DNS Lookup
Choose a DNS record type to search for.
Propagation & diagnostics
Compare resolvers worldwide and inspect returned answers.
Keep history, monitor your zones and automate recurring checks.
Email authentication
Tools to verify and validate your email authentication setup.
Deliverability
Email deliverability audit
Audit MX, SPF, DKIM and DMARC to confirm a domain is ready to send.
Mail header analyzer
Decode participants, authentication results and routing from raw headers.
Email tester
Send a test email and get instant authentication and deliverability feedback.
IP Blacklist Checker
Check if your IP is on email blacklists
Domain Blacklist Checker
Check if your domain is on URI blacklists
SPF Flattener
Flatten SPF records to reduce DNS lookups below the 10-lookup limit.
DKIM Selector Finder
Auto-discover all DKIM selectors for a domain via DNS brute-force.
SMTP/MX Tester
Test SMTP connectivity of your MX servers: banner, STARTTLS, TLS certificate, open relay.
IP tools
Quickly inspect an IP address or your own connection.
My IP address
Detect your IPv4/IPv6 addresses and their geolocation.
Reverse lookup
Resolve a PTR record and validate DNS consistency.
IP WhoIs
Identify the owner of an IP range and its contacts.
IPv4 netmask
Calculate network, broadcast and usable hosts for any IPv4 block.
IPv6 subnet calculator
Calculate IPv6 subnets, address ranges and reverse DNS entries.
Text
Transform and measure your content in seconds.
Text case converter
Convert any block of text to upper or lower case instantly.
Slug generator
Transform any sentence into an SEO-friendly slug in seconds.
Word & character counter
Measure the length of any text, with instant word and character counts.
Password generator
Generate strong random passwords and memorable passphrases instantly.
Developer
Encoding, hashing, regex and formatting for everyday dev work.
Base64 encoder / decoder
Encode or decode any content in Base64 without leaving the browser.
Hash Generator
Compute MD5, SHA-1, SHA-256 and SHA-512 hashes of any text.
URL encoder / decoder
Encode or decode text using percent-encoding (RFC 3986) right in your browser.
Regex Tester
Test a regular expression against text and visualize matches.
JSON / YAML Formatter
Format, validate and convert JSON and YAML in one click.
Web & Certificates
BIMI logos, VMC/CSR certificates and web page diagnostics.
BIMI logo lookup
Inspect a BIMI logo URL - format, metadata and live rendering - before rollout.
BIMI SVG converter
Convert any SVG to BIMI-compliant Tiny-PS format in seconds.
CSR parser
Inspect a CSR, extract subject details, fingerprints and requested SANs.
VMC inspector
Inspect a Verified Mark Certificate - issuer, validity and SAN coverage - before you publish BIMI.
Page size checker
Check if your page exceeds Google's 2 MB crawl limit.
Phishing URL Checker
Check if a URL is flagged as phishing or malware by 4 threat intelligence sources.
SPF, DKIM, DMARC, BIMI and MTA-STS adoption rates by stock index, country and industry sector.
Scan week: 2026-03-02
40 companies
Average score
54
DMARC reject
57.5%
BIMI configured
7.5%
MTA-STS enforce
2.5%
DNSSEC enabled
25%
40 companies
Average score
55
DMARC reject
65%
BIMI configured
20%
MTA-STS enforce
30%
DNSSEC enabled
25%
100 companies
Average score
46
DMARC reject
61%
BIMI configured
7%
MTA-STS enforce
5%
DNSSEC enabled
8%
89 companies
Average score
33
DMARC reject
14.6%
BIMI configured
0%
MTA-STS enforce
0%
DNSSEC enabled
3.4%
50 companies
Average score
42
DMARC reject
56%
BIMI configured
26%
MTA-STS enforce
0%
DNSSEC enabled
34%
225 companies
Average score
29
DMARC reject
14.7%
BIMI configured
3.1%
MTA-STS enforce
0%
DNSSEC enabled
4%
50 companies
Average score
28
DMARC reject
6%
BIMI configured
0%
MTA-STS enforce
0%
DNSSEC enabled
2%
| Country | # | Average score | DMARC reject |
|---|---|---|---|
| 🇱🇺 Luxembourg | 2 | 67 | 50% |
| 🇳🇱 Netherlands | 5 | 59 | 100% |
| 🇩🇪 Germany | 38 | 55 | 63.2% |
| 🇫🇷 France | 35 | 52 | 54.3% |
| 🇪🇸 Spain | 1 | 52 | 100% |
| 🇮🇪 Ireland | 6 | 51 | 100% |
| 🇨🇭 Switzerland | 3 | 50 | 100% |
| 🇬🇧 United Kingdom | 93 | 45 | 57% |
| Country | # | Average score | DMARC reject |
|---|---|---|---|
| 🇨🇦 Canada | 2 | 65 | 100% |
| 🇺🇸 United States | 506 | 47 | 64.6% |
| 🇲🇽 Mexico | 1 | 32 | 0% |
| Country | # | Average score | DMARC reject |
|---|---|---|---|
| 🇮🇳 India | 50 | 42 | 56% |
| 🇭🇰 Hong Kong | 23 | 41 | 13% |
| 🇯🇵 Japan | 225 | 29 | 14.7% |
| 🇨🇳 China | 98 | 28 | 9.2% |
| Country | # | Average score | DMARC reject |
|---|---|---|---|
| 🇺🇾 Uruguay | 1 | 57 | 100% |
| Country | # | Average score | DMARC reject |
|---|---|---|---|
| 🇦🇺 Australia | 1 | 47 | 100% |
105 companies · 58.1% dmarc reject
89 companies · 65.2% dmarc reject
33 companies · 48.5% dmarc reject
137 companies · 65.7% dmarc reject
49 companies · 59.2% dmarc reject
55 companies · 36.4% dmarc reject
107 companies · 49.5% dmarc reject
68 companies · 54.4% dmarc reject
45 companies · 40% dmarc reject
47 companies · 36.2% dmarc reject
355 companies · 33% dmarc reject
These statistics provide a snapshot of how the world's largest listed companies protect their email infrastructure. Each metric tracks a specific email security standard and shows the percentage of companies that have deployed it correctly.
Key metrics explained:
p=reject, the strictest enforcement level-all (hard fail), blocking unauthorized sendersenforce mode, requiring TLS encryption for inbound emailEach stock index represents a national or regional sample of major companies. Comparing indices reveals global differences in cybersecurity priorities and regulatory influence.
Within each index, companies are grouped by industry sector. This reveals whether specific industries (e.g., banking, technology) systematically outperform others in email security.
The grade distribution shows how scores spread across companies. A healthy distribution skews toward A+/A. A wide spread from A+ to F indicates significant disparity in security maturity.
Q: What do the adoption percentages mean?
A: Each percentage represents the share of companies that have deployed a given standard correctly.
Q: Why do rates vary between indices?
A: Regulatory environments, industry composition and cybersecurity maturity differ across countries.
Q: What is the most important metric?
A: DMARC with a reject policy is the single most impactful email security control.
| Page | Purpose |
|---|---|
| Observatory Dashboard | Overall observatory overview with top and bottom companies |
| Email Domain Check | Audit your own domain's email security |