We track the state of email authentication across the internet and openly share data, insights and guidance that help companies and domain owners defend against impersonation.
The DNS of the UK's ten largest banks and building societies, read record by record. Nine enforce DMARC, the big four stop there, two building societies go furthest, and six of the short .uk domains are open, one of them because it carries two policies at once.
We scanned the DMARC, SPF, DKIM, BIMI, MTA-STS and TLS-RPT records of Australia's ten largest banks. All ten enforce DMARC, four show a verified logo in the inbox, eight still sign with 1024-bit keys, and seven own a direct .au domain with no email authentication at all.
We scanned the DMARC, SPF, MTA-STS, TLS-RPT and BIMI records of the Forbes Global 2000 top 100. 64 are at reject, 15 have no DMARC record at all, and geography predicts enforcement better than size.