S&P 500 email security: not one domain scored above a C

We scanned every S&P 500 domain for SPF, DMARC, MTA-STS, DANE, and DNSSEC. Not one earned an A or a B - here's what the biggest companies get right, and skip.

The S&P 500 is shorthand for serious money and serious IT - 500 of the most valuable companies on earth, the ones you'd bet on to get the basics right.

So we tested that bet. SecRift scanned every domain in the index from the outside - no warning, no inside access, just the public signals any attacker can read - and graded each one exactly the way it grades any domain at secrift.com.

Corporate America did not ace it.

Five hundred household names. Not one earned an A or a B.

The 10 that came closest

These are the best-configured domains in the index. Look at the grade column: every one of them is a C. That is not a fluke - it is a ceiling, and we will get to why.

What they nailed, and what they skipped

Here is the surprising part: the S&P 500 is not careless. It is lopsided. The control everyone has heard of - the one that stops criminals from emailing the world as you - is in great shape. The quiet machinery that protects your mail in transit is almost untouched.

Then there is the part almost nobody touches.

That last number is the one that quietly caps everybody. Hold that thought.

The 10 at the bottom

At the other end, things fall apart - records missing, duplicated, or contradicting each other. Every domain here scored an F.

CrowdStrike won, and still couldn't crack a B

If anyone should run the table, it is a cybersecurity company - and CrowdStrike tops the index at 89 out of 100. On raw points, that is a B. The grade still reads C. Welcome to the ceiling.

CrowdStrike did almost everything right. MTA-STS in enforce mode, perfect. TLS-RPT, perfect. DNSSEC fully signed on the domain. DMARC at the strictest setting. A near-flawless sheet.

Two tiny things nibble at the score: SPF ends in ~all instead of a strict -all, and DMARC uses relaxed alignment. Fix both and the number climbs. The grade will not budge - because of this:

One critical finding pins the grade to C, full stop, no matter how high the score goes. The kicker: the missing piece lives in Proofpoint's DNS, not CrowdStrike's. The best-configured domain in the S&P 500 is held back by something it does not even control.

APA Corporation came last by trying twice

Dead last at 29 out of 100 is APA Corporation - and the twist is that APA tried. The SPF record exists. It is just doubled.

APA publishes two separate SPF records - and no DMARC at all. Here is the rule nobody warns you about: two records count as none. Mail servers see the duplicate SPF, give up, and apply no protection at all - so on paper APA authorizes its senders, and in practice it authorizes nobody. With DMARC missing too, nothing is left to catch the gap.

And that is before the rest: no MTA-STS, no TLS-RPT, no DANE, DNSSEC off. Here is the full scorecard.

Merging the SPF records and publishing one DMARC policy is a five-minute fix. Everything after that is a roadmap.

Why everyone hits the same wall

Six findings repeat across hundreds of the biggest companies in America, and a few simple reasons explain almost all of it.

Why nobody beats a C. It is not effort - it is physics. 88% of the index fails the same DANE check CrowdStrike did: the mail host's zone is not signed with DNSSEC, so DANE cannot work. Most of these companies outsource email to Proofpoint, Mimecast, or Microsoft 365, and those providers do not sign their mail zones. Until they do, their customers literally cannot deploy DANE, and that one critical finding caps the whole index at C.

Why DNSSEC stays off (90%). DNSSEC signs your DNS, but a botched key change does not fail gracefully - it can take your entire domain offline. When your domain is your business, the risk of self-inflicted downtime outweighs the upside. So the biggest brands treat it as a third rail.

Why SPF leans soft (~all on nearly half). A strict -all tells servers to reject anything not on the list. Forget one of your dozens of senders and you are blocking your own invoices. Soft fail ~all never does that - and with DMARC already enforcing, it is DMARC making the real call anyway.

The takeaway. The S&P 500 won the loud battle - stopping impersonation - and has barely started the quiet one: encrypting mail in transit. MTA-STS, TLS-RPT, and DANE adoption all sit in the single digits. The giants stopped the spoofers. They just have not locked the pipe yet.