News & media
Email security of 65 news organizations
Newsrooms are prime impersonation targets. This is where the world's mastheads sit on SPF, DMARC, and DKIM.
Across these 65 domains, 93.8% publish SPF, 92.3% publish DMARC and 73.8% enforce it (reject or quarantine), 18.5% sit on p=none, and 75.4% sign with DKIM. Scanned August 13, 2026.
Every domain in this cohort
| Domain | SPF | DMARC | DKIM | MTA-STS | TLS-RPT |
|---|---|---|---|---|---|
| abc.net.au | Softfail | Reject | No | No | No |
| ap.org | Softfail | Reject | Yes | No | No |
| apnews.com | Softfail | Reject | Yes | No | No |
| arstechnica.com | Softfail | Reject | Yes | No | No |
| bbc.co.uk | Softfail | Reject | No | No | No |
| bbc.com | Softfail | Reject | No | No | No |
| bloomberg.com | Hardfail | Reject | No | No | No |
| businessinsider.com | Softfail | Reject | Yes | No | No |
| buzzfeednews.com | Hardfail | Quarantine | No | No | No |
| cnn.com | Softfail | Reject | Yes | No | No |
| dailymail.co.uk | Hardfail | Reject | Yes | No | No |
| economist.com | Softfail | Quarantine | Yes | No | No |
| elpais.com | Hardfail | Reject | Yes | No | No |
| engadget.com | Softfail | Reject | Yes | No | No |
| fastcompany.com | Softfail | Quarantine | Yes | No | No |
| forbes.com | Present | Reject | Yes | No | No |
| fortune.com | Hardfail | Reject | Yes | No | No |
| foxnews.com | Hardfail | Reject | No | No | No |
| gizmodo.com | Hardfail | Quarantine | Yes | No | No |
| hindustantimes.com | Softfail | Quarantine | Yes | No | No |
| huffpost.com | Hardfail | Quarantine | Yes | No | No |
| independent.co.uk | Hardfail | Quarantine | Yes | No | No |
| lemonde.fr | Hardfail | Quarantine | Yes | No | No |
| mashable.com | Softfail | Quarantine | Yes | No | No |
| mirror.co.uk | Softfail | Quarantine | No | No | No |
| ndtv.com | Softfail | Reject | Yes | No | No |
| news24.com | Softfail | Quarantine | Yes | No | No |
| nikkei.com | None | Quarantine | No | No | No |
| npr.org | Hardfail | Reject | Yes | No | No |
| nytimes.com | Softfail | Reject | Yes | No | No |
| pbs.org | Softfail | Reject | Yes | No | No |
| politico.com | Softfail | Quarantine | Yes | No | No |
| propublica.org | Softfail | Quarantine | Yes | No | No |
| reuters.com | Hardfail | Reject | Yes | No | No |
| scmp.com | Softfail | Quarantine | Yes | No | No |
| slate.com | Softfail | Reject | Yes | No | No |
| smh.com.au | Softfail | Reject | Yes | No | No |
| spiegel.de | Hardfail | Quarantine | Yes | No | No |
| straitstimes.com | Softfail | Reject | Yes | No | No |
| techcrunch.com | Hardfail | Reject | Yes | No | No |
| telegraph.co.uk | Softfail | Reject | Yes | Yes | Yes |
| theguardian.com | Hardfail | Reject | Yes | Yes | Yes |
| thetimes.co.uk | Softfail | Reject | Yes | No | No |
| theverge.com | Softfail | Reject | Yes | No | No |
| vox.com | Softfail | Reject | Yes | No | No |
| washingtonpost.com | Hardfail | Reject | No | No | No |
| wired.com | Softfail | Reject | Yes | No | No |
| wsj.com | Softfail | Quarantine | Yes | No | No |
| abcnews.com | None | Missing | No | No | No |
| asahi.com | Softfail | None (monitor) | Yes | No | No |
| cbsnews.com | Softfail | None (monitor) | Yes | No | No |
| corriere.it | Hardfail | None (monitor) | Yes | No | No |
| espn.com | Softfail | None (monitor) | Yes | No | No |
| faz.net | None | Missing | No | No | No |
| ft.com | Hardfail | Missing | No | No | No |
| indianexpress.com | Softfail | None (monitor) | Yes | No | No |
| lefigaro.fr | Softfail | None (monitor) | Yes | No | No |
| motherjones.com | Softfail | None (monitor) | Yes | No | No |
| nbcnews.com | Softfail | None (monitor) | No | No | No |
| thehindu.com | Softfail | Missing | No | No | No |
| theintercept.com | Softfail | None (monitor) | Yes | No | No |
| thenextweb.com | Hardfail | None (monitor) | No | Yes | Yes |
| timesofindia.indiatimes.com | None | Missing | No | No | No |
| venturebeat.com | Present | None (monitor) | Yes | No | No |
| zeit.de | Softfail | None (monitor) | Yes | No | No |
Where does your domain stand?
Run the same 15 checks on your own domain — free, no signup. If you need the result as evidence, the signed Domain Audit Report turns it into a dated artifact your auditor can verify.