Skip to main content
CaptainDNS
46/ 100

Paychex

paychex.com · 🇺🇸 US · industrials

🇺🇸 S&P 500🇺🇸 Nasdaq 100

Scan week: 2026-10-19

  • Paychex scores 46/100 and receives a grade of D in the Email Security Observatory.
  • This score is 2 points above the global average of 44/100, placing Paychex among the better-protected companies.
  • Paychex ranks #867 out of 1601 companies globally in the email security observatory.
  • The score is unchanged from last week.
  • Outbound email security - covering DMARC, SPF, DKIM and BIMI - scores 64/100 (C).
  • Inbound email protection - covering MX, MTA-STS, DANE and TLS-RPT - scores 40/100 (D).
  • DNS security (DNSSEC) scores 0/100 (F).
  • 8 recommendations have been identified to improve Paychex's email security posture.
  • Score history spans 6 weeks, enabling week-over-week tracking of email authentication progress.

Score

Outbound

50%
C
64/ 100
dmarc
34/40A
spf
9/30D
dkim
21/25B
bimi
0/5F

Inbound

35%
D
40/ 100
mx
40/40A
mta-sts
0/30F
dane
0/15F
tls-rpt
0/15F

DNS security

15%
F
0/ 100
dnssec
0/100F

Rankings

global

#867 / 1601

country US

#336 / 505

index sp-500

#335 / 502

index nasdaq-100

#76 / 101

sector industrials

#207 / 413

Score history

46
10-19
46
10-12
44
03-23
44
03-16
44
03-09
44
03-02

Recommendations

Highdnssec

Enable DNSSEC for your domain to improve DNS security

Mediumdkim

observatory.rec.upgrade_weak_selector

Mediummta-sts

Deploy MTA-STS to enforce TLS for inbound email

Mediumcaa

observatory.rec.caa_absent

Lowbimi

Add a BIMI record with your logo to improve brand visibility in inboxes

Lowmx

observatory.rec.mx_smtp_check

Lowmx

observatory.rec.mx_ip_blacklist_oneshot

Lowtls-rpt

Add a TLS-RPT record to receive TLS failure reports

Understanding the company audit

Each company in the Observatory is analyzed weekly for email authentication standards. The audit provides a comprehensive view of the company's email security posture.

What this page shows:

  • Total score - A score out of 100 reflecting overall email security maturity
  • Letter grade - From A+ (excellent) to F (significant gaps)
  • Per-standard analysis - Individual scores for SPF, DKIM, DMARC, BIMI, MTA-STS, DANE/TLSA and DNSSEC
  • Recommendations - Prioritized steps to improve the score

Standards evaluated

  1. SPF - Sender Policy Framework prevents unauthorized servers from sending email on behalf of the domain
  2. DKIM - DomainKeys Identified Mail ensures emails are signed and unaltered during transit
  3. DMARC - Domain-based Message Authentication, Reporting and Conformance ties SPF and DKIM together with a policy
  4. BIMI - Brand Indicators for Message Identification displays the brand logo in supporting email clients
  5. MTA-STS - Mail Transfer Agent Strict Transport Security enforces TLS encryption for inbound email
  6. DNSSEC - Domain Name System Security Extensions prevent DNS spoofing attacks

FAQ - Frequently asked questions

Q: How is the score calculated?

A: Points are awarded for each standard based on configuration quality, totaling up to 100.

Q: What do the grades mean?

A: A+ is excellent (90-100), F indicates significant gaps (below 50).

PagePurpose
Observatory DashboardOverall overview with key metrics
StatisticsCross-index and cross-sector comparison
Email Domain CheckAudit your own domain