Security & privacy vendors
Email security of 40 security & privacy vendors
Password managers, VPNs, and security platforms sell trust for a living — graded here on the same email-authentication basics they audit everyone else on.
Across these 40 domains, 92.5% publish SPF, 95% publish DMARC and 82.5% enforce it (reject or quarantine), 12.5% sit on p=none, and 60% sign with DKIM. Scanned June 24, 2026.
Every domain in this cohort
| Domain | SPF | DMARC | DKIM | MTA-STS | TLS-RPT |
|---|---|---|---|---|---|
| 1password.com | Softfail | Quarantine | Yes | No | No |
| auth0.com | Hardfail | Quarantine | Yes | No | No |
| beyondidentity.com | Hardfail | Quarantine | Yes | No | No |
| bitwarden.com | Softfail | Reject | Yes | No | No |
| checkmarx.com | Hardfail | Quarantine | Yes | No | No |
| cyberghostvpn.com | Hardfail | Quarantine | No | No | No |
| dashlane.com | Hardfail | Reject | Yes | No | No |
| duo.com | Softfail | Reject | Yes | No | No |
| expressvpn.com | None | Quarantine | No | No | No |
| gitguardian.com | Hardfail | Reject | Yes | No | No |
| hardenize.com | Softfail | Reject | Yes | No | Yes |
| infisical.com | Softfail | Quarantine | Yes | No | No |
| ivpn.net | Hardfail | Reject | No | No | No |
| lastpass.com | Present | Reject | Yes | No | No |
| mullvad.net | Hardfail | Reject | No | No | No |
| nordpass.com | Hardfail | Reject | Yes | No | No |
| nordvpn.com | Hardfail | Reject | Yes | No | No |
| okta.com | Softfail | Reject | No | No | No |
| onelogin.com | Hardfail | Reject | Yes | No | No |
| openvpn.net | Softfail | Quarantine | Yes | No | No |
| protonmail.com | Softfail | Quarantine | No | No | No |
| protonvpn.com | Softfail | Quarantine | No | No | No |
| purevpn.com | Softfail | Quarantine | Yes | No | No |
| securitytrails.com | Hardfail | Quarantine | No | No | No |
| signal.org | Softfail | Quarantine | Yes | Yes | Yes |
| snyk.io | Softfail | Quarantine | Yes | No | No |
| surfshark.com | Softfail | Reject | Yes | No | No |
| tailscale.com | Softfail | Reject | Yes | No | No |
| torguard.net | Hardfail | Quarantine | Yes | No | No |
| tutanota.com | Hardfail | Quarantine | No | Yes | Yes |
| veracode.com | Softfail | Reject | No | No | No |
| windscribe.com | Softfail | Quarantine | No | No | No |
| yubico.com | Softfail | Reject | Yes | Yes | Yes |
| censys.io | Softfail | None (monitor) | Yes | No | No |
| keeperpasswordmanager.com | None | Missing | No | No | No |
| shodan.io | Hardfail | None (monitor) | No | No | No |
| torproject.org | Softfail | None (monitor) | No | No | No |
| truffle-security.com | None | Missing | No | No | No |
| tunnelbear.com | Hardfail | None (monitor) | No | No | No |
| zerotier.com | Softfail | None (monitor) | Yes | No | No |
Where does your domain stand?
Run the same 15 checks on your own domain — free, no signup. If you need the result as evidence, the signed Domain Audit Report turns it into a dated artifact your auditor can verify.