Live data / Email Security Index
Can the best-known brands be impersonated?
48 banks, payment companies, tech giants, shops, work tools and newsrooms, graded with the same report card you can run on your own domain. From public DNS, refreshed every six hours.
Only 6 of 48 protect the email sent to them with MTA-STS.
Every brand here stops forged email “from” itself (42 with p=reject). But without MTA-STS, delivery to them can be silently downgraded to unencrypted — and only one of 48 earns an A.
- Average grade score
- 74/100
- Enforce DMARC
- 100%
- MTA-STS
- 13%
- BIMI logo
- 46%
- DNSSEC
- 15%
Measured 2026-11-07 12:27 UTC. Share on LinkedIn · Post on X · Open data (JSON)
By sector
Grades
All brands, best protected first
| # | Domain | Grade | DMARC | MTA-STS | BIMI | DNSSEC |
|---|---|---|---|---|---|---|
| 1 | ikea.comShopping | A 100 | reject | Yes | Yes | Yes |
| 2 | paypal.comPayments and fintech | B 88 | reject | — | Yes | Yes |
| 3 | cloudflare.comBig tech | B 86 | reject | — | — | Yes |
| 4 | ing.comBanks | B 82 | reject | — | — | Yes |
| 5 | microsoft.comBig tech | B 82 | reject | Yes | — | — |
| 6 | theguardian.comNews | B 82 | reject | Yes | — | — |
| 7 | notion.soWork software | B 82 | quarantine | — | Yes | — |
| 8 | atlassian.comWork software | B 80 | reject | — | Yes | — |
| 9 | bankofamerica.comBanks | B 80 | reject | — | Yes | — |
| 10 | ebay.comShopping | B 80 | reject | — | Yes | — |
| 11 | klarna.comPayments and fintech | B 80 | reject | — | Yes | — |
| 12 | mailchimp.comWork software | B 80 | reject | — | Yes | — |
| 13 | google.comBig tech | B 78 | reject | Yes | — | — |
| 14 | salesforce.comWork software | B 78 | reject | — | — | Yes |
| 15 | cnn.comNews | B 76 | reject | — | Yes | — |
| 16 | reuters.comNews | B 76 | reject | — | Yes | — |
| 17 | shopify.comShopping | B 76 | reject | — | Yes | — |
| 18 | x.comBig tech | B 76 | reject | — | Yes | — |
| 19 | zalando.comShopping | B 76 | reject | — | Yes | — |
| 20 | apple.comBig tech | B 76 | quarantine | — | Yes | — |
| 21 | revolut.comPayments and fintech | B 76 | quarantine | — | Yes | — |
| 22 | facebook.comBig tech | B 75 | reject | Yes | — | — |
| 23 | coinbase.comPayments and fintech | C 74 | reject | — | — | — |
| 24 | db.comBanks | C 74 | reject | — | — | — |
| 25 | nytimes.comNews | C 74 | reject | — | — | — |
| 26 | stripe.comPayments and fintech | C 74 | reject | — | — | — |
| 27 | target.comShopping | C 74 | reject | — | — | — |
| 28 | walmart.comShopping | C 74 | reject | — | — | — |
| 29 | zoom.usWork software | C 74 | reject | — | — | — |
| 30 | bbc.co.ukNews | C 72 | reject | — | Yes | — |
| 31 | chase.comBanks | C 72 | reject | — | Yes | — |
| 32 | dropbox.comWork software | C 72 | reject | — | Yes | — |
| 33 | adyen.comPayments and fintech | C 70 | reject | — | — | — |
| 34 | booking.comShopping | C 70 | reject | — | — | — |
| 35 | hsbc.comBanks | C 70 | reject | — | — | — |
| 36 | squareup.comPayments and fintech | C 70 | reject | — | — | — |
| 37 | github.comBig tech | C 70 | quarantine | — | — | — |
| 38 | wellsfargo.comBanks | C 68 | reject | — | Yes | — |
| 39 | wise.comPayments and fintech | C 68 | reject | Yes | Yes | — |
| 40 | barclays.co.ukBanks | C 66 | reject | — | — | — |
| 41 | bloomberg.comNews | C 66 | reject | — | — | — |
| 42 | washingtonpost.comNews | C 66 | reject | — | — | — |
| 43 | wsj.comNews | C 66 | quarantine | — | — | — |
| 44 | hubspot.comWork software | C 64 | reject | — | Yes | Yes |
| 45 | amazon.comBig tech | C 64 | quarantine | — | Yes | — |
| 46 | slack.comWork software | C 62 | reject | — | — | Yes |
| 47 | santander.comBanks | D 59 | reject | — | — | — |
| 48 | etsy.comShopping | D 42 | reject | — | — | — |
How it’s measured
Each domain is checked from public DNS with the same inbox check and report card anyone can run, every six hours. The grade counts SPF and DKIM (25), DMARC enforcement (30), the bulk-sender rules (15), MTA-STS (8), TLS-RPT (4), DNSSEC (8), CAA (4) and BIMI (6). DKIM keys under private selector names can’t be seen from DNS; with DMARC enforced that is scored as unverified, not missing.
It measures what public DNS shows about email impersonation and delivery, nothing more: not a company’s security overall, its mail filtering, or its staff training. The brands were chosen for being widely known and impersonated, not to single anyone out. Spotted something wrong? Tell us and it’s re-checked.