How spoofable is crypto? Aggregate dataset ========================================== Study: https://lookproof.dev/research/crypto-domains-email-spoofing-dmarc Publisher: Lookproof (lookproof.dev) Scan: DMARC, SPF and DKIM of 8,522 crypto domains, 2026-10-30T06:00:09.452140Z to 2026-10-31T06:53:59.387115Z (UTC), public DNS only. License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Credit "Lookproof, How spoofable is crypto?" with a link to the study. Market cap rank and exchange type: CoinGecko API. Powered by CoinGecko (https://www.coingecko.com). The files contain only our own aggregates, no CoinGecko data. The dataset has groups only: no domain names, ranks or CoinGecko ids. Groups overlap (a domain that is both a coin and an exchange is in both groups), so rows must not be added up. Format: UTF-8, comma-separated, a dot as decimal separator, shares as fractions (0.0833, not 8.33%). An empty cell means the value does not apply to that row. segments.csv: one row per group ------------------------------- segment group id (below) segment_label readable name of the group domains domains in the group before exclusions included domains counted in the shares (after NXDOMAIN, lame delegation and unresolved domains are excluded) spoofable included domains a forged From address can use: the DMARC policy receivers apply is none, or there is no record, or it is invalid spoofable_share spoofable / included spoofable_ci_low/high 95% Wilson interval of spoofable_share included_mail included domains with an MX record spoofable_mail spoofable domains among them spoofable_share_mail spoofable_mail / included_mail not_reject included domains whose applied policy is not reject ("not fully protected"; includes quarantine) not_reject_share not_reject / included, with not_reject_ci_low/high as 95% interval n_protected applied policy reject n_partial applied policy quarantine n_monitoring applied policy none n_unprotected no DMARC record n_broken invalid DMARC record (a malformed rua/ruf address alone does not count; RFC 9989, section 4.8) n_nxdomain excluded: domain does not exist (confirmed by a second lookup) n_lame_delegation excluded: name servers did not answer n_unresolved excluded: lookups kept failing flag_* included domains with the flag: subdomains_open (sp= or np= weaker than the domain policy), spf_broken, pct_below_100, dmarc_test_mode (t=y), dmarc_inherited (policy from a parent domain), no_mail (no MX or null MX), null_mx, reporting_broken (malformed rua/ruf), mta_sts, tls_rpt, bimi, dkim_found (on known selectors only) scan_first/last_checked_at first and last check of the scan (UTC), the same on every row The no_mail row has only included, spoofable and spoofable_share. categories.csv: long format for charts -------------------------------------- segment, category, count, with category one of protected, partial, monitoring, unprotected, broken, nxdomain, lame_delegation, unresolved. Same numbers as the n_* columns. Groups ------ projects_top50 Top 50 projects (CoinGecko market cap) projects_top500 Top 500 projects (CoinGecko market cap) projects_top1000 Top 1,000 projects (CoinGecko market cap) cex_top100 Top 100 centralized exchanges (CoinGecko trust score) cex_ranked All ranked centralized exchanges dex_ranked Ranked decentralized exchanges exchange_type_unknown Ranked exchanges without a centralized flag tail Long tail (primary domains without a CoinGecko rank) group_token Token projects (primary domains) group_chain Chains (primary domains) group_exchange Exchanges (primary domains) primary All primary domains secondary Secondary domains all All scanned domains no_mail Included domains without mail (no MX or null MX) Status on the scan date; DNS changes. Method: https://lookproof.dev/research/crypto-domains-email-spoofing-dmarc#data-and-method