Observatory · data from September 2026
Can Europe's largest listed companies be spoofed by email?
47 of 226 have no DMARC policy preventing the domain of their corporate website from being used to send forged email.
Of the rest, 137 reject it, 39 send it to spam and 3 only partly set it aside.
The companies in 5 stock indices (IBEX 35, Euro Stoxx 50, FTSE 100, DAX 40 and CAC 40), measured every month with the same engine as the CyberEscudo auditor. A company listed in two indices counts once. Public records only: nobody was attacked or contacted.
Index by index
Each index has its own size: compare the percentages, not the counts.
Can be spoofed
Protected
- Can be spoofed
- No effective DMARC policy: receivers are not asked to reject or set aside mail forging the domain.
- Protected
- reject at 100%: receivers reject mail forging the domain.
The reports
Each report has its methodology, its limitations, the full figures and a per-company lookup.
-
IBEX 35
Spain · 23 September 2026
11 of 35 can be spoofed
Of the rest, 20 reject it and 4 send it to spam.
-
Euro Stoxx 50
Eurozone · 24 September 2026
3 of 50 can be spoofed
Of the rest, 39 reject it and 8 send it to spam.
-
FTSE 100
United Kingdom · 24 September 2026
23 of 100 can be spoofed
Of the rest, 55 reject it, 19 send it to spam and 3 only partly set it aside.
-
DAX 40
Germany · 24 September 2026
7 of 40 can be spoofed
Of the rest, 28 reject it and 5 send it to spam.
-
CAC 40
France · 24 September 2026
7 of 40 can be spoofed
Of the rest, 25 reject it and 8 send it to spam.
How it is done
- What is measured
- SPF, DMARC and DKIM for the domain of each company's corporate website, with the email auditor engine: the same weights, scale and caps you see when auditing your domain. How we score
- When
- One edition a month per index, with public DNS queries to Google Public DNS. A published edition is never rewritten and keeps the methodology of its time: if the methodology changes, it shows in the next edition, not in past ones.
- Which companies
- Each index's composition on the date of its edition, with the source cited in each report. The domain is that of the corporate website, and each comes with its source in the CSV.
- Companies in several indices
- They count in every index they belong to, but only once in this page's total, with their latest measurement.
For the press
If you cite the observatory, please give the source and the date of the data. A faithful wording:
"47 of the 226 large European listed companies in the IBEX 35, Euro Stoxx 50, FTSE 100, DAX 40 and CAC 40 indices have no DMARC policy preventing the domain of their corporate website from being used to send forged email." Source: CyberEscudo, Email Spoofing Observatory (data from September 2026).
- Observatory card (PNG, 1200×630)
- Each report has its own quote, card and data in JSON and CSV.
- Contact for interviews or more data
And your domain?
The same analysis, for yours, in seconds and without signing up. If something needs fixing, I can help you reach p=reject without losing legitimate mail.