I checked the DMARC policies of 226 large European listed companies…

I run a small Spanish security site and for the last couple of months I've been measuring, every month, whether the corporate domains of Europe's biggest listed companies are protected against email spoofing. October's edition covers five indices: 266 index seats, 226 unique companies once you remove the overlap.

📊 The headline numbers (public DNS, measured 12 October 2026)

🔴 48 of 226 (21%) have no effective DMARC policy: either no record at all or p=none. Anyone can send mail "from" their corporate domain and the receiver is never asked to block it.

🟡 41 more only send forged mail to spam (quarantine) or only partly.

🟢 137 (61%) publish p=reject.

📉 By index, companies without an effective policy:

Euro Stoxx 50: 3 of 50

DAX 40: 7 of 40

CAC 40: 7 of 40

IBEX 35: 11 of 35

FTSE 100: 24 of 100 (8 with no DMARC record at all)

🔎 How it's measured

One domain per company: the corporate / investor relations site, not the consumer brand. It was cross-checked against Wikidata, Wikipedia and the IR pages, because Wikidata alone got 12 of them wrong.

It reads DMARC, SPF (following includes and redirects) and common DKIM selectors from public DNS, and gives a grade with the same open scoring as the free checker on the site.

Each edition is frozen once published, so a later fix doesn't rewrite history. Re-checking a domain today may give a different result, and that's the point of doing it monthly.

⚠️ Limits

It only looks at one domain per company. Brand and country domains often differ.

DKIM is detected by guessing selectors, so "not found" doesn't mean "not there".

It measures what the domain asks for, not what Gmail/Outlook actually enforce.

🚫 No ranking

I deliberately don't publish a league table naming the worst companies. There's a search box if you want to look up a specific one, and the aggregate data (CSV, CC BY 4.0) is downloadable.

I'd really like feedback on the methodology, especially from people who have pushed an org from p=none to p=reject: what actually blocked you?

https://cyberescudo.com/observatorio?lang=en

Impact

The absence or ineffectiveness of DMARC policies in 48 of 226 large European companies allows attackers to spoof their corporate email domains without being blocked by recipient mail servers. This can facilitate phishing, fraud, or brand impersonation attacks targeting customers, partners, or investors. Partial or quarantine-only policies in 41 additional companies provide some protection but may still allow spoofed emails to reach recipients' spam folders. Companies with strict p=reject policies have mitigated this risk effectively. The impact is limited to the risk of email spoofing and associated social engineering attacks.

Defensive guidance

Companies without effective DMARC policies should implement and enforce a strict p=reject DMARC policy to instruct recipient mail servers to reject spoofed emails. Organizations with partial or quarantine policies should consider moving to full rejection to improve protection. The study provides public data and tools to help companies audit and improve their email authentication settings. No immediate action is required by recipients beyond awareness, but senders should prioritize deploying and maintaining DMARC, SPF, and DKIM configurations to prevent domain spoofing.

Summary

A monthly measurement conducted in October 2026 assessed the DMARC, SPF, and DKIM email authentication policies of 226 unique companies listed in major European stock indices (Euro Stoxx 50, DAX 40, CAC 40, IBEX 35, FTSE 100). The study found that 48 companies lack an effective DMARC policy (either no record or p=none), meaning receivers are not instructed to reject spoofed emails from these domains. Another 41 companies have policies that only quarantine or partially handle spoofed emails. The remaining 137 companies publish a strict p=reject DMARC policy, instructing receivers to reject spoofed emails. The analysis was performed on corporate/investor relations domains and used public DNS queries. The data is publicly available and updated monthly. No active attacks or incidents were reported; this is an observational study of policy adoption.

I checked the DMARC policies of 226 large European listed companies (Euro Stoxx 50, DAX, CAC 40, IBEX 35, FTSE 100): 48 of them can still be spoofed

Discussion

Links cited in the discussion

Impact

Defensive guidance

Summary

References

Community reviews

Discussion

Links cited in the discussion

AI analysisMachine-generated, updated 31 Oct 2026, 12:05 UTC

Technical details

References

Community reviews