DE EN IT

~/home / e-mail ranking: italy

E-mail ranking: Italy.

Can someone send mail in the name of these domains without it landing in spam? We read SPF, DMARC and MTA-STS of 30 domains from public DNS, as of 6 November 2026.

AllGermanyItalyBanks

30domains checked
13with DMARC p=reject
57 %without an effective DMARC block
80median score

57% of the domains do not reject forged mail (no DMARC, p=none or p=quarantine).

Grade distribution

RankDomainScoreSPFSPF -allDMARCPolicyReportsMTA-STS
1Aagenziaentrate.gov.it90SPF: yesSPF -all: yesDMARC: yesDMARC policy: rejectReports: yesMTA-STS: noCheck live
2Aaruba.it90SPF: yesSPF -all: yesDMARC: yesDMARC policy: rejectReports: yesMTA-STS: noCheck live
3Abancobpm.it90SPF: yesSPF -all: yesDMARC: yesDMARC policy: rejectReports: yesMTA-STS: noCheck live
4Abper.it90SPF: yesSPF -all: yesDMARC: yesDMARC policy: rejectReports: yesMTA-STS: noCheck live
5Ainps.it90SPF: yesSPF -all: yesDMARC: yesDMARC policy: rejectReports: yesMTA-STS: noCheck live
6Aintesasanpaolo.com90SPF: yesSPF -all: yesDMARC: yesDMARC policy: rejectReports: yesMTA-STS: noCheck live
7Amediaworld.it90SPF: yesSPF -all: yesDMARC: yesDMARC policy: rejectReports: yesMTA-STS: noCheck live
8Arai.it90SPF: yesSPF -all: yesDMARC: yesDMARC policy: rejectReports: yesMTA-STS: noCheck live
9Asubito.it90SPF: yesSPF -all: yesDMARC: yesDMARC policy: rejectReports: yesMTA-STS: noCheck live
10Asky.it90SPF: yesSPF -all: yesDMARC: yesDMARC policy: rejectReports: yesMTA-STS: noCheck live
11Bfastweb.it83SPF: yesSPF -all: noDMARC: yesDMARC policy: rejectReports: yesMTA-STS: noCheck live
12Bfineco.it83SPF: yesSPF -all: noDMARC: yesDMARC policy: rejectReports: yesMTA-STS: noCheck live
13Bvodafone.it83SPF: yesSPF -all: noDMARC: yesDMARC policy: rejectReports: yesMTA-STS: noCheck live
14Bansa.it80SPF: yesSPF -all: yesDMARC: yesDMARC policy: quarantineReports: yesMTA-STS: noCheck live
15Bunicredit.it80SPF: yesSPF -all: yesDMARC: yesDMARC policy: quarantineReports: yesMTA-STS: noCheck live
16Bwindtre.it80SPF: yesSPF -all: yesDMARC: yesDMARC policy: quarantineReports: yesMTA-STS: noCheck live
17Cagid.gov.it60SPF: yesSPF -all: yesDMARC: yesDMARC policy: noneReports: yesMTA-STS: noCheck live
18Cbancaditalia.it60SPF: yesSPF -all: yesDMARC: yesDMARC policy: noneReports: yesMTA-STS: noCheck live
19Ccorriere.it60SPF: yesSPF -all: yesDMARC: yesDMARC policy: noneReports: yesMTA-STS: noCheck live
20Ciliad.it60SPF: yesSPF -all: yesDMARC: yesDMARC policy: noneReports: yesMTA-STS: noCheck live
21Cmps.it60SPF: yesSPF -all: yesDMARC: yesDMARC policy: noneReports: yesMTA-STS: noCheck live
22Cposte.it60SPF: yesSPF -all: yesDMARC: yesDMARC policy: noneReports: yesMTA-STS: noCheck live
23Crepubblica.it60SPF: yesSPF -all: yesDMARC: yesDMARC policy: noneReports: yesMTA-STS: noCheck live
24Dilsole24ore.com53SPF: yesSPF -all: noDMARC: yesDMARC policy: noneReports: yesMTA-STS: noCheck live
25Dlastampa.it53SPF: yesSPF -all: noDMARC: yesDMARC policy: noneReports: yesMTA-STS: noCheck live
26Dregister.it53SPF: yesSPF -all: noDMARC: yesDMARC policy: noneReports: yesMTA-STS: noCheck live
27Dtrenitalia.com53SPF: yesSPF -all: noDMARC: yesDMARC policy: noneReports: yesMTA-STS: noCheck live
28Dmediolanum.com35SPF: yesSPF -all: yesDMARC: noDMARC policy: –Reports: noMTA-STS: noCheck live
29Ftim.it28SPF: yesSPF -all: noDMARC: noDMARC policy: –Reports: noMTA-STS: noCheck live
30Fgov.it0SPF: noSPF -all: noDMARC: noDMARC policy: –Reports: noMTA-STS: noCheck live

And your domain?

Check SPF, DMARC and MX in ten seconds.

Create a DMARC record →

Why it matters

Without DMARC at p=reject, scammers can send mail with exactly this sender address and many mailboxes will deliver it. That is how a lot of phishing in the name of banks, parcel services and authorities works. SPF says which servers may send; DMARC tells the receiver what to do with forgeries.

How we measured

Public DNS queries only; nothing is sent to the domains. Points: SPF present 20, SPF with -all 15 (~all 8), DMARC present 20, p=reject 30 (quarantine 20), reports (rua) 5, MTA-STS 10. Grade A from 90, B from 75, C from 55, D from 35, otherwise F. The main domain is measured (the organisational domain for subdomains).

Reading it fairly

DKIM cannot be checked from outside without the selector, so it is left out. p=quarantine is better than nothing but protects less than reject. A low grade does not mean the provider's mail is insecure, only that forgeries get through more easily.

Also: header ranking (HSTS, CSP & co) →