{
  "study": "Podvrzene e-maily z ceskych firemnich domen",
  "publisher": "CIAD - Cesky institut pro AI a data",
  "url": "https://ciad.cz/studie/podvrzene-emaily-ceske-domeny/",
  "license": "CC BY 4.0",
  "generated": "2026-08-03",
  "scan_date": "2026-08-03",
  "note_on_data": "Agregatni data bez domenovych jmen a bez jmen firem. Vzorek je konvencni (vyzkumny korpus CIAD pouzivany napric paralelnimi bezpecnostnimi studiemi), ne nahodny nebo reprezentativni vzorek ceske ekonomiky.",
  "sample": {
    "n_domains_targeted": 299,
    "n_domains_scan_errored": 0,
    "n_domains_evaluable": 299,
    "sampling_method": "convenience sample: CIAD research corpus used across parallel security studies, not random or representative of the Czech economy",
    "scan_type": "passive read-only DNS only (dig against 1.1.1.1 and 8.8.8.8); no HTTP or SMTP connection made to any target"
  },
  "mx": {
    "n_evaluable": 297,
    "n_query_errors_excluded": 2,
    "has_mx": 231,
    "has_mx_pct": 77.8,
    "no_mx": 66,
    "no_mx_pct": 22.2,
    "detected_provider_breakdown_of_has_mx": {
      "microsoft_365": 79,
      "undetected": 103,
      "google_workspace": 29,
      "other_lt10_combined": 20
    }
  },
  "spf": {
    "n_evaluable": 266,
    "n_excluded": 33,
    "n_excluded_breakdown": {
      "apex_nxdomain": 31,
      "query_error": 2
    },
    "present": 205,
    "present_pct": 77.1,
    "absent": 61,
    "absent_pct": 22.9,
    "qualifier_breakdown_of_present": {
      "hard_fail_minus_all": 112,
      "soft_fail_tilde_all": 84,
      "other_or_no_all_lt10_combined": 9
    },
    "multiple_spf_records_permerror": 0
  },
  "dmarc": {
    "n_evaluable": 297,
    "n_query_errors_excluded": 2,
    "present": 139,
    "present_pct": 46.8,
    "absent": 158,
    "absent_pct": 53.2,
    "policy_breakdown_of_present": {
      "p_none": 73,
      "p_quarantine": 35,
      "p_reject": 31
    },
    "policy_breakdown_pct_of_evaluable_297": {
      "no_record": 53.2,
      "p_none": 24.6,
      "p_quarantine": 11.8,
      "p_reject": 10.4
    },
    "enforcement_summary_of_evaluable_297": {
      "enforcing_quarantine_or_reject": {
        "n": 66,
        "pct": 22.2
      },
      "not_enforcing_no_record_or_p_none": {
        "n": 231,
        "pct": 77.8
      }
    },
    "p_none_breakdown": {
      "denominator": 73,
      "with_rua_reporting": {
        "n": 31,
        "pct_of_p_none": 42.5,
        "pct_of_evaluable_297": 10.4
      },
      "without_rua_reporting": {
        "n": 42,
        "pct_of_p_none": 57.5,
        "pct_of_evaluable_297": 14.1
      }
    },
    "multiple_dmarc_records_processing_aborted": 0
  },
  "dkim": {
    "n_evaluable": 299,
    "note": "DKIM selector is an arbitrary string chosen by the sending provider; absence cannot be proven by DNS probing alone. Never publish as prevalence of the full 299 - see buckets and determinable_subset below.",
    "buckets": {
      "found": 121,
      "not_found_known_provider": 35,
      "indeterminate_no_mx": 68,
      "indeterminate_unknown_provider": 75
    },
    "buckets_pct_of_299": {
      "found": 40.5,
      "not_found_known_provider": 11.7,
      "indeterminate_no_mx": 22.7,
      "indeterminate_unknown_provider": 25.1
    },
    "determinable_subset": {
      "denominator": 156,
      "definition": "found + not_found_known_provider",
      "found_pct": 77.6,
      "not_found_pct": 22.4,
      "caveat": "This subset is not representative of the full 299 - it only includes domains on providers with a known, documented selector convention. The 22.4% figure must never be reported as 'X% of domains lack DKIM'."
    },
    "indeterminate_excluded_from_any_negative_claim": {
      "n": 143,
      "pct_of_299": 47.8
    },
    "secondary_resolver_confirm": {
      "confirmed_both_resolvers": 118,
      "primary_resolver_only": 3,
      "of_found_n": 121
    }
  },
  "bimi": {
    "n_evaluable": 296,
    "n_query_errors_excluded": 3,
    "present": 5,
    "present_pct": 1.7,
    "note": "BIMI (brand logo in inbox) requires an enforcing DMARC policy as one precondition; the low count is consistent with only 66/297 domains enforcing DMARC."
  },
  "scan_method": {
    "type": "passive read-only DNS",
    "description": "dig queries against 1.1.1.1 and 8.8.8.8 for SPF (apex TXT), DMARC (_dmarc TXT), DKIM (selector sweep, 25 selectors per domain, provider-informed via MX where the convention is documented: Google Workspace, Microsoft 365, Zoho), and BIMI (default._bimi TXT). No SMTP connection, no email sent, no authentication, no vulnerability testing.",
    "resolvers": [
      "1.1.1.1",
      "8.8.8.8"
    ],
    "dkim_selectors_tried_per_domain": 25
  }
}