How the benchmark is built
Our benchmark measures the real state of email security across the internet. It is built from public DNS data only, scored with the same engine as our live check, and refreshed every month. Here is exactly how it works, so you can trust what it tells you.
domains scored
RFC-level checks per domain
refresh of the whole picture
Public DNS data only
Every signal in the benchmark comes from public DNS: the records a domain publishes for the whole internet to read. We do not use private data, customer data, or anything that is not already public. That is what lets us publish the results openly, and it is why anyone can reproduce a single domain's result with our free check.
What we read, per domain
- SPF, and whether it is valid and within limits
- DMARC, its policy strength and reporting setup
- DKIM signals we can observe publicly
- MTA-STS and TLS-RPT for transport security
- DNSSEC on the zone
- DANE/TLSA published on the mail servers
Scored by the same engine as your check
A domain in the benchmark is scored 0 to 100 by exactly the engine behind our live checker, running the same 90+ RFC-level compliance rules. So the number you get when you check your own domain is directly comparable to the benchmark: you are being measured on the same ruler as everyone else, not a separate marketing metric.
- One 0 to 100 score, one rule set
- The same engine for the benchmark and your check
- Directly comparable: you versus the field
- Deterministic and reproducible from public records
Rolled up by industry and country
We group domains by industry and by country, and roll the scores up into averages you can compare against. Country is derived from the domain's country-code top-level domain and other public signals; industry from public classification signals. That is what turns a single score into a verdict: you can see whether you are ahead of your sector and your market, or exposed.
- Averages by industry, country and continent
- Country from ccTLD and public signals
- Your score placed against your peers
- A live, public picture, not a static report
Refreshed monthly, and honest about limits
The benchmark is rescored on a monthly cadence, so it reflects the current state of the internet rather than a one-off snapshot. Because it is built from public DNS, it measures what a domain publishes, which is exactly what an attacker or a receiving mail server sees. It does not claim to measure private mail-flow or internal configuration we cannot observe. That boundary is deliberate: everything in the benchmark is public, checkable and reproducible.
See where your domain stands
Run the same check, on your own domain, against the whole field.
Check your domain Explore the benchmark