Research
How many Flemish hotels can have email sent in their name?
Measured on 28 September 2026. Next edition: January 2027.
87.0%
84.4 to 89.3%
Of the 732 hotel email domains we could check, 637 give receiving mail servers no instruction to block a forged email that uses the hotel's exact domain. The 732 domains cover 830 of the 867 active hotels in the Toerisme Vlaanderen register.
The ranges shown with the main figures are 95% Wilson intervals. This edition counts almost every active hotel in the register, not a sample, so a range is not a margin of error in the usual sense. It shows how much a figure of this size could move between two editions for reasons that have nothing to do with a real change.
Several hotels? Ask for a free private report.For journalists and sector organisations
What "open" means in this index
When a mail server receives a message that claims to be from reservations@thehotelsname.be, it can check a public DNS setting called DMARC to see what the owner of that domain wants done with mail that fails authentication. The owner can ask for nothing to happen and just a report (p=none), for the mail to be put aside as suspicious (p=quarantine), or for it to be refused outright (p=reject).
We count a domain as open when it has no valid DMARC record, when the record is set to p=none, or when a stricter setting is marked as a test with the tag t=y. With no record or p=none, the domain owner has not asked receiving mail servers to block or set aside a forged email that uses the hotel's exact domain. No domain in this edition uses t=y, so that third case changes no figure on this page.
This definition looks only at the DMARC setting in DNS. Other ways a hotel's name can be abused are listed further down and are not counted.
The DMARC ladder
Share of the 732 analysed hotel email domains at each DMARC setting, with the 95% interval. "No DMARC record" includes 2 domains that publish two DMARC records at once, which receivers must ignore.
Of the 251 domains set to p=none, 157 (62.5%) also give no address for reports. Those records ask receivers to block nothing and send the owner no reports.
| The DMARC ladder | Domains | Share | 95% interval |
|---|---|---|---|
| No DMARC record | 386 | 52.7% | 49.1 to 56.3% |
| p=none (report only) | 251 | 34.3% | 30.9 to 37.8% |
| p=quarantine | 53 | 7.2% | 5.6 to 9.3% |
| p=reject | 42 | 5.7% | 4.3 to 7.7% |
SPF alone does not protect the From address
400 of the 732 domains (54.6%) end their SPF record with "-all", the strict setting that fails mail from a server the owner has not listed. Of those 400, 330 have no DMARC policy that asks receivers to block or set aside mail that fails.
SPF checks a hidden technical sender address, not the "From" line a guest sees in their inbox. A strict SPF record on its own therefore does not stop a forged email that shows the hotel's exact domain in the From line. DMARC is the setting that links SPF and DKIM to that From address and tells receivers what to do when the check fails.
Almost all analysed domains (724 of 732) have a mail server (MX record) configured. A domain without one can still be forged in an email's "From" line even though it never receives mail itself.
By hotel size
This table covers the 703 domains used by a single hotel; domains shared by two or more hotels have their own row. Smaller hotels are more exposed. Larger hotels more often have a DMARC record, but also more often leave it at p=none: 40.9% of domains for hotels with 50 or more rooms, against 29.4% for hotels with 1 to 9 rooms.
| Rooms | Domains | Open | No DMARC record | Protected |
|---|---|---|---|---|
| 1–9 rooms | 180 | 91.1% (86.0 to 94.5%) | 61.7% | 8.9% |
| 10–49 rooms | 391 | 88.2% (84.7 to 91.1%) | 56.0% | 11.8% |
| 50+ rooms | 132 | 77.3% (69.4 to 83.6%) | 36.4% | 22.7% |
| Hotel-group domains (shared by 2+ hotels) | 29 (127 hotels) | 89.7% (73.6 to 96.4%) | 27.6% | 10.3% |
The headline figure and the DMARC ladder count a domain shared by several hotels once, because one DMARC record governs every hotel behind it. Counting each hotel separately gives 87.5% open (726 of 830 hotels), half a point from the domain-level figure. The largest shared domain covers 4.9% of the 830 hotels, so no single group's setting decides the result.
Domains shared by hotel groups are no better protected: 26 of the 29 are open (89.7%), against 87.0% for all 732 domains.
By province
This table covers the same 703 single-hotel domains. No province stands out: the intervals of all five overlap, so the differences are within what chance could produce, and there is no defensible "best" or "worst" province in this edition.
| Province | Domains | Open | No DMARC record | Protected |
|---|---|---|---|---|
| Antwerp | 118 | 82.2% (74.3 to 88.1%) | 44.1% | 17.8% |
| Limburg | 97 | 91.8% (84.6 to 95.8%) | 53.6% | 8.2% |
| East Flanders | 93 | 91.4% (83.9 to 95.6%) | 52.7% | 8.6% |
| Flemish Brabant | 70 | 84.3% (74.0 to 91.0%) | 52.9% | 15.7% |
| West Flanders | 325 | 86.5% (82.3 to 89.8%) | 57.8% | 13.5% |
What this index does not measure
This index reads public DNS records only, on one date. It says nothing about:
- DKIM, the third email-authentication setting. Its keys sit in DNS under names (selectors) that cannot be listed from outside, so DKIM was not checked.
- Look-alike domains, such as an extra hyphen or a swapped letter. DMARC only ever covers the exact domain it is published on; a look-alike needs its own separate check.
- Hacked mailboxes. A message sent from a real, stolen mailbox passes SPF, DKIM and DMARC, because it genuinely comes from the real domain.
- What each receiving mail server actually does with a forged message. Many providers apply their own spam filtering on top, so an "open" domain does not mean every forged email reaches a guest's inbox; it means the domain owner has not asked receivers to block it.
- Display-name tricks, such as "Hotel Reservations" shown over an unrelated free-mail address. No DNS setting stops that; only reading the actual address does.
How this compares to other published figures
Other published DMARC figures use different populations and methods, so none of them is directly comparable to this index. They are included here only as context, each with its own source.
A Belgian hosting provider (vendor study: Nomeo, reported by Emerce on 2 September 2024) found that about 23% of more than 450,000 .be domains set up for mail had a DMARC record, and that 73% of those were at p=none, 16% at quarantine and 9% at reject. That puts about 6% of all .be mail domains at quarantine or reject in 2024, against 13.0% of the hotel domains here in 2026. The populations and years differ, so the gap does not show that hotels do better.
A 2026 report on travel and hospitality (vendor study: Valimail, "2026 State of DMARC Report: Travel and Hospitality") puts almost half of the domains it covers at an enforcing setting. Valimail does not publish its sample size, and a study like this is usually built on large brands' domains rather than small independent hotels, so it is not a like-for-like comparison. We found no official Belgian figure for hotels, restaurants or cafés.
What a hotel owner can do
Your web host or IT provider can do each of these steps for you.
- 1Check your own domain. It reads the same public DNS records and stores nothing.
- 2If there is no DMARC record yet, ask your host to publish one at p=none with a report address, and read the reports that receiving mail servers send to that address for a few weeks before changing anything else.
- 3Once your own mail consistently passes, move the setting to p=quarantine and then to p=reject. A four-week plan, step by step
- 4See how a forged email travels and where DMARC lets a receiver stop it. The step-by-step explainer is on the same check.
- 5DMARC only protects your exact domain. Also check whether a domain that merely looks like yours is already registered. Free look-alike domain check
Free private report for hotel groups
Of the 29 email domains that each serve several hotels, 127 hotels in all, 26 are open. Do you run several hotels or domains? We check each of your domains and send you a report per domain: what is set now and what your web host or IT provider needs to change.
- Free, with no obligation.
- We send the report only to an email address on one of the domains you list.
- We read only public DNS data, as for the index. Your results never appear on this site or in the index.
- You get the report within five working days, in English, Dutch or French.
One hotel and one domain? Run the free check yourself right away.
Method and coverage
Population: every hotel with status Erkend (recognised) or Aangemeld (registered) in the Toerisme Vlaanderen register on 28 September 2026: 867 active hotels. For each hotel we took the domain of its published email address; where that address sat on a shared service such as Gmail or Telenet, we used the hotel's own website domain instead. Only the domain part of any address was read; no mailbox name, phone number or person's name was collected or stored.
26 hotels had no domain of their own to check. For a further 11 hotels, the domain did not exist, was misspelt in the register, or gave no usable answer from public DNS on two attempts. That leaves 830 hotels (96% of the register) behind 732 analysable domains.
A domain shared by several hotels, such as a hotel group's, counts once: one DMARC record governs every hotel behind it. We looked up the public SPF, DMARC and MX records of each domain through public DNS resolvers on 28 September 2026. No hotel's mail server or website was contacted; only public DNS was read. Records were read according to RFC 9989, the current DMARC standard.
This is a count of nearly every active hotel in the register, not a sample drawn from it. We do not publish results for individual hotels or domains, and we do not rank hotels, chains or provinces against each other.
Source: Toerisme Vlaanderen. Register data reused under the Modellicentie Gratis Hergebruik v1.0 (Flemish free reuse licence).
We repeat this measurement every quarter, in the first week of January, April, July and October, with the same method. If the method ever changes, that change will be listed on this page. Next edition: January 2027.
For journalists and sector organisations
You may reuse the figures and charts on this page with a source credit. Below are the finding in one sentence, how to cite it and the downloads.
- The finding in one sentence
- On 28 September 2026, 637 of 732 Flemish hotel email domains (87.0%) gave receiving mail servers no instruction to block a forged email using the hotel's exact domain. For domains that serve several hotels, it is 26 of 29.
- How to cite this study
- Fluxive, "How many Flemish hotels can have email sent in their name?", edition of 28 September 2026, https://fluxive.be/en/research/hotel-email/
- Downloads
- Questions about the method, or an interview
- Aman Yadav, founder of Fluxive: aman@fluxive.be or +32 472 92 57 41. Calls in English; in writing also in Dutch and French.
What we do not share: hotel names, domains or results per hotel, not even on request.
The next edition comes out in January 2027. Want it when it is published? Email aman@fluxive.be.