S&P 500 Email Security Report

Scanning Approach

This report analyzes the email security posture of 500 domains from the S&P 500 Email Security Report constituent list, of which 474 were successfully scanned. Each domain undergoes automated DNS and protocol checks that examine published records, validate configurations, and verify protocol compliance without sending any email traffic or interacting with mail servers beyond standard DNS queries and TLS connection probes.

Three-Pillar Model (DoSPM)

Every domain is evaluated across three security pillars, each representing a distinct dimension of email security posture:

Identity

Measures authentication and sender verification protocols including SPF, DKIM, DMARC, MTA-STS, DANE, and BIMI. These controls establish domain ownership and prevent unauthorized senders from impersonating the domain.

Shadow

Evaluates DNS infrastructure security including DNSSEC validation and DNS configuration hygiene. These controls protect against DNS spoofing, cache poisoning, and unauthorized zone modifications.

Reputation

Assesses transport security and domain standing including TLS configuration, certificate validity, and blacklist status. These controls ensure encrypted delivery and protect against interception and reputation damage.

Grading Scale

Each domain receives an overall score from 0 to 100, derived from weighted pillar scores. The score maps to a letter grade on a 13-point scale:

Checks Per Domain

Each domain is evaluated against 57+ individual checks spanning all three pillars. Checks range from verifying the presence and syntax of DNS records to validating policy enforcement levels, cryptographic key strengths, certificate chains, and protocol interoperability. Results are classified by severity (pass, fail, warning, informational) and aggregated into pillar scores.

Data Coverage

Of the 500 domains in the S&P 500 Email Security Report constituent list, 474 (94.8%) were successfully scanned and included in aggregate calculations. Domains without scan data or with scans older than 90 days are excluded from statistical analysis to ensure the report reflects current security posture.