US Bank and Credit Union Email Census: 7,537 Domains

Software companies that sell to banks and credit unions mostly reach them by email first: the introduction, the follow-up after a conference, the security questionnaire, the pilot proposal. Two facts about each institution decide what happens to that mail before anyone reads it. The first is who receives it, which the institution's MX records name. The second is whether the institution's own domain is protected from impersonation, which its SPF and DMARC records say. We found no published measurement of either across the whole US market, so we measured both for every bank and credit union with a website in October 2026, using the method of our dealership gateway census and dealership authentication census.

Population: 4,223 active institutions from the FDIC BankFind Suite and 4,299 credit unions from the NCUA call report data for June 2026, 8,522 in all. 8,022 list a usable website address. Their domains were deduplicated (an institution sharing a domain with a larger one was counted once, under the larger), leaving 7,971 domains, of which 7,962 resolved cleanly. 7,537 publish a mail exchange record: 3,947 banks and 3,590 credit unions. They are the population for every figure below. Figures are shares of institution domains, not of messages or employees.

Who receives email for US banks and credit unions?

3,107 of the 7,537 domains (41%) point their MX records at a dedicated email security gateway, the filtering service that receives, scans and holds mail before it reaches the mailbox. 3,198 (42%) point straight at Microsoft 365. Google Workspace receives mail for 189 (2%), which is almost nobody. The remaining 14% run their own servers or use hosting and banking technology providers, including the hosted mail service USA.NET at 162 domains.

Embed this chart

Microsoft sits underneath most of the gateways as well. Where a gateway fronts the domain, the SPF record usually names the mailbox platform behind it, and 1,736 of the 3,107 gateway domains (56%) authorise Microsoft 365 to send for them; 21 authorise Google. Counting both routes, Microsoft hosts the mailboxes of at least 65% of US banks and credit unions that receive mail.

Which email security gateways do banks and credit unions use?

Proofpoint is the most common gateway by a wide margin: 1,112 domains, 36% of all gateway domains. Barracuda (633), Mimecast (497), AppRiver / Zix (424), Cisco Secure Email (104) follow. The mix shifts with size: Barracuda fronts 27% of gateway domains between $100 million and $500 million in assets but 10% between $1 billion and $10 billion, where Mimecast rises to 33%; at $10 billion and over Proofpoint fronts 65%. A domain counts as gateway-fronted when any of its MX hosts belongs to a known filtering service.

Does asset size change the email set-up?

Asset size moves both measures sharply. 25% of institutions under $100 million in assets sit behind a gateway; 53% of those between $1 billion and $10 billion do, and 66% of those at $10 billion and over. DMARC enforcement follows the same curve, from 35% at the small end to 84% at the top. The smallest credit unions are the weakest group in the census: 64% publish DMARC, 30% enforce it and 32% publish SPF with no DMARC at all.

Embed this chart

How many banks and credit unions publish SPF and DMARC?

SPF is close to universal: 98% of mail-receiving institution domains publish a record and 57% end it in a hard fail. DMARC is where banks and credit unions part company. 86% of all domains publish a DMARC record; 26% stop at p=none, which reports spoofing without blocking it; 28% quarantine and 32% reject. Banks enforce at 72% and reject at 43%; credit unions enforce at 46% and reject at 19%. 18% of credit union domains publish SPF with no DMARC, against 8% of bank domains.

Embed this chart

For scale, the same measurement on US franchise car dealerships found 47% publishing DMARC and 23% enforcing it. Financial institutions are 2.6 times as likely to enforce.

Do .bank domains enforce DMARC?

721 institutions in the census use a .bank website domain, and 664 of them receive mail at it. 99% of those enforce DMARC and 99% reject, against 60% of .com institution domains. That is the registry's rule showing up in DNS: fTLD Registry Services, which runs .bank, requires every .bank domain to publish DMARC at p=reject, with a 90-day allowance while email is being deployed. 57 .bank domains publish no mail record; those institutions most likely keep email on another domain, which this census does not see.

Which charters and states enforce DMARC?

Charter type tracks the bank and credit union split. Banks of every charter enforce DMARC at similar rates; federally chartered credit unions trail state-chartered ones.

By state, Nebraska institutions enforce DMARC at 75% and New Jersey institutions at 40%. States with fewer than 100 mail-receiving institution domains are excluded; the state is the institution's headquarters, not every market it serves.

What does this mean for a fintech or software vendor emailing institutions?

Expect a filter before a person. 41% of institutions, and 66% of those with $10 billion or more in assets, scan inbound mail through a gateway that scores sender reputation, authentication and content before delivery. Gateways do not all behave alike. In Provena's dealership deliverability benchmark, dealers behind Mimecast bounced 52 to 72 percent of first-touch cold sends as policy while Proofpoint-fronted dealers bounced about 1 percent; that benchmark measured dealerships, not institutions, but the same products front 52% of institution gateways here. Classify an institution list by gateway before sending, and treat a sender's own SPF, DKIM and DMARC alignment, a warmed sending domain and a verified list as entry requirements. A sending domain without DMARC, or mail that fails alignment, is exactly what these filters score down.

Segment before writing. A $50 million credit union on Microsoft 365 with no DMARC and a $5 billion bank behind Proofpoint at p=reject are different receivers with different buyers, review paths and tolerance for unsolicited mail. Size the account list by charter, asset band and receiving provider, route sends accordingly, and keep the first message plain: no attachments, no link shorteners and one clear reason the institution should care. The guide to selling fintech to financial institutions covers segmentation, the buying group and the assurance pack that follows the first reply; the fintech lead generation agency comparison covers who can run outreach to this market, and what to ask them about deliverability before signing. For credit unions specifically, the guide to selling to credit unions adds size, staff, digital services and dealer lending from the NCUA call report. Every study in this series sits in the financial services library and the research hub.

Read the authentication numbers as buyer context too. 40% of institutions (3,015) either have no DMARC or have not moved past p=none, and 83% of those hold under $500 million in assets. For a vendor selling security, fraud prevention or managed IT to community banks and credit unions, that is the size of the open market. Provena classifies institution lists this way before any SaaS and fintech outbound campaign is sent, and publishes its own campaign results, with their limits, in the case study library.

How was this measured?

Institutions: the FDIC BankFind Suite institutions API (active institutions, website address, state, charter class and total assets from the June 2026 Call Report) and the NCUA quarterly call report data for June 2026 (credit union name, state, charter type, total assets and the website address the credit union reports). Only institution-level public fields were read; no personal data was collected. Domains: each website address was reduced to its registrable domain, with obvious typing errors in the source lists repaired (for example a comma in place of a dot) and 7 unusable entries dropped; 51 institutions that share a domain with a larger one were folded into it. Records: MX, the root TXT set (SPF, v=spf1, classified by its all mechanism) and the _dmarc TXT record (v=DMARC1, classified by its p tag; several records or a missing p tag count as invalid) were resolved on 7 October 2026 against public resolvers, each lookup retried on a second and third resolver before being counted as an error; 9 domains still failed and are excluded. Classification: a domain is gateway-fronted when any MX host belongs to a known filtering service, otherwise it takes the provider of its preferred MX host; the platform behind a gateway is read from the SPF record's include list.

Limits: the census measures the website domain. An institution that sends and receives email on a different domain is measured on the wrong one or, where the website domain has no MX record, left out (333 domains publish no MX and 92 no longer resolve). A gateway in MX does not prove how strictly it filters, a DMARC record does not prove the institution's own senders align with it, and DKIM is not reported because selectors cannot be listed from outside. Some filtering services used by banking technology providers could not be attributed to a vendor and remain in other. DMARC for .bank domains can also be evaluated at the registry's public suffix, which this census does not count. Aggregate figures only; the domain list is not published.

Sources and companion studies

FDIC BankFind Suite institutions API; NCUA credit union and corporate call report data; fTLD .bank email authentication requirements; RFC 7208 (SPF) and RFC 7489 (DMARC); Google's email sender guidelines. Companion studies: the dealership email authentication census and the dealership email gateway census.

Frequently asked questions