Skip to main content
CaptainDNS

🇭🇰 Email Security in Hong Kong

Weekly audit of email security across 23 listed companies headquartered in Hong Kong.

23 companies analyzed · Scan week: 2026-10-26

  • Listed companies headquartered in Hong Kong score an average of 43/100 for email authentication and DNS security.
  • 0% of Hong Kong companies achieve grades A+ or A in email security, while 61% score D or F.
  • This is 1 points below the global average of 44 across all 1601 companies in the observatory.
  • DMARC email authentication is deployed by 78.3% of Hong Kong companies, with 17.4% enforcing a reject policy to prevent domain spoofing.
  • SPF records are published on 96% of analyzed domains, authorizing legitimate email senders.
  • BIMI brand indicator adoption stands at 0% in Hong Kong.
  • MTA-STS enforced TLS encryption is deployed by 0% of companies, securing inbound email delivery.
  • DNSSEC domain signing is active on 13% of Hong Kong domains.
  • The highest-scoring company is Hong Kong Exchanges and Clearing with 59/100 (C).
  • Sands China trails at 12/100, with significant room for improvement.
  • Scores range from 12 to 59 with a median of 45, showing disparate email security postures across Hong Kong listed companies.

Average score

43/ 100

DMARC reject

17.4%

BIMI configured

0%

MTA-STS enforce

0%

DNSSEC enabled

13%

0
A+
0
A
0
B
9
C
9
D
5
F

43

Average

45

Median

12

Min

59

Max

Grade
1Hong Kong Exchanges and Clearinghkexgroup.com59C
2Power Assets Holdingspowerassets.com56C
3CK Infrastructurecki.com.hk56C
4CK Asset Holdingsckah.com56C
5Chow Tai Fookchowtaifook.com54C
6CLP Holdingsclpgroup.com53-1C
7MTR Corporationmtr.com.hk53C
8Galaxy Entertainmentgalaxyentertainment.com52+9C
9BOC Hong Kongbochk.com50C
10Link REITlinkreit.com49+6D
11Techtronic Industriesttigroup.com46D
12Orient Overseas Container Lineoocl.com45D
13Henderson Landhld.com44D
14New World Developmentnwd.com.hk43+9D
15Hang Seng Bankhangseng.com43D
16Budweiser APACbudweiserapac.com42D
17CK Hutchisonckh.com.hk42D
18AIA Groupaia.com36D
19Hang Lung Propertieshanglung.com28F
20Wharf REICwharfreic.com27F
21Kingboard Holdingskingboard.com26F
22Sun Hung Kai Propertiesshkp.com25F
23Sands Chinasandschina.com12F

Understanding country-level analysis

Grouping companies by country reveals how corporate email security practices vary across markets. Countries with stricter regulatory environments or more mature cybersecurity ecosystems tend to show higher average scores.

What this page shows:

  • Average score - The mean email security score across all listed companies in this country
  • Grade distribution - How many companies fall into each grade bracket (A+ through F)
  • DMARC reject rate - The percentage of companies enforcing strict DMARC policies
  • Company table - Individual scores, grades and key indicator status

Key standards tracked

Each company is evaluated on:

  1. SPF - Is the sending policy properly configured? Does it use -all (hard fail)?
  2. DKIM - Are signing keys published and strong enough (2048-bit minimum)?
  3. DMARC - Is a policy in place? Is it set to quarantine or reject?
  4. BIMI - Is the brand logo published for inbox display?
  5. MTA-STS - Is inbound email transport encryption enforced?
  6. DNSSEC - Is the DNS zone signed to prevent spoofing?

FAQ - Frequently asked questions

Q: How are companies grouped by country?

A: Based on the stock exchange where they are listed.

Q: What standards are checked?

A: SPF, DKIM, DMARC, BIMI, MTA-STS, DANE/TLSA and DNSSEC.

Q: Can I compare countries?

A: Yes, via the Statistics page.

PagePurpose
Observatory DashboardOverall overview with key metrics
StatisticsCross-country and cross-sector comparison
Email Domain CheckAudit your own domain