Measurement report ·
US stock exchanges email security report card: DMARC and DNSSEC in 4,707 firms (Oct 2026)
By: Kemal Özleyen, Cybersecurity Engineer · Check Point Workspace Security Expert · Kinetik Bilişim
The domains of 4,707 of the 5,047 operating companies on the NYSE and NASDAQ, measured in a single pass with the same engine on 29 October 2026. Unique domains: 4,640.
PNG · Turkish version · Data (CSV) · Blog article · CC BY 4.0 — share freely with attribution (Mailskop · Kinetik Bilişim).
Key findings
- Of 4,640 domains of 4,707 companies listed on the NYSE and NASDAQ, 33.1% have no DMARC policy that stops forged email: 12.8% have no or an invalid record and 20.4% only monitor (
p=none). - 66.9% of the same 4,640 domains enforce DMARC; 38.6% reject forged mail outright with
p=reject. - There is a strong trend with index membership: 93.3% of Dow Jones 30 and 89.0% of S&P 500 companies enforce DMARC, versus 64.2% of companies in none of the three major indices.
- By market cap: 90.0% of mega cap ($200b+) companies enforce DMARC versus 50.5% of micro cap (<$300m) companies.
- By exchange: 76.5% of 1,737 NYSE domains and 61.1% of 2,903 NASDAQ domains enforce DMARC;
p=reject49.8% on the NYSE versus 31.8% on NASDAQ. - Sectors differ: 76.4% enforce DMARC in utilities versus 56.8% in consumer staples.
DMARC policy
reject has forged mail rejected, quarantine sends it to spam, none only asks for reports. An invalid record is the same as none to a receiver and is counted in that column (7 domains). Domains with more than one DMARC record: 4. 89.8% of domains with a DMARC record request aggregate reports (rua).
| Segment | Domains | reject | quarantine | none | No / invalid record | Enforcing |
|---|---|---|---|---|---|---|
| All companies | 4,640 | 38.6% | 28.3% | 20.4% | 12.8% | 66.9% |
By index and market cap
Index membership from current constituent lists, by ticker; most Dow Jones 30 members are also in the S&P 500, so rows overlap. Market cap from the Nasdaq screener (USD); a domain’s bracket comes from the largest company using it. Companies sharing a domain are counted once. Index membership indicates a tendency, not a cause.
| Segment | Domains | reject | quarantine | none | No / invalid record | Enforcing |
|---|---|---|---|---|---|---|
| Dow Jones 30 | 30 | 83.3% | 10.0% | 6.7% | 0.0% | 93.3% |
| Nasdaq-100 | 100 | 65.0% | 25.0% | 8.0% | 2.0% | 90.0% |
| S&P 500 | 498 | 70.1% | 18.9% | 9.0% | 2.0% | 89.0% |
| In none of the three | 4,127 | 34.7% | 29.5% | 21.7% | 14.1% | 64.2% |
| Mega cap ($200B+) | 70 | 77.1% | 12.9% | 8.6% | 1.4% | 90.0% |
| Large cap ($10–200B) | 816 | 63.2% | 21.3% | 11.2% | 4.3% | 84.6% |
| Mid cap ($2–10B) | 1,039 | 47.6% | 27.3% | 19.8% | 5.2% | 75.0% |
| Small cap ($300M–2B) | 1,160 | 34.1% | 33.4% | 23.5% | 8.9% | 67.6% |
| Micro cap (<$300M) | 1,530 | 21.0% | 29.5% | 23.9% | 25.6% | 50.5% |
By sector
Sector from the Nasdaq screener. Sectors with at least 15 domains, ordered by the share enforcing DMARC.
| Segment | Domains | reject | quarantine | none | No / invalid record | Enforcing |
|---|---|---|---|---|---|---|
| Utilities | 140 | 48.6% | 27.9% | 17.1% | 6.4% | 76.4% |
| Technology | 652 | 42.2% | 31.1% | 17.6% | 9.0% | 73.3% |
| Energy | 155 | 38.1% | 33.5% | 16.8% | 11.6% | 71.6% |
| Finance | 715 | 43.8% | 26.4% | 18.0% | 11.7% | 70.2% |
| Telecommunications | 77 | 44.2% | 26.0% | 18.2% | 11.7% | 70.1% |
| Industrials | 533 | 41.1% | 25.7% | 21.4% | 11.8% | 66.8% |
| Miscellaneous | 53 | 34.0% | 32.1% | 24.5% | 9.4% | 66.0% |
| Consumer discretionary | 932 | 40.2% | 25.6% | 19.7% | 14.4% | 65.9% |
| Real estate | 190 | 33.7% | 30.5% | 18.4% | 17.4% | 64.2% |
| Health care | 931 | 29.8% | 31.6% | 25.3% | 13.3% | 61.3% |
| Basic materials | 94 | 29.8% | 30.9% | 27.7% | 11.7% | 60.6% |
| Consumer staples | 125 | 38.4% | 18.4% | 15.2% | 28.0% | 56.8% |
NYSE and NASDAQ; by origin
Each exchange is assessed on its own base. A domain’s exchange is that of the largest company using it. NASDAQ has a larger share of small and young companies, which explains part of the gap. Origin from the country field of the Nasdaq screener: “foreign” means companies listed in the US but headquartered elsewhere.
| Segment | Domains | reject | quarantine | none | No / invalid record | Enforcing |
|---|---|---|---|---|---|---|
| NYSE | 1,737 | 49.8% | 26.7% | 16.4% | 7.2% | 76.5% |
| NASDAQ | 2,903 | 31.8% | 29.3% | 22.8% | 16.1% | 61.1% |
| US companies | 3,481 | 41.9% | 29.2% | 19.8% | 9.1% | 71.1% |
| Foreign companies | 1,086 | 28.8% | 24.5% | 22.1% | 24.6% | 53.3% |
| Measure | NYSE | NASDAQ |
|---|---|---|
| SPF record present | 96.4% | 95.4% |
| DKIM key found | 75.9% | 72.8% |
| DNSSEC | 10.5% | 8.4% |
| MTA‑STS enforce | 1.1% | 0.8% |
| BIMI | 9.3% | 6.0% |
SPF, DKIM, DNSSEC, MTA‑STS and BIMI
95.8% of 4,640 domains with a measurable SPF lookup publish SPF; 27 publish more than one record, which invalidates SPF under RFC 7208. A DKIM key was found on 73.9% of 3,678 domains where DKIM could be checked; this is a lower bound, since selector names cannot be listed from DNS.
DNSSEC was measured as a DS record in the parent zone plus a validated answer (AD): on for 427 of 4,640 domains, no broken chains. Without DNSSEC, DANE cannot be deployed either. Domains enforcing MTA‑STS: 42, in testing mode 52; publishing TLS‑RPT 172; publishing BIMI 336 (base 4,640).
Mail platform and security product
Platform and product are inferred from MX, SPF and DKIM traces; products leaving no trace are invisible. Hosting companies and products are not named one by one: rates reflect the organisations’ configuration, not the product.
| Group | Domains | reject | quarantine | none | No / invalid record | Enforcing |
|---|---|---|---|---|---|---|
| Microsoft 365 | 2,880 | 36.4% | 33.2% | 22.1% | 8.3% | 69.5% |
| Other hosting | 656 | 42.5% | 16.5% | 19.2% | 21.8% | 59.0% |
| Infrastructure not detected | 530 | 48.5% | 16.6% | 10.9% | 24.0% | 65.1% |
| Google Workspace | 493 | 36.7% | 29.0% | 20.7% | 13.6% | 65.7% |
| Own mail server | 81 | 29.6% | 23.5% | 27.2% | 19.8% | 53.1% |
| Email security product detected | 2,321 | 49.7% | 26.3% | 19.6% | 4.4% | 76.0% |
| No product detected | 2,319 | 27.4% | 30.3% | 21.1% | 21.2% | 57.7% |
Sample, method and limits
Based solely on public DNS records. No system was accessed and no email was read.
From 6,685 securities listed on the NYSE and NASDAQ, preferred shares, warrants, rights, units, SPACs and funds were removed, leaving 5,047 operating companies. The US has no central source of company email, so the registered domain of the corporate website was measured: first the official website on Wikidata (2,289 companies), otherwise the address in recent SEC EDGAR annual and periodic reports (2,422 companies). Of 4,711 companies with a domain, the domains of 4,707 resolved and were measured. Companies sharing a domain (share classes, group companies) are counted once (58 shared domains).
All domains were measured on 29 October 2026 with the Mailskop engine, using the same parameters as the live bulk check. Index membership from the current constituent lists of the S&P 500, Nasdaq-100 and Dow Jones 30; sector, country and market cap from the Nasdaq screener. A value that could not be measured was not counted as absent; it was removed from the denominator. Domains that receive no mail (no MX or null MX): 203; they stay in the base, because DMARC also protects a domain that sends no mail. This report is frozen and will not change.
Data and citation
Download the aggregate counts as CSV. Aggregate counts only; no individual company or domain.
The data and tables are licensed under CC BY 4.0: you may use, share and adapt them freely with attribution.
To cite: Kemal Özleyen, Mailskop (Kinetik Bilişim), “US stock exchanges email security report card: DMARC and DNSSEC in 4,707 firms (Oct 2026)”, 30 October 2026. https://mailskop.com/en/research/2026-10-abd-borsalari
Last updated: