standard (up from 76.9% in 2013). Over two million domains (weekly active) have adopted this standard (up from 0.5 millions 2013). 
  • 95.3% of incoming emails we receive come from SMTP servers that are authenticated using the SPF standard (up from 89.1% in 2013). Over 7.8 million domains (weekly active) have adopted the SPF standard (up from 3.5 million domains in 2013).
  • 85% of incoming emails we receive are protected by both the DKIM and SPF standards (up from 74.7% in 2013).
  • Over 162,000 domains have deployed domain-wide policies that allow us to reject hundreds of millions of unauthenticated emails every week via the DMARC standard (up from 80,000 in 2013). 
Join the fight against email spam 

As more domains implement authentication, phishers are forced to target domains that are not yet protected. If you own a domain that sends email, the most effective action you can take to help us and prevent spammers from impersonating your domain is to set up DKIM, SPF and DMARC. Check our help pages on DKIM, SPF, DMARC to get started.

When using DKIM, please make sure that your public key is at least 1024 bits, so that attackers can’t crack it and impersonate your domain. The use of weak cryptographic keys -- ones that are 512 bits or less -- is one of the major sources of DKIM configuration errors (21%).

If you own domains that are never used to send email, you can still help prevent abuse. All you need to do is create a DMARC policy that describes your domain as a non-sender. Adding a “reject” policy for these domains ensures that no emails impersonating you will ever reach Gmail users’ inboxes.

While the fight against spammers is far from over, it’s nevertheless encouraging to see that community efforts are paying off. Gmail has been an early adopter of these standards and we remain a strong advocate of email authentication. We hope that publishing these results will inspire more domain owners to adopt the standards that protect them from impersonation and help keep email inboxes safe and clean.


  1. Hi this seems the closest to my problem. Someone has added one number to my e mail address and is sending requests for wire transfers under my name. What do I do? Google is lacking in direct help answers.

  2. I don't understand how any of these protocols will have a lasting impact on larger problem of phishing. Maybe you could help me with that? What they seem to do, under the best of circumstances, is prevent spoofing of the domain in one small technical part of a message that most users simply ignore anyway. What do you suppose the click rate delta is on a message that comes in with a slightly altered domain name(heck, even a totally bogus domain name)? Not much I'd wager. Exact same message that your blocking now with DMARC, sent with a different domain, and the message is successfully delivered. It's still a win, and I'm simplifying for sure, but it's difficult for me to get excited about the long term prospects of this helping with phishing.

  3. wow,its really amazing post thanks a lot for sharing with us,good work,keep it up.

  4. Have google any development services about email security in my country? Portugal.
    I know you have advertising department but not for my intentions to submit a new anti-spam study and concept, i know you go to see.

  5. Why if you want to fight fishing have you made the captchas on the Report Fishing page so difficult to read?

  6. Why, if you want to fight phishing, have you made the captchas so much more difficult?

  7. This article provides a very useful information that I need. Thanks for sharing this post.
    Internet Research

  8. I am also not happy with spam emails when I open my inbox I don't feel well after watching 1000's of spam and unwanted emails.
    Internet Research

  9. Very informative post. Its just awesome work behaind each and every transaction.. Really very impressive post..


You are welcome to contribute comments, but they should be relevant to the conversation. We reserve the right to remove off-topic remarks in the interest of keeping the conversation focused and engaging. Shameless self-promotion is well, shameless, and will get canned.

Note: Only a member of this blog may post a comment.