How are companies within an index scored?

Each company's primary domain is analyzed for SPF, DKIM, DMARC, BIMI, MTA-STS, DANE/TLSA and DNSSEC. Points are awarded for each standard based on its quality and strictness, totaling up to 100.

What does the grade distribution tell me?

The grade distribution shows the spread of scores across all companies in the index. If most companies score A or A+, the index has strong overall email security. A wide spread from A+ to F indicates significant variation.

Why might a well-known company score poorly?

Email security configuration is often managed independently from other cybersecurity controls. A company may have strong network security but still lack proper DMARC enforcement or MTA-STS deployment.

How often are scores updated?

All domains are rescanned weekly. Changes in DNS records are reflected in the next weekly scan.

DAX 40 - Email Security Scores

Company

		Country		Grade	DMARC	SPF	BIMI	MTA-STS	DANE-TLSA	DNSSEC
1	Beiersdorfbeiersdorf.com	🇩🇪 Germany	90	A	reject	-all	✓	✓	✓	✓
2	Freseniusfresenius.com	🇩🇪 Germany	81	B	reject	-all	✗	✓	✗	✓
3	Heidelberg Materialsheidelbergmaterials.com	🇩🇪 Germany	75	B	reject	-all	✗	✓	✗	✗
4	Münchener Rück (Munich Re)munichre.com	🇩🇪 Germany	73	B	reject	-all	✗	✗	✗	✓
5	Merck KGaAmerckgroup.com	🇩🇪 Germany	70	B	reject	~all	✗	✗	✗	✓
6	Commerzbankcommerzbank.com	🇩🇪 Germany	70	B	reject	-all	✓	✓	✗	✗
7	BASFbasf.com	🇩🇪 Germany	67-3	C	reject	~all	✓	✓	✗	✗
8	Henkelhenkel.com	🇩🇪 Germany	65	C	quarantine	-all	✗	✓	✗	✗
9	Sartoriussartorius.com	🇩🇪 Germany	64	C	reject	-all	✓	✓	✗	✓
10	Porsche AGporsche.com	🇩🇪 Germany	63	C	reject	-all	✓	✗	✗	✓
11	Siemenssiemens.com	🇩🇪 Germany	61	C	reject	-all	✓	✗	✓	✓
12	SAPsap.com	🇩🇪 Germany	60+2	C	reject	-all	✗	✗	✗	✗
13	Allianzallianz.com	🇩🇪 Germany	60	C	reject	~all	✗	✓	✗	✗
14	Covestrocovestro.com	🇩🇪 Germany	59	C	none	~all	✗	✓	✗	✗
15	Airbusairbus.com	🇳🇱 Netherlands	58	C	reject	-all	✗	✗	✗	✗
16	MTU Aero Enginesmtu.de	🇩🇪 Germany	57	C	none	-all	✗	✗	✗	✗
17	Deutsche Bankdb.com	🇩🇪 Germany	56+1	C	reject	~all	✗	✗	✗	✗
18	Brenntagbrenntag.com	🇩🇪 Germany	56	C	reject	~all	✗	✗	✗	✗
19	BMWbmwgroup.com	🇩🇪 Germany	55	C	quarantine	-all	✗	✗	✗	✗
20	Siemens Energysiemens-energy.com	🇩🇪 Germany	54	C	reject	-all	✗	✗	✗	✗
21	Porsche SEporsche-se.com	🇩🇪 Germany	54	C	none	-all	✗	✗	✗	✓
22	Siemens Healthineerssiemens-healthineers.com	🇩🇪 Germany	53+1	C	reject	-all	✗	✗	✗	✗
23	Deutsche Börsedeutsche-boerse.com	🇩🇪 Germany	52	C	reject	-all	✗	✗	✗	✗
24	Qiagenqiagen.com	🇳🇱 Netherlands	52	C	reject	~all	✓	✓	✗	✗
25	RWErwe.com	🇩🇪 Germany	52	C	reject	-all	✗	✗	✗	✗
26	Adidasadidas-group.com	🇩🇪 Germany	51	C	reject	~all	✗	✗	✗	✗
27	Symrisesymrise.com	🇩🇪 Germany	49	D	reject	~all	✗	✗	✗	✗
28	Deutsche Post (DHL)dpdhl.com	🇩🇪 Germany	48	D	reject	~all	✗	✗	✗	✗
29	Daimler Truckdaimlertruck.com	🇩🇪 Germany	48	D	quarantine	-all	✗	✗	✗	✗
30	E.ONeon.com	🇩🇪 Germany	47-2	D	quarantine	—	✗	✓	✗	✗
31	Deutsche Telekomtelekom.com	🇩🇪 Germany	46	D	quarantine	~all	✗	✗	✗	✗
32	Continentalcontinental.com	🇩🇪 Germany	45	D	none	-all	✗	✗	✗	✗
33	Infineoninfineon.com	🇩🇪 Germany	45	D	none	~all	✗	✗	✗	✗
34	Deutsche Lufthansalufthansagroup.com	🇩🇪 Germany	43	D	reject	—	✗	✗	✗	✓
35	Mercedes-Benzmercedes-benz.com	🇩🇪 Germany	43	D	reject	~all	✗	✗	✗	✗
36	Hannover Rehannover-re.com	🇩🇪 Germany	40	D	none	-all	✗	✗	✗	✗
37	Bayerbayer.com	🇩🇪 Germany	31	D	none	-all	✗	✗	✗	✗
38	Vonoviavonovia.com	🇩🇪 Germany	29	F	—	—	✗	✗	✗	✓
39	Rheinmetallrheinmetall.com	🇩🇪 Germany	27	F	none	~all	✗	✗	✗	✗
40	Zalandocorporate.zalando.com	🇩🇪 Germany	19+1	F	reject	—	✗	✗	✗	✗

Understanding index-level analysis

A stock index groups the largest companies in a market. Analyzing their email security provides a representative snapshot of how a country's or region's corporate sector protects against email-based threats.

What this page shows:

Average score - The mean email security score across all constituent companies
Grade distribution - How many companies fall into each grade bracket (A+ through F)
Company table - Individual scores, grades and key indicator status for each company
Sector breakdown - How different industries within the index compare

Key standards tracked

Each company is evaluated on:

SPF - Is the sending policy properly configured? Does it use -all (hard fail)?
DKIM - Are signing keys published and strong enough (2048-bit minimum)?
DMARC - Is a policy in place? Is it set to quarantine or reject?
BIMI - Is the brand logo published for inbox display?
MTA-STS - Is inbound email transport encryption enforced?
DNSSEC - Is the DNS zone signed to prevent spoofing?

FAQ - Frequently asked questions

Q: How are companies scored?

A: Each domain is analyzed for email authentication standards and awarded up to 100 points across three pillars.

Q: What does the grade distribution show?

A: The spread of scores from A+ to F, indicating overall index maturity.

Q: Can I compare indices?

A: Yes, via the Statistics page.

Page	Purpose
Observatory Dashboard	Overall overview with key metrics
Statistics	Cross-index and cross-sector comparison
Email Domain Check	Audit your own domain

🇩🇪 DAX 40 Email Security

Company

Understanding index-level analysis

Key standards tracked

FAQ - Frequently asked questions

Related pages