Why an email security observatory?
Email remains the primary vector for cyberattacks targeting businesses. Phishing, CEO fraud and business email compromise exploit weak or missing email authentication. Publicly listed companies are high-value targets because spoofed emails can move markets, trigger fraudulent transfers or damage investor confidence.
The observatory exists to:
- Measure the real-world adoption of email security standards across major indices
- Track how adoption evolves week after week
- Identify common gaps and help prioritize remediation
- Provide transparency on the email security posture of the world's largest listed companies
What standards are analyzed?
Outbound email security
| Standard | Purpose |
|---|---|
| SPF | Authorizes which servers can send email on behalf of the domain |
| DKIM | Cryptographically signs outgoing messages to prove authenticity |
| DMARC | Tells receivers how to handle messages that fail SPF/DKIM checks |
| BIMI | Displays the company's logo in recipients' inboxes after DMARC enforcement |
Inbound email protection
| Standard | Purpose |
|---|---|
| MX | Declares the mail servers that receive email for the domain |
| MTA-STS | Enforces TLS encryption for incoming email connections |
| DANE/TLSA | Pins TLS certificates in DNS for email transport verification |
DNS security
| Standard | Purpose |
|---|---|
| DNSSEC | Cryptographically signs DNS zones to prevent spoofing and cache poisoning |
How the scoring works
Each domain is scored on a 100-point scale, divided into three pillars:
- Outbound security (up to 55 points) - SPF record quality, DKIM key strength, DMARC policy strictness, BIMI deployment
- Inbound protection (up to 25 points) - MX configuration, MTA-STS mode, DANE/TLSA records
- DNS hardening (up to 20 points) - DNSSEC chain validation
The final score maps to a letter grade: A+ (90+), A (80-89), B (65-79), C (50-64), D (30-49), F (below 30).
FAQ - Frequently asked questions
Q: What does the observatory measure?
A: The observatory analyzes email authentication records (SPF, DKIM, DMARC), brand protection (BIMI), transport security (MTA-STS, DANE/TLSA) and DNS security (DNSSEC) for each monitored domain.
Q: How is the score calculated?
A: The score is the sum of points across three pillars: outbound security (SPF, DKIM, DMARC, BIMI), inbound protection (MX, MTA-STS, DANE/TLSA) and DNS hardening (DNSSEC). Each standard contributes a weighted number of points.
Q: How often are companies scanned?
A: All domains are scanned once per week. The scan week is displayed on the dashboard.
Q: Which companies are monitored?
A: The observatory covers over 1,000 companies from 9 major global stock indices: S&P 500, Nasdaq 100, FTSE 100, CAC 40, DAX 40, Nikkei 225, Hang Seng, Nifty 50 and SSE 50.
Q: What is a good score?
A: A+ (90-100) indicates excellent email security. B (65-79) is acceptable but improvements exist. F (below 30) indicates significant gaps.
Related tools
| Tool | Purpose |
|---|---|
| Email Domain Check | Full email authentication audit for any domain |
| SPF Inspector | Verify and fix your SPF record |
| DKIM Inspector | Validate your DKIM signature and key |
| DMARC Inspector | Configure and test your DMARC policy |
| MTA-STS Check | Verify your MTA-STS policy |