26 of the world's 100 largest companies still let anyone send email as them

DMARC adoption across the Forbes Global 2000 top 100. Scanned 7 September 2026.

We looked up the email authentication records of the 100 largest public companies on Earth, as ranked by Forbes in June 2026. The question was simple: if someone forged an email from this company's corporate domain today, has the company told the world's mail servers what to do about it?

For 74 of them, yes. For 26, no.

What we checked

DMARC is the DNS record that tells a receiving mail server what to do with a message that claims to come from your domain but fails authentication. It has three settings. p=reject drops the forgery. p=quarantine sends it to spam. p=none delivers it and only asks for a report. No record at all means no instruction and no report.

Of the 100 domains, 64 are at reject and 10 at quarantine. Those 74 companies have made a forged email from their domain either undeliverable or spam-foldered at every major mailbox provider.

The other 26 have not. 11 publish a record set to p=none, which is monitoring only: they receive reports about who is sending as them, but the forged message still lands in the inbox. 15 publish no DMARC record at all. They receive nothing, and receivers apply nothing.

6 of those 15 also have no SPF record. Toyota, NTT, Hon Hai, Sinopec, CNOOC and China Mobile have no email authentication of any kind on their corporate domain. Volkswagen Group has a monitoring-only DMARC record and no SPF.

Finding 1: a quarter of the list is unprotected

The 26 are not small names hiding at the bottom of the ranking. They include Alphabet at number four, ICBC at six, China Construction Bank at nine, Samsung at fifteen and Toyota at seventeen.

Nothing in the group is unusual for its size. Collectively they employ millions of people and email hundreds of millions of customers, which is exactly the population a phishing campaign wants to reach with a From address it recognises.

The split inside the 26 matters. A p=none record is a company that has started: it is collecting reports and has, presumably, a project underway. A missing record is a company that has not looked. 15 of the hundred largest companies in the world are in the second group.

Finding 2: geography predicts enforcement, size does not

Every company on this list is enormous, so size explains nothing. Where the company is headquartered explains almost everything.

Canada, France, Switzerland and India each have every one of their companies at reject. The United States has 32 of 37, and its three laggards are Alphabet, Chevron and Disney, all at monitoring only.

East Asia is the mirror image. Of 29 companies headquartered in China, Hong Kong, Japan, South Korea and Taiwan, four are at reject: Agricultural Bank of China, Mitsubishi UFJ, Sumitomo Mitsui and TSMC. Twenty-two are at monitoring only or have no record. Mainland China accounts for seven of the 15 domains with no record, nine counting Hong Kong, and one of its fifteen companies is at reject.

The likely reason is regulatory rather than technical. Google and Yahoo have required DMARC from bulk senders since 2024, and Microsoft since 2025, but those rules bite hardest where the customers' mailboxes are. A company whose customers live on Gmail and Outlook has been forced to act. A company whose customers live elsewhere has not.

Finding 3: transport security barely exists at the top

DMARC protects the From address. It does nothing to stop a message being read or altered in transit, which is the job of two younger standards. MTA-STS tells sending servers that your domain requires encrypted delivery. TLS-RPT asks them to report when encryption fails.

Among the 100 largest companies in the world, 7 publish an MTA-STS record and 3 enforce it: Microsoft, Allianz and Petrobras. 9 publish TLS-RPT. Exactly 2 companies, Microsoft and Allianz, have the full stack of DMARC at reject, MTA-STS enforced and TLS-RPT.

BIMI, the standard that displays a verified logo next to authenticated email, does better: 25 companies publish a BIMI record, every one of them with a verified mark certificate. Logos in the inbox are a marketing benefit with a clear owner. Encrypted transport is a security benefit with no owner, and the numbers show which one gets done.

The full table

Every company on the list, with the domain we scanned. Click a column to sort, or filter by policy and region. The CSV carries the raw records and the reason for every domain substitution.

What a monitoring-only policy means for a company this size

A p=none record is the correct first step for a domain that has never had DMARC. It costs nothing, breaks nothing, and produces the reports that show which services send legitimate mail. The problem is staying there. Our guide to choosing a DMARC policy covers when a domain is ready to move to quarantine and reject, and our guide to reading DMARC reports covers what the reports are telling you in the meantime.

23 companies in this list also still publish a pct= tag, which the May 2026 revision of the DMARC standard removed. It is not counted against anyone here, but it is a sign of records written years ago and not revisited.

Methodology

The list. The Forbes Global 2000 for 2026, published June 2026, positions 1 to 100. Forbes ranks on a composite of sales, profits, assets and market value.

The domain. Forbes lists a website for each company. We took the registrable domain of that website and scanned it. Where Forbes lists a regional or subsidiary site, we substituted the group's primary domain and recorded why; there are 21 such substitutions, all listed in the CSV. Alphabet is scanned as abc.xyz, the holding company's own domain, which is at monitoring only; google.com is at reject. Every subsidiary, brand and regional domain is out of scope. A company can be at reject on one domain and unprotected on another, and only the corporate domain is scored here.

The scan. On 7 September 2026 we queried each domain's DNS over Cloudflare's resolver for the DMARC record, the SPF record and its lookup count, the MTA-STS record and policy file, the TLS-RPT record and the BIMI record. Every domain reported as having no DMARC record was confirmed against Google's resolver. The grading rule is the same one our free DMARC checker applies, so checking any domain in the table yourself will show the same result.

What this does not say. A DNS record is a statement of policy at a moment in time. It says nothing about whether a domain has been spoofed, how a company's mail is filtered internally, or what other controls it runs. Records change; we will re-scan this list quarterly and publish the difference.

Licence. The dataset and charts are released under Creative Commons Attribution 4.0. Use them freely, including commercially, with a credit to Canny Pigeons and a link to this page.

Corrections. If you work at one of these companies and the domain we scanned is not the one your company is known by, tell us at gday@cannypigeons.com and we will re-check and amend the table.