Written by Psychevus
Published
Every six hours, this site checks the public email setup of 48 companies most people have heard of: banks, payment firms, big tech, shops, work software and newsrooms. When I went through the numbers on 7 November, one thing stood out more than any of the grades.
None of them can be easily impersonated anymore. But only 7 of the 48 protect the mail people send to them, while 22 have gone to the trouble of getting their logo shown next to their messages in Gmail.
All 48 publish an enforced DMARC policy. 42 tell receiving servers to reject mail that fails the check outright. The other six (amazon.com, apple.com, github.com, notion.so, revolut.com and wsj.com) ask for it to go to spam instead.
A few years ago that would have been a surprising result. Gmail and Yahoo started requiring authentication from bulk senders in 2024, and big brands clearly took the hint. If someone sends a fake invoice "from" one of these domains today, it is very unlikely to reach an inbox.
DMARC only covers what a company sends. It does nothing for what it receives: replies from customers, invoices, signed contracts coming back from partners.
Mail servers usually encrypt the connection between them, but only if both sides agree, and that agreement happens in the open. Someone on the network path can strip the offer, and the sending server will quietly fall back to plain text. Nobody gets an error. Two standards exist to stop this, MTA-STS (RFC 8461) and DANE for SMTP (RFC 7672). Both let a domain say, in effect, "only deliver to me encrypted, and only to these servers."
Six brands publish an MTA-STS policy: facebook.com, google.com, ikea.com, microsoft.com, theguardian.com and wise.com. Cloudflare does the same job with DANE, and IKEA uses both. That makes seven. None of the eight banks in the index uses either.
BIMI is the record that puts a brand's logo next to its messages in Gmail, Apple Mail and Yahoo. For Gmail to show it, the company also needs a mark certificate, which costs money and comes with trademark paperwork.
22 of the 48 have set it up. So about three times as many of these companies have done the expensive thing that makes their email look trustworthy as have done the free thing that keeps email to them private.
To be fair, the two aren't competing for the same budget line. BIMI only works once DMARC is enforced, so having it says something good about a company's setup. I just didn't expect the order to come out this way.
An MTA-STS policy is one TXT record plus a short text file served over HTTPS. The careful way to roll it out is to publish it in testing mode, read the TLS reports mail providers send back (TLS-RPT) for a few weeks, and then switch to enforce. I set it up for this site in an afternoon.
DNSSEC, which DANE depends on, is usually a switch at the DNS provider plus a DS record at the registrar. The registrar part can be the slow bit: with mine, it has taken a support ticket. Only 7 of the 48 brands have DNSSEC turned on.
Everything here comes from public DNS, read over DNS-over-HTTPS (Cloudflare and Google) on 7 November 2026 and graded with the same report card anyone can run on their own domain. DANE only counts when a domain's mail servers have TLSA records that validate with DNSSEC. The index looks at what DNS reveals about impersonation and delivery, and nothing else. It says nothing about how well these companies filter spam or train their staff.
The data is open (CC BY 4.0) and refreshed every six hours, so these numbers will move. When a brand changes its setup, the change shows up in the index's change log.
A question, an idea, or just a hello.
Start a conversation