Observatory · data from October 2026
Can the largest listed companies in Europe and the US be spoofed by email?
50 of 256 have no DMARC policy preventing the domain of their corporate website from being used to send forged email.
Of the rest, 163 reject it, 40 send it to spam and 3 only partly set it aside.
The companies in 6 stock indices (IBEX 35, Euro Stoxx 50, FTSE 100, DAX 40, CAC 40 and Dow Jones), measured every month with the same engine as the CyberEscudo auditor. A company listed in two indices counts once. Public records only: nobody was attacked or contacted.
Index by index
Each index has its own size: compare the percentages, not the counts.
Can be spoofed
Protected
- Can be spoofed
- No effective DMARC policy: receivers are not asked to reject or set aside mail forging the domain.
- Protected
- reject at 100%: receivers reject mail forging the domain.
Do size or age matter?
Companies that can be spoofed, by band. Each company counts once. Market capitalisation at the close on 30 October 2026, in euros.
By market capitalisation
By year founded
Market capitalisation: all listed shares at the closing price (not free float), from each company's primary exchange (BME, London Stock Exchange, Euronext, Deutsche Börse, Nasdaq Nordic; in the US, shares outstanding reported to the SEC and the Nasdaq close), converted to euros at that day's ECB reference rate. Exchanges do not allow their figures to be redistributed, so only the bands are shown here. Year founded: the earliest of Wikidata and the English Wikipedia infobox; for groups formed by mergers it may be that of the oldest company.
This is a correlation across 256 companies, not a cause: the smaller ones are mostly in the FTSE 100 and the IBEX 35, so the country matters too. No market cap: 2; no year founded: 4.
The reports
Each report has its methodology, its limitations, the full figures and a per-company lookup.
-
IBEX 35
Spain · 12 October 2026
11 of 35 can be spoofed
Of the rest, 20 reject it and 4 send it to spam.
-
Euro Stoxx 50
Eurozone · 12 October 2026
3 of 50 can be spoofed
Of the rest, 39 reject it and 8 send it to spam.
-
FTSE 100
United Kingdom · 12 October 2026
24 of 100 can be spoofed
Of the rest, 55 reject it, 18 send it to spam and 3 only partly set it aside.
-
DAX 40
Germany · 12 October 2026
7 of 40 can be spoofed
Of the rest, 28 reject it and 5 send it to spam.
-
CAC 40
France · 12 October 2026
7 of 40 can be spoofed
Of the rest, 25 reject it and 8 send it to spam.
-
Dow Jones
United States · 30 October 2026
2 of 30 can be spoofed
Of the rest, 26 reject it and 2 send it to spam.
How it is done
- What is measured
- SPF, DMARC and DKIM for the domain of each company's corporate website, with the email auditor engine: the same weights, scale and caps you see when auditing your domain. How we score
- When
- One edition a month per index, with public DNS queries to Google Public DNS. A published edition is never rewritten and keeps the methodology of its time: if the methodology changes, it shows in the next edition, not in past ones.
- Which companies
- Each index's composition on the date of its edition, with the source cited in each report. The domain is that of the corporate website, and each comes with its source in the CSV.
- Companies in several indices
- They count in every index they belong to, but only once in this page's total, with their latest measurement.
For the press
If you cite the observatory, please give the source and the date of the data. A faithful wording:
"50 of the 256 large listed companies in Europe and the US in the IBEX 35, Euro Stoxx 50, FTSE 100, DAX 40, CAC 40 and Dow Jones indices have no DMARC policy preventing the domain of their corporate website from being used to send forged email." Source: CyberEscudo, Email Spoofing Observatory (data from October 2026).
- Observatory card (PNG, 1200×630)
- Full series: every edition of every index (CSV)
- The data is licensed under CC BY 4.0: you may reuse it, commercially too, as long as you credit CyberEscudo as the source.
- Each report has its own quote, card and data in JSON and CSV.
- Contact for interviews or more data
And your domain?
The same analysis, for yours, in seconds and without signing up. If something needs fixing, I can help you reach p=reject without losing legitimate mail.