How are companies within an index scored?

Each company's primary domain is analyzed for SPF, DKIM, DMARC, BIMI, MTA-STS, DANE/TLSA and DNSSEC. Points are awarded for each standard based on its quality and strictness, totaling up to 100.

What does the grade distribution tell me?

The grade distribution shows the spread of scores across all companies in the index. If most companies score A or A+, the index has strong overall email security. A wide spread from A+ to F indicates significant variation.

Why might a well-known company score poorly?

Email security configuration is often managed independently from other cybersecurity controls. A company may have strong network security but still lack proper DMARC enforcement or MTA-STS deployment.

How often are scores updated?

All domains are rescanned weekly. Changes in DNS records are reflected in the next weekly scan.

IBEX 35 - Email Security Scores

Company

		Country		Grade	DMARC	SPF	BIMI	MTA-STS	DANE-TLSA	DNSSEC
1	CaixaBankcaixabank.com	🇪🇸 Spain	75	B	reject	-all	✓	✗	✗	✓
2	Fluidrafluidra.com	🇪🇸 Spain	73	B	reject	-all	✗	✗	✗	✓
3	ArcelorMittalarcelormittal.com	🇱🇺 Luxembourg	68	C	none	-all	✗	✗	✗	✓
4	Amadeus IT Groupamadeus.com	🇪🇸 Spain	67	C	reject	-all	✗	✓	✗	✗
5	Repsolrepsol.com	🇪🇸 Spain	66+2	C	reject	-all	✓	✗	✗	✗
6	BBVAbbva.com	🇪🇸 Spain	59	C	reject	-all	✗	✗	✗	✗
7	Inditexinditex.com	🇪🇸 Spain	58	C	reject	-all	✗	✗	✗	✗
8	Acerinoxacerinox.com	🇪🇸 Spain	56	C	reject	~all	✗	✗	✗	✗
9	Aenaaena.es	🇪🇸 Spain	54	C	reject	-all	✗	✗	✗	✗
10	ACSgrupoacs.com	🇪🇸 Spain	53	C	reject	-all	✗	✗	✗	✗
11	International Consolidated Airlines Groupiairgroup.com	🇪🇸 Spain	52	C	reject	-all	✗	✗	✗	✗
12	Mapfremapfre.com	🇪🇸 Spain	52	C	reject	-all	✗	✗	✗	✗
13	Red Eléctricaree.es	🇪🇸 Spain	52	C	none	-all	✗	✗	✗	✗
14	Sacyrsacyr.com	🇪🇸 Spain	52	C	reject	-all	✗	✗	✗	✗
15	Enagásenagas.es	🇪🇸 Spain	50	C	quarantine	-all	✗	✗	✗	✗
16	EDP Renováveisedpr.com	🇪🇸 Spain	50	C	quarantine	-all	✗	✗	✗	✗
17	Cellnex Telecomcellnex.com	🇪🇸 Spain	49	D	quarantine	-all	✗	✗	✗	✗
18	Ferrovialferrovial.com	🇪🇸 Spain	49	D	reject	~all	✗	✗	✗	✗
19	Bankinterbankinter.com	🇪🇸 Spain	47	D	reject	-all	✗	✗	✗	✗
20	Banco Santandersantander.com	🇪🇸 Spain	47	D	reject	-all	✗	✗	✗	✗
21	Colonialinmocolonial.com	🇪🇸 Spain	46	D	none	~all	✗	✗	✗	✗
22	CIE Automotivecieautomotive.com	🇪🇸 Spain	46	D	quarantine	~all	✗	✗	✗	✗
23	Merlin Propertiesmerlinproperties.es	🇪🇸 Spain	46	D	none	~all	✗	✗	✗	✗
24	Naturgynaturgy.com	🇪🇸 Spain	46	D	reject	-all	✓	✗	✗	✗
25	Accionaacciona.com	🇪🇸 Spain	46	D	none	-all	✗	✗	✗	✗
26	Unicaja Bancounicajabanco.es	🇪🇸 Spain	45	D	reject	-all	✗	✗	✗	✗
27	Indraindracompany.com	🇪🇸 Spain	44	D	quarantine	-all	✗	✗	✗	✗
28	Iberdrolaiberdrola.com	🇪🇸 Spain	43+2	D	reject	-all	✗	✗	✗	✗
29	Telefónicatelefonica.com	🇪🇸 Spain	42	D	none	-all	✗	✗	✗	✗
30	Grifolsgrifols.com	🇪🇸 Spain	36	D	reject	-all	✗	✗	✗	✗
31	Endesaendesa.com	🇪🇸 Spain	33	D	reject	-all	✗	✗	✗	✗
32	PharmaMarpharmamar.com	🇪🇸 Spain	32	D	quarantine	~all	✗	✗	✗	✗
33	Solariasolaria.es	🇪🇸 Spain	32	D	—	~all	✗	✗	✗	✗
34	Meliá Hotelsmeliahotelsinternational.com	🇪🇸 Spain	31+2	D	reject	—	✗	✗	✗	✗
35	Banco Sabadellgrupbancsabadell.com	🇪🇸 Spain	15	F	—	—	✗	✗	✗	✓

Understanding index-level analysis

A stock index groups the largest companies in a market. Analyzing their email security provides a representative snapshot of how a country's or region's corporate sector protects against email-based threats.

What this page shows:

Average score - The mean email security score across all constituent companies
Grade distribution - How many companies fall into each grade bracket (A+ through F)
Company table - Individual scores, grades and key indicator status for each company
Sector breakdown - How different industries within the index compare

Key standards tracked

Each company is evaluated on:

SPF - Is the sending policy properly configured? Does it use -all (hard fail)?
DKIM - Are signing keys published and strong enough (2048-bit minimum)?
DMARC - Is a policy in place? Is it set to quarantine or reject?
BIMI - Is the brand logo published for inbox display?
MTA-STS - Is inbound email transport encryption enforced?
DNSSEC - Is the DNS zone signed to prevent spoofing?

FAQ - Frequently asked questions

Q: How are companies scored?

A: Each domain is analyzed for email authentication standards and awarded up to 100 points across three pillars.

Q: What does the grade distribution show?

A: The spread of scores from A+ to F, indicating overall index maturity.

Q: Can I compare indices?

A: Yes, via the Statistics page.

Page	Purpose
Observatory Dashboard	Overall overview with key metrics
Statistics	Cross-index and cross-sector comparison
Email Domain Check	Audit your own domain

🇪🇸 IBEX 35 Email Security

Company

Understanding index-level analysis

Key standards tracked

FAQ - Frequently asked questions

Related pages