Provider

Microsoft 365

37,157 domains tracked. 43.2% at DMARC enforcement (p=reject or p=quarantine), backed by 16,051 enforced domains.

Domains tracked
37K+
37,157
DMARC enforcement
43.2%
p=reject + p=quarantine
Avg posture score
56.1
of 100
A-grade domains
379
9 A+ · 370 A

Authentication posture

per protocol

DMARC

policy enforcement: 43.2%
reject
19.4%
quarantine
23.8%
none
34.0%
missing
22.8%

SPF

pass rate: 97.2%
pass
97.2%
warn
1.5%
fail
1.2%
not found
0.1%

DKIM

pass rate: 73.8%
pass
73.8%
warn
0.1%
fail
25.1%
not found
1.0%

MTA-STS

pass rate: 1.3%
pass
1.3%
warn
0.7%
fail
94.4%
not found
3.6%

TLS-RPT

pass rate: 2.5%
pass
2.5%
warn
11.9%
fail
82.0%
not found
3.6%

BIMI

pass rate: 1.4%
pass
1.4%
warn
0.3%
fail
94.7%
not found
3.6%

Top performers

20 of 37,157 tracked
#DomainScoreGrade
1climeworks.com97A+
2delinea.com96A+
3ef.com96A+
4citysprint.co.uk95A+
5dreams.co.uk95A+
6europeantour.com95A+
7fanuc.eu95A+
8hastingsdirect.com95A+
9imec-int.com95A+
10aladdinsgoldcasino.com94A
11allstarslots.com94A
12bankmuscat.com94A
13icertis.com94A
14adamhall.com93A
15agc.org93A
16and-charge.com93A
17arcadis.com93A
18bathspa.ac.uk93A
19blue10.com93A
20commerzbank.com93A

How this is measured

Each tracked domain is scanned for SPF, DKIM, DMARC, MTA-STS, TLS-RPT, and BIMI. Result statuses (pass / fail / warn / not-found) and DMARC policy values are aggregated into this page nightly. The top performers list is capped at 20. The full corpus is much larger and is not enumerated publicly.

Data provenance

  • Scanner — Authex Labs public scanner (DNS, RFC-compliant)
  • Refreshed — daily at 04:05 UTC
  • Last seen 8 May 2026