Last updated: 16 October 2026 How well do prop firms protect their email from being spoofed? We looked up the public email-authentication records (DMARC, SPF, MTA-STS, TLS reporting, BIMI and DNSSEC) for the main domains of 10 prop firms on 16 October 2026.
4 of 10 prop firms tell receiving mail servers to reject email that fails authentication: FTMO, FundingPips, Goat Funded Trader and Tradeify.
4 use quarantine, which sends failing mail to spam: FundedNext, MyFundedFutures, The5ers and Topstep. Apex Trader Funding and Take Profit Trader publish p=none, a monitoring setting that collects reports but asks servers to take no action.
3 firms end their SPF record with a hard fail (-all): FTMO, FundingPips and FundedNext. The rest use softfail (~all), which is common and relies on DMARC for enforcement.
3 firms publish MTA-STS, which asks other mail servers to use encryption when delivering to them: FundingPips (testing), FundedNext (enforce) and The5ers (enforce). FTMO, FundedNext and MyFundedFutures publish a BIMI record for showing their logo in supporting inboxes.
Email authentication scorecard
| Firm | DMARC policy | SPF ending | MTA-STS | TLS reporting | BIMI logo | DNSSEC |
|---|---|---|---|---|---|---|
| FTMO | reject | -all (fail) | none | no | yes | yes |
| FundingPips | reject | -all (fail) | testing | yes | no | yes |
| Goat Funded Trader | reject | ~all (softfail) | none | no | no | no |
| Tradeify | reject | ~all (softfail) | none | no | no | no |
| FundedNext | quarantine | -all (fail) | enforce | no | yes | no |
| MyFundedFutures | quarantine | ~all (softfail) | none | no | yes | yes |
| The5ers | quarantine | ~all (softfail) | enforce | no | no | no |
| Topstep | quarantine | ~all (softfail) | none | no | no | no |
| Apex Trader Funding | none (monitor only) | ~all (softfail) | none | no | no | no |
| Take Profit Trader | none (monitor only) | ~all (softfail) | none | no | no | no |
Checked 16 October 2026 through public DNS (Cloudflare and Google resolvers gave the same answers). Sorted from strictest DMARC policy. All firms with a DMARC record apply it to 100% of mail.
What the settings mean
- DMARC tells receiving servers what to do with mail claiming to be from a domain that fails SPF and DKIM checks: reject it, quarantine it (spam folder), or none (deliver as normal and send the owner a report). Many domains start on none while they map their senders and move to stricter settings later.
- SPF lists the servers allowed to send for the domain. Ending in -all asks receivers to fail anything else; ~all asks them to treat it as suspicious.
- MTA-STS asks other mail servers to use encrypted connections when delivering to the domain. “Testing” mode reports problems without enforcing.
- BIMI lets a domain with a strict DMARC policy display its logo next to messages in supporting inboxes such as Gmail and Yahoo.
- DNSSEC signs the domain’s DNS records so resolvers can check they haven’t been tampered with.
Why it matters to traders
Phishing emails that pretend to come from prop firms, offering fake payouts, discounts or account warnings, are a common scam. A strict DMARC policy makes it harder for someone to send mail that appears to come from the firm’s exact domain, though it does nothing about look-alike domains. A p=none setting isn’t a vulnerability or a breach; it means the firm hasn’t asked mail servers to block failing messages. Whatever the setting, check the sender address, log in through the firm’s site rather than email links, and never share passwords or 2FA codes. October is Cybersecurity Awareness Month. For other public checks on these firms, see the prop firm website health check.
Sources
- Cloudflare DNS over HTTPS (JSON) and Google Public DNS JSON API, queried 16 October 2026 (TXT records at _dmarc, the domain root, _mta-sts, _smtp._tls and default._bimi).
- Each firm’s MTA-STS policy file at https://mta-sts.<domain>/.well-known/mta-sts.txt, where one is published.
- RFC 7489 (DMARC), RFC 7208 (SPF) and RFC 8461 (MTA-STS) for what each setting means.
Method
We checked the main website domain for each firm. Firms may send some mail from other domains or subdomains, which can have different settings. A domain’s DMARC record applies to its subdomains unless they publish their own or an sp= tag says otherwise.
DNSSEC is shown as validated when the resolver set the Authenticated Data flag on the answer.
Caveats
DNS records can change at any time; this is a snapshot from 16 October 2026.
These records show policy, not how well a firm’s mail is actually authenticated. We didn’t test DKIM keys, which sit at selector names that aren’t public.
Nothing here is a finding of a security weakness or a breach. p=none is a standard monitoring setting.
How to cite this
Prop Data Lab, “Prop Firm Email Security Scorecard”, updated 16 October 2026, https://propdatalab.com/prop-firm-email-security-dmarc-scorecard/
The table and the CSV are free to reuse under CC BY 4.0: copy, chart or republish them, commercial use included, as long as you link back to this page. Data are public DNS records.
Common questions
Which prop firms use DMARC reject?
On 16 October 2026, FTMO, FundingPips, Goat Funded Trader and Tradeify published a DMARC policy of p=reject on their main domains.
Is p=none insecure?
Not in itself. p=none is a monitoring mode: the domain owner gets reports about mail that fails authentication, but receiving servers are asked not to block it. It is a common step before moving to quarantine or reject.
How can I tell if a prop firm email is real?
Check the full sender address against the firm's real domain, be wary of look-alike spellings, and log in through the firm's website instead of email links. No genuine firm will ask for your password or 2FA code by email.
How do I check a domain's DMARC record?
Look up the TXT record at _dmarc followed by the domain, for example _dmarc.ftmo.com, with any DNS lookup tool.