Which industry & country has the worst email security? An analysis of 5,800+ domains for SPF, DMARC, DKIM & MTA-STS protocols

Every day, cybercriminals send around 3.4 billion phishing emails. 90 percent of successful cyber attacks originate from one of these emails.

We analyzed the live DNS records for 5,849 domains across 13 sectors, scoring each domain on eight points based on its Sender Policy Framework (SPF), Domain-based Message Authentication, Reporting, and Conformance (DMARC), DomainKeys Identified Mail (DKIM), and Mail Transfer Agent Strict Transport Security (MTA-STS).

96 percent of IT security and decision makers expect to see email security challenges throughout 2026, so you’d be forgiven for thinking that most organizations would be meeting the basics. However, our findings found that more than eight percent of organizations’ domains are fully unprotected, meaning they have no SPF, DMARC, DKIM, or MTA-STS measures in place. A mere 0.6 percent scored full marks for having all of the protections in place and at the highest level.

Which industries have the worst email security?

Government agencies and healthcare providers*.

Government agencies had the lowest average score by far (2.73) and had the highest number of unprotected domains with nearly 27 percent in total. Healthcare providers had the second-lowest average score (3.43) and the second-highest rate of unprotected domains (more than 19%).

In contrast, technology companies had the highest average score (4.83) and the lowest rate of domains with zero protection (2%).

What about the worst countries**?

Asian countries/territories had the lowest average scores, with China (2.3), South Korea (2.84), Hong Kong (3.07), and Japan (3.53) ranking among the lowest. The European countries of France (3.77), Germany (3.8), and Spain (3.98) also scored poorly.

Among the highest-scoring countries were the Netherlands (5.51), Denmark (5.33), Norway (5.31), and Finland (5.19).

China (28%), Hong Kong (26%), and France (16%) had the highest percentage of domains with zero protection. Seven countries, including the United Arab Emirates and Poland, had zero domains with no protection. Switzerland also had just less than 2 percent.

*We looked at healthcare providers (those providing direct care to patients) and healthcare businesses (e.g. pharmaceutical or medical device manufacturers) separately.

**Countries without large datasets, those with less than 10 scanned domains, haven’t been included in the country-by-country analysis.

All of the companies mentioned in the article have been contacted for comment (except those with full 8/8 scores). Any responses received will be added to the end of the article.

Key findings:

• 487 of the total domains scanned (5,849) had zero protection (8.3%)
• Just 33 of the total domains had full protection (0.6%)
• Average score across all domains – 4.2
• Government domains had the lowest average score – 2.73
• Tech company domains had the highest average score – 4.83
• Government domains had the highest percentage of domains with zero protection – 27%
• Tech company domains had the lowest percentage of domains with zero protection – 2%
• China had the lowest average score – 2.3
• The Netherlands had the highest average score – 5.51
• China had the highest percentage of domains with zero protection – 28%
• 90 percent of all domains had SPF protocols in place
• 81 percent of all domains had DMARC protocols in place
• 55 percent of all domains had DKIM protocols in place
• Just over 3 percent of all domains had MTA-STS protocols in place

Scoring

For scores used in the context of this article, each domain was given a score out of 8, with 8 being fully protected and 0 indicating no protection:

• SPF presence – checks whether incoming emails are from authorized domains (1 point)
• SPF hard fail (“-all”) – explicitly rejects/discards any emails that don’t come from the authorized list of domains (1 point)
• SPF soft fail “~all”) – sends an email to spam rather than rejecting it completely (0.5 points)
• DMARC presence – a DMARC record has been created within the domain’s DNS settings, enabling email receivers to check the authenticity of the received emails (1 point)
• DMARC enforcement – the policy contains p=quarantine (0.5 points) or p=reject (1 point) for messages that don’t pass authentication checks. Any with p=none do not get an additional point, as these will go straight through
• DMARC reporting destination – feedback reporting has been enabled and the recipient of these reports has been specified (1 point)
• DKIM presence – uses a digital signature to notify the recipient that the message is coming from an address that’s been authorized by the domain
• MTA-STS publication – tells email senders that an organization’s domain is using encrypted Transport Layer Security (TLS) connections (1 point)
• MTA-STS enforce mode – if a secure connection cannot be established, the email will be rejected and it will not be delivered in its unencrypted state (1 point). Those in “testing” mode score 0.5 points, those highlighted as “broken” or “none” scored 0

Government: the sector with the worst email security

No government domains scored full marks, but three did score 7.5 – Australia’s national science agency (CSIRO), the Mila – Quebec Artificial Intelligence Institute in Canada, and The Alan Turing Institute in the UK (also dedicated to data science and artificial intelligence).

Each dropped half a point for a different reason: CSIRO has its MTA-STS in the testing phase, Mila has soft-fail SPF, and Turing quarantines emails that don’t pass DMARC checks, rather than rejecting them.

Government domain scores by country

Where more than 10 domains were scanned within the country, the UK (4.6) and the US were the top scorers (3.9). The UK also had the lowest percent of domains with zero protection (6%), but 17 percent of domains were unprotected in the US.

China (0.9) and France (1.4) had the lowest average scores. Both of these countries also had the highest number of fully unprotected domains with 65 and 47 percent, respectively.

Key country highlights:

Technology: the sector with the best email security

Two tech companies’ domains scored full marks – microsoft.com and f5.com. A further 10 scored 7.5 – six of these were in the US and the others in Spain, Switzerland, Sweden, and the Netherlands.

Of the 10 without any protections, four were in China, and the others were in Hong Kong, Germany, Taiwan, South Korea, the Netherlands, and India.

Technology domain scores by country

The countries with the highest average scores were Israel (5.5) and the US (5.3). Both countries had no domains without any protections, as did Japan and Canada.

China and South Korea had the lowest average scores with 3.3 each.

Key country highlights:

Healthcare providers: well below average

Four domains scored full points. Three of these were part of the UK’s NHS (NHS Blood and Transplant, Manchester University NHS Foundation Trust, and University Hospitals Birmingham NHS Foundation Trust), and one was the Dutch cancer specialist, Prinses Máxima Centrum.

A further three domains (one each in the US, UK, and Netherlands) scored 7.5, each dropping 0.5 for MTA-STS being in the testing phase.

Healthcare providers’ domain scores by country

The Netherlands had the highest average score (6), while China (2.1) and Spain (2.6) had the lowest. The UK also had a low average score (2.9).

China also had the highest percentage of domains without any protections (45%), followed by the UK (37%).

Key country highlights:

Among the domains with zero protections were a US healthcare company operating across over 500 locations and an NHS Trust in the UK.

Healthcare businesses: marginally better than their counterparts

Healthcare businesses scored slightly better than healthcare providers across all categories, but still had the fourth-lowest average score and the third-worst zero-protection rate.

Just one domain scored full points – Revolution Medicines in the US. Five scored 7.5: Amgen in the US, bioMérieux in France, Fagron in Belgium, Fresenius (FSE) in Germany, and Verona Pharma* in the UK. All of them dropped 0.5 points for having MTA-STS in testing, aside from bioMérieux, which had MTA-STS in enforcement mode but DMARC in quarantine mode.

*Verona Pharma is now part of U.S. Merck.

Healthcare businesses’ domain scores by country

The UK had the highest average score (4.9), but was closely followed by Switzerland (4.8) and the US (4.7). China (2.1) had the lowest average score and the highest percentage of domains without any protections (36%).

Key country highlights:

Among those scoring zero were a biopharmaceutical company with a $500M+ turnover in the US and an Irish pharmaceutical manufacturer.

Universities: the p=none paradox

Despite universities having the fifth-lowest percentage of domains with zero protection and the most domains with MTA-STS protocols, they had the highest number of domains with DMARC p=none. In short, despite nearly 86 percent of the universities we audited having a DMARC record in place, a meaningful share (42%) have stalled in monitoring mode and never flipped to enforcement.

Five universities scored full marks. Wageningen University & Research in the Netherlands, the Australian National University, the University of Auckland in New Zealand, and the University of Southampton and the University of Bath in the UK.

Universities’ domain scores by country

The Netherlands had the highest average score (6), followed by Australia (5.4) and the UK (5.2). China (3.1), Germany (3.3), and South Korea (3.4) had the lowest scores.

Japan (10%) and China (8%) had the highest rate of unprotected domains.

Key country highlights:

Among the domains that scored zero were a Japanese university and a medical university in Germany.

Law firms: mid-table with some judgement required

Three domains scored full points – Schjødt in Norway, MinterEllisonRuddWatts in New Zealand, and Linklaters in the US. A further seven scored 7.5 – six of these were in the UK and one in the US. All of the UK domains had soft-fail SPF, while the US domain had MTA-STS in testing mode.

Law firm domain scores by country

The UK had the highest average score (5.5) and China had the lowest (2.1). China also had the highest number without any protections (38%).

Key country highlights:

19 domains had no protections.

Insurance companies & financial institutions: joint second place

Please note: some of the finance companies may also offer insurance packages, but these are included alongside financing/banking options.

Insurance:

Four insurance companies had perfect scores, including Beneva of Canada, WCF Insurance, Pinnacol Assurance, and FFVA Mutual of the US.

Finance:

Five finance companies also had perfect scores but, in this case, none of these were in the US. Rather, these were Nykredit in Denmark, Bank Muscat in Oman, Berner Kantonalbank in Switzerland, Commerzbank in Germany, and Belfius in Belgium.

Insurance company domain scores by country

Canada had the highest overall score (5.5), while Japan had the lowest (3.2)

Key country highlights:

Of the domains with zero protections, most of these were in the US (6) and France (5).

Finance company domain scores by country

Brazil had the highest overall score (5.7), while China had the lowest (2.2).

Key country highlights:

Most of the domains without any protections were in China (7).

Non-profit organizations: budgets may be allocated elsewhere

None of the non-profit domains we analyzed scored 8 out of 8 but two scored 7.5. These were the Center for International Climate Research (CICERO) in Norway and the LSU AgCenter in the US. CICERO has DMARC in quarantine mode, while LSU AgCenter has MTA-STS in testing mode.

Non-profit organizations’ domain scores by country

The US had the highest average score with 4.6, while China had the lowest with 1.6

Key country highlights:

Among those domains with zero protections was a non-profit research company headquartered in Portugal.

Manufacturers: need to make progress

Three manufacturers’ domains scored full points. These were Wärtsilä and Valmet in Finland and the LISI Group in France.

Manufacturers’ domain scores by country

Switzerland comes out on top with an average score of 5.6 and is closely followed by Sweden with 5.4. South Korea features at the bottom with an average score of 2.1, while China has the highest percentage of domains with zero protection (20%).

Key country highlights:

Included within the domains with zero protection were a global manufacturer with a head office in Japan and an Indian-based manufacturer with a global turnover of over $27 billion USD.

Airlines: fly in mid-table

Just one airline secured the full 8 points – HK Express in Hong Kong. One more (JetSMART in Chile) scored 7.5, dropping half a point for its MTA-STS being in testing mode.

Airlines’ domain scores by country

Spain had the highest average score with 5.2 and China the lowest with 2.4. 21 percent of the domains in China also had zero protections.

Key country highlights:

Energy sector: just needs a little boost

Equinor in Norway and OQ Gas Networks (OQGN) in Oman were the only two domains to score 8 points. Four further companies scored 7.5, including two in Canada, one in Finland, and one in the UK.

Energy companies’ domain scores by country

Norway’s energy company domains scored an average of 5.9, closely followed by the UK and Italy with 5.5. China scored 1.8 and had the highest number of domains with zero protections (27%), followed by India (17%)

Key country highlights:

Retail: needs to shop for better email protections

Three retailers scored full points – Fielmann in Germany, ThredUp in the US, and National Vision, also in the US.

Retailers’ domain scores by country

France (5.2) and Germany (5.1) had the highest average scores among retailers, while Japan and China had the lowest with 2.6 each. Japan also has the highest number of domains with zero protection.

Key country highlights:

Domains with zero protections included a Japanese online shoe shop and a UK high-street retailer.

Country-by-country scores

Final thoughts

Our report highlights how each and every industry and country has room for improvement when it comes to email security. This is even the case within sectors and/or countries where email security is regulated to some degree.

For example, Europe’s GDPR doesn’t explicitly state that these protocols should be in place, but it does state that organizations must implement strict standards to help safeguard data. This perhaps explains why the likes of the Netherlands, Denmark, and Norway appear at the top of our rankings. But this doesn’t extend across all EU-regulated countries, with France, Germany, and Spain scoring far lower.

Equally, certain sectors within specific countries face heavier regulation. For example, in the US, the Department of Homeland Security (DHS) mandates that DMARC should be in use on all government agency email domains. And, in the UK, the Government Digital Service (GDS) requires DMARC across governmental domains, and with p=reject (hard fail)

If we look at our findings, 12 government entities in the US and three UK government agencies don’t employ DMARC (some of these are mentioned above).

As spam email campaigns continue to involve and utilize the likes of Google and the New York Times to induce a sense of trust, meeting basic email security standards has never been more crucial. Increased regulation may help spur organizations into action, but companies shouldn’t be waiting around to be told to safeguard their domains, particularly with what many would call standard protocols.

Methodology, limitations & sources

Domain selection

The list of companies (and their subsequent domains) were derived from industry lists of key/top companies within each sector. For example, the ICMF’s list of the world’s largest mutual and cooperative insurers was used for the insurance sector.

Any domains that weren’t available, e.g. those presenting a 404 error, were removed.

A full list of sources is detailed below.

DNS audit

We then resolved live DNS records for each domain. We queried TXT records at the apex for any SPF record, the qualifier on the trailing -all/~all/?all/+all mechanism, and the policy on any DMARC record at _dmarc.<domain>. We additionally tested for an MTA-STS policy files and DKIM records.

Scoring

Each domain was scored on an 8-point scale (SPF presence, SPF strict-fail qualifier, DMARC presence, DMARC enforcement, DMARC reporting destination, DKIM presence, MTA-STS publication, MTA-STS enforce mode).

Limitations

This audit checks the public, observable email-authentication posture of each domain at its apex. It does not assess subdomain posture (many large organizations enforce DMARC on a customer-facing subdomain while running monitor mode on the apex), internal mail-server configuration, anti-phishing tooling deployed by the organization’s mail provider, customer-side filtering, or human-targeted brand-protection programs.

Sources

https://www.icmif.org/wp-content/uploads/2024/05/ICMIF-Global-500-2024.pdf

https://companiesmarketcap.com

https://brandirectory.com/reports/banking

https://www.deloitte.com/content/dam/assets-shared/docs/industries/consumer/2025/deloitte-global-powers-of-retailing-2025.pdf

https://disfold.com/sector/healthcare/companies/

https://www.scimagoir.com/rankings.php

Data researcher: Mantas Sasnauskas