How are companies within an index scored?

Each company's primary domain is analyzed for SPF, DKIM, DMARC, BIMI, MTA-STS, DANE/TLSA and DNSSEC. Points are awarded for each standard based on its quality and strictness, totaling up to 100.

What does the grade distribution tell me?

The grade distribution shows the spread of scores across all companies in the index. If most companies score A or A+, the index has strong overall email security. A wide spread from A+ to F indicates significant variation.

Why might a well-known company score poorly?

Email security configuration is often managed independently from other cybersecurity controls. A company may have strong network security but still lack proper DMARC enforcement or MTA-STS deployment.

How often are scores updated?

All domains are rescanned weekly. Changes in DNS records are reflected in the next weekly scan.

CAC 40 - Email Security Scores

Company

		Country		Grade	DMARC	SPF	BIMI	MTA-STS	DANE-TLSA	DNSSEC
1	Schneider Electricse.com	🇫🇷 France	73	B	reject	-all	✗	✗	✗	✓
2	BNP Paribasbnpparibas.com	🇫🇷 France	70	B	reject	-all	✓	✗	✗	✓
3	Thalesthalesgroup.com	🇫🇷 France	69	C	quarantine	-all	✗	✗	✗	✓
4	Stellantisstellantis.com	🇳🇱 Netherlands	69	C	reject	-all	✗	✗	✗	✓
5	ArcelorMittalarcelormittal.com	🇱🇺 Luxembourg	68	C	none	-all	✗	✗	✗	✓
6	Vivendivivendi.com	🇫🇷 France	67	C	quarantine	~all	✗	✗	✗	✓
7	Danonedanone.com	🇫🇷 France	67	C	quarantine	~all	✗	✓	✗	✗
8	Eurofins Scientificeurofins.com	🇱🇺 Luxembourg	66	C	reject	-all	✗	✗	✗	✓
9	Orangeorange.com	🇫🇷 France	66	C	none	-all	✗	✗	✗	✓
10	STMicroelectronicsst.com	🇨🇭 Switzerland	59	C	reject	-all	✗	✗	✗	✗
11	Capgeminicapgemini.com	🇫🇷 France	59	C	reject	~all	✗	✗	✗	✓
12	LVMHlvmh.com	🇫🇷 France	59	C	reject	-all	✗	✗	✗	✗
13	Hermèshermes.com	🇫🇷 France	58	C	reject	-all	✗	✗	✗	✗
14	Airbusairbus.com	🇳🇱 Netherlands	58	C	reject	-all	✗	✗	✗	✗
15	Air Liquideairliquide.com	🇫🇷 France	57	C	reject	-all	✗	✗	✗	✗
16	Michelinmichelin.com	🇫🇷 France	56	C	quarantine	~all	✗	✗	✗	✓
17	Renaultrenaultgroup.com	🇫🇷 France	55	C	reject	~all	✗	✗	✗	✗
18	Bureau Veritasbureauveritas.com	🇫🇷 France	55	C	quarantine	-all	✗	✗	✗	✗
19	L'Oréalloreal.com	🇫🇷 France	55	C	quarantine	-all	✗	✗	✗	✗
20	Unibail-Rodamco-Westfieldurw.com	🇫🇷 France	55	C	reject	~all	✗	✗	✗	✗
21	Saint-Gobainsaint-gobain.com	🇫🇷 France	55	C	reject	~all	✗	✗	✗	✗
22	Dassault Systèmes3ds.com	🇫🇷 France	55	C	reject	~all	✗	✗	✗	✗
23	Veoliaveolia.com	🇫🇷 France	54	C	reject	~all	✗	✗	✗	✗
24	TotalEnergiestotalenergies.com	🇫🇷 France	54	C	reject	-all	✗	✗	✗	✗
25	Sanofisanofi.com	🇫🇷 France	54	C	quarantine	~all	✓	✗	✗	✗
26	Bouyguesbouygues.com	🇫🇷 France	51	C	quarantine	-all	✗	✗	✗	✗
27	Carrefourcarrefour.com	🇫🇷 France	51	C	none	-all	✗	✗	✗	✗
28	EssilorLuxotticaessilorluxottica.com	🇫🇷 France	49	D	reject	~all	✗	✗	✗	✗
29	Vincivinci.com	🇫🇷 France	49	D	reject	-all	✗	✗	✗	✗
30	Teleperformancetp.com	🇫🇷 France	49	D	none	~all	✗	✗	✗	✗
31	Legrandlegrand.com	🇫🇷 France	47	D	quarantine	-all	✗	✗	✗	✗
32	Société Généralesocietegenerale.com	🇫🇷 France	47	D	reject	-all	✗	✗	✗	✗
33	Engieengie.com	🇫🇷 France	47	D	reject	-all	✓	✗	✗	✗
34	Pernod Ricardpernod-ricard.com	🇫🇷 France	46	D	quarantine	~all	✗	✗	✗	✗
35	Keringkering.com	🇫🇷 France	44	D	reject	-all	✗	✗	✗	✗
36	Publicis Groupepublicisgroupe.com	🇫🇷 France	42	D	none	~all	✗	✗	✗	✗
37	Crédit Agricolecredit-agricole.com	🇫🇷 France	40	D	reject	-all	✗	✗	✗	✗
38	Alstomalstom.com	🇫🇷 France	39	D	reject	-all	✗	✗	✗	✗
39	AXAaxa.com	🇫🇷 France	38	D	none	~all	✗	✗	✗	✗
40	Safransafran-group.com	🇫🇷 France	15	F	—	-all	✗	✗	✗	✗

Understanding index-level analysis

A stock index groups the largest companies in a market. Analyzing their email security provides a representative snapshot of how a country's or region's corporate sector protects against email-based threats.

What this page shows:

Average score - The mean email security score across all constituent companies
Grade distribution - How many companies fall into each grade bracket (A+ through F)
Company table - Individual scores, grades and key indicator status for each company
Sector breakdown - How different industries within the index compare

Key standards tracked

Each company is evaluated on:

SPF - Is the sending policy properly configured? Does it use -all (hard fail)?
DKIM - Are signing keys published and strong enough (2048-bit minimum)?
DMARC - Is a policy in place? Is it set to quarantine or reject?
BIMI - Is the brand logo published for inbox display?
MTA-STS - Is inbound email transport encryption enforced?
DNSSEC - Is the DNS zone signed to prevent spoofing?

FAQ - Frequently asked questions

Q: How are companies scored?

A: Each domain is analyzed for email authentication standards and awarded up to 100 points across three pillars.

Q: What does the grade distribution show?

A: The spread of scores from A+ to F, indicating overall index maturity.

Q: Can I compare indices?

A: Yes, via the Statistics page.

Page	Purpose
Observatory Dashboard	Overall overview with key metrics
Statistics	Cross-index and cross-sector comparison
Email Domain Check	Audit your own domain

🇫🇷 CAC 40 Email Security

Company

Understanding index-level analysis

Key standards tracked

FAQ - Frequently asked questions

Related pages