Rankings
Who actually authenticates their email?
We scanned the inbound email authentication of 1436 well-known domains and grouped the notable ones into cohorts. Each ranking lists every member domain and links to its full dossier. Scanned August 13, 2026.
Across all 1436 domains
- have SPF
- 90.3%
- publish DMARC
- 82.7%
- enforce DMARC
- 65%
- sit on p=none
- 17.8%
- run MTA-STS
- 4.2%
- run TLS-RPT
- 5.7%
Methodology and the full write-up live in The State of Email Authentication 2026; every check is defined in methodology v1.
Cohorts
Email security of 67 banks & fintechsThe domains that move money have the most to lose from a spoofed email — here is how their inbound email authentication actually holds up.View the ranking →Email security of 65 news organizationsNewsrooms are prime impersonation targets. This is where the world's mastheads sit on SPF, DMARC, and DKIM.View the ranking →Email security of 18 AI companiesThe labs shipping frontier models, graded on the unglamorous email-security basics.View the ranking →Email security of 24 Big Tech domainsThe platforms everyone else defers to on security — measured against the same email-authentication checklist.View the ranking →Email security of 39 government agencies & portalsUS federal agencies have been under a DMARC-enforcement mandate (BOD 18-01) since 2018 — here is how government domains worldwide actually score on it.View the ranking →Email security of 18 universitiesSprawling, decentralised IT and a domain every student trusts — universities are a spoofing target with an unusually hard email-auth problem.View the ranking →Email security of 31 retailers & marketplacesFake order confirmations and delivery scams all start with a spoofed retail domain — this is how the big marketplaces and brands hold up.View the ranking →Email security of 40 security & privacy vendorsPassword managers, VPNs, and security platforms sell trust for a living — graded here on the same email-authentication basics they audit everyone else on.View the ranking →Email security of 442 security & compliance consultanciesvCISO practices, SOC 2 and ISO 27001 consultancies audit everyone else's email authentication for a living. This is how their own domains score on the same checks.View the ranking →
Where does your domain stand?
Run the same 15 checks on your own domain — free, no signup. If you need the result as evidence, the signed Domain Audit Report turns it into a dated artifact your auditor can verify.