DNS Lookup
Choose a DNS record type to search for.
Propagation & diagnostics
Compare resolvers worldwide and inspect returned answers.
Keep history, monitor your zones and automate recurring checks.
Email authentication
Tools to verify and validate your email authentication setup.
Deliverability
Email deliverability audit
Audit MX, SPF, DKIM and DMARC to confirm a domain is ready to send.
Mail header analyzer
Decode participants, authentication results and routing from raw headers.
Email tester
Send a test email and get instant authentication and deliverability feedback.
IP Blacklist Checker
Check if your IP is on email blacklists
Domain Blacklist Checker
Check if your domain is on URI blacklists
SPF Flattener
Flatten SPF records to reduce DNS lookups below the 10-lookup limit.
DKIM Selector Finder
Auto-discover all DKIM selectors for a domain via DNS brute-force.
SMTP/MX Tester
Test SMTP connectivity of your MX servers: banner, STARTTLS, TLS certificate, open relay.
IP tools
Quickly inspect an IP address or your own connection.
My IP address
Detect your IPv4/IPv6 addresses and their geolocation.
Reverse lookup
Resolve a PTR record and validate DNS consistency.
IP WhoIs
Identify the owner of an IP range and its contacts.
IPv4 netmask
Calculate network, broadcast and usable hosts for any IPv4 block.
IPv6 subnet calculator
Calculate IPv6 subnets, address ranges and reverse DNS entries.
Text
Transform and measure your content in seconds.
Text case converter
Convert any block of text to upper or lower case instantly.
Slug generator
Transform any sentence into an SEO-friendly slug in seconds.
Word & character counter
Measure the length of any text, with instant word and character counts.
Password generator
Generate strong random passwords and memorable passphrases instantly.
Developer
Encoding, hashing, regex and formatting for everyday dev work.
Base64 encoder / decoder
Encode or decode any content in Base64 without leaving the browser.
Hash Generator
Compute MD5, SHA-1, SHA-256 and SHA-512 hashes of any text.
URL encoder / decoder
Encode or decode text using percent-encoding (RFC 3986) right in your browser.
Regex Tester
Test a regular expression against text and visualize matches.
JSON / YAML Formatter
Format, validate and convert JSON and YAML in one click.
Web & Certificates
BIMI logos, VMC/CSR certificates and web page diagnostics.
BIMI logo lookup
Inspect a BIMI logo URL - format, metadata and live rendering - before rollout.
BIMI SVG converter
Convert any SVG to BIMI-compliant Tiny-PS format in seconds.
CSR parser
Inspect a CSR, extract subject details, fingerprints and requested SANs.
VMC inspector
Inspect a Verified Mark Certificate - issuer, validity and SAN coverage - before you publish BIMI.
Page size checker
Check if your page exceeds Google's 2 MB crawl limit.
Phishing URL Checker
Check if a URL is flagged as phishing or malware by 4 threat intelligence sources.
Every week, we audit the email configuration (SPF, DKIM, DMARC, BIMI, MTA-STS, DANE and DNSSEC) of over 1,000 listed companies worldwide. Our scoring covers 9 major stock indices (from the S&P 500 and Nasdaq 100 to the Nikkei 225 and Hang Seng), providing a global view of email security practices. Explore results by index, country or company and track progress week over week.
Scan week: 2026-03-02 · 1090 companies analysed
DMARC reject
47.3%
516 / 1090
SPF strict (-all)
46%
505 / 1090
BIMI configured
10%
114 / 1090
MTA-STS enforce
1%
15 / 1090
DNSSEC enabled
9.6%
105 / 1090
42
Average
46
Median
0
Min
87
Max
| Grade | |||
|---|---|---|---|
| 1 | Beiersdorfbeiersdorf.com | 87 | A |
| 2 | CME Groupcmegroup.com | 86 | A |
| 3 | Freseniusfresenius.com | 81 | B |
| 4 | Vonoviavonovia.de | 81 | B |
| 5 | CrowdStrikecrowdstrike.com | 79 | B |
| 6 | Tata Consultancy Servicestcs.com | 75 | B |
| 7 | Cincinnati Financialcinfin.com | 75 | B |
| 8 | United Parcel Serviceups.com | 75 | B |
| 9 | Heidelberg Materialsheidelbergmaterials.com | 75 | B |
| 10 | Accentureaccenture.com | 74 | B |
| Grade | |||
|---|---|---|---|
| 1 | D. R. Hortondfrhorton.com | 0 | F |
| 2 | Mitsubishi Materialsmitsubishimaterials.com | 0 | F |
| 3 | China Mobilechinamobileltd.com | 0 | F |
| 4 | China Northern Rare Earthnfrare.com | 0 | F |
| 5 | Beijing-Shanghai High Speed Railwaycr-jh.cn | 0 | F |
| 6 | China Resources Powercr-power.com | 0 | F |
| 7 | Mitsui Fudosanmitsui-fudosan.co.jp | 0 | F |
| 8 | Mitsui Mining & Smeltingmitsuiminingamp;smelting.com | 0 | F |
| 9 | Mitsui O.S.K. Linesmitsuiosklines.com | 0 | F |
| 10 | Monolithic Power Systemsmonolithicpowersystems.com | 0 | F |
Email remains the primary vector for cyberattacks targeting businesses. Phishing, CEO fraud and business email compromise exploit weak or missing email authentication. Publicly listed companies are high-value targets because spoofed emails can move markets, trigger fraudulent transfers or damage investor confidence.
The observatory exists to:
| Standard | Purpose |
|---|---|
| SPF | Authorizes which servers can send email on behalf of the domain |
| DKIM | Cryptographically signs outgoing messages to prove authenticity |
| DMARC | Tells receivers how to handle messages that fail SPF/DKIM checks |
| BIMI | Displays the company's logo in recipients' inboxes after DMARC enforcement |
| Standard | Purpose |
|---|---|
| MX | Declares the mail servers that receive email for the domain |
| MTA-STS | Enforces TLS encryption for incoming email connections |
| DANE/TLSA | Pins TLS certificates in DNS for email transport verification |
| Standard | Purpose |
|---|---|
| DNSSEC | Cryptographically signs DNS zones to prevent spoofing and cache poisoning |
Each domain is scored on a 100-point scale, divided into three pillars:
The final score maps to a letter grade: A+ (90+), A (80-89), B (65-79), C (50-64), D (30-49), F (below 30).
Q: What does the observatory measure?
A: The observatory analyzes email authentication records (SPF, DKIM, DMARC), brand protection (BIMI), transport security (MTA-STS, DANE/TLSA) and DNS security (DNSSEC) for each monitored domain.
Q: How is the score calculated?
A: The score is the sum of points across three pillars: outbound security (SPF, DKIM, DMARC, BIMI), inbound protection (MX, MTA-STS, DANE/TLSA) and DNS hardening (DNSSEC). Each standard contributes a weighted number of points.
Q: How often are companies scanned?
A: All domains are scanned once per week. The scan week is displayed on the dashboard.
Q: Which companies are monitored?
A: The observatory covers over 1,000 companies from 9 major global stock indices: S&P 500, Nasdaq 100, FTSE 100, CAC 40, DAX 40, Nikkei 225, Hang Seng, Nifty 50 and SSE 50.
Q: What is a good score?
A: A+ (90-100) indicates excellent email security. B (65-79) is acceptable but improvements exist. F (below 30) indicates significant gaps.
| Tool | Purpose |
|---|---|
| Email Domain Check | Full email authentication audit for any domain |
| SPF Inspector | Verify and fix your SPF record |
| DKIM Inspector | Validate your DKIM signature and key |
| DMARC Inspector | Configure and test your DMARC policy |
| MTA-STS Check | Verify your MTA-STS policy |