email-transport · severity high
Mail transport encryption
Share of email-active domains whose primary mail server accepts mail without offering STARTTLS — inbound mail is delivered in the clear.
Measured every Friday · last updated
How it is measured
Connect to the lowest-preference MX on port 25, EHLO, check for the STARTTLS capability. Denominator: has_mx, further restricted to MXs that answer.
Why it matters
If STARTTLS is not offered, every inbound message crosses the internet in plaintext, readable by anything on the path. The domain may have perfect SPF/DMARC and still be handing its mail over in the clear.
Limits of this measurement
~32% of small-company MXs never answer within a 6s timeout and are excluded, so this is measured over reachable mail servers.
The base rate
Two independent populations. The global, domain-anchored figure is unbiased; the company-anchored figures are built by matching company names to domains and skew toward more digitally-mature firms. Both are published, so the gap is visible.
By company size band
Company-anchored cuts (national registries with a size proxy), split by size band. Right-hand figure is the share not meeting the control.
Every segment
Pick one to see the citable answer for a company like yours, with its trend and methodology.
Show the remaining 3 segments
Slices below 100 measured members are withheld rather than shown with a wide interval — an absent country or issuer means too little data, not zero failures. Licensed CC BY 4.0. Machine-readable data per segment: append .json or .csv to its URL.