Deliverability briefing, Saturday, 5 September 2026
aon.com and zoho.com tighten mail-spoofing settings
No cold email story cleared our bar for corroboration today, so the movers in our daily panel are the news. aon.com and zoho.com both tightened the settings that let mail servers reject messages forged in their name. Across the 499 companies we track, the overall picture held steady from yesterday.
Inbox Rules Index
499 of 499 companies checked, Saturday, 5 September 2026
Every morning we look up the published email settings of the same 499 real companies, the kind you send cold email to. This is what they have set up, not a score on your own sending.
Today's panel shows 88.4% of the 499 companies we track block mail that fakes their address, unchanged from yesterday and up 0.6 percentage points from our 10 August baseline. That figure describes how these companies protect their own name, not how your cold email is judged when it lands in their inbox.
What this means for your sending
Proofpoint screens more of these companies than anything else, at 33.9%, so it is the filter most of your cold email actually meets. 6.4% ask senders for an encrypted connection, so an expired or mismatched certificate on your sending server can stop mail reaching them at all. 2.4% cannot receive email at all, which is dead weight on any list that includes them. The rest is about how these companies stop others forging their address. It is a good sign of how seriously they run email security, but it is not what decides where your mail lands: that is judged against your own domain's records.
Who changed their setup
| aon.com | Sender list: loose list → locked list | stricter |
| zoho.com | Sender list: nothing published → locked list | stricter |
2 of these companies changed their email setup since Friday, 4 September 2026: 2 got stricter. If any are on your list, the stricter ones are running their email security actively.
Whose spam filter your email meets
| Proofpoint | 33.9% | |
| Microsoft 365 | 26.1% | |
| Google Workspace | 18.8% | |
| Their own servers, or unknown | 9.6% | |
| Mimecast | 4% | |
| Cisco Secure Email | 3.8% |
Proofpoint screens about one in every 3 of these companies, more than any other filter. This is the software that reads your email before a person does, and it is the part of this briefing that most directly decides whether you land.
Which industries guard their name hardest (companies checked)
| Software (126) | 97.6% | |
| Finance (54) | 94.4% | |
| Services (28) | 92.9% | |
| Healthcare (47) | 89.4% | |
| Logistics (17) | 88.2% | |
| Retail (50) | 88% | |
| Travel (25) | 88% | |
| Energy (24) | 87.5% | |
| Media (26) | 84.6% | |
| Telecoms (30) | 80% | |
| Industrial (44) | 79.5% | |
| Schools and universities (28) | 57.1% |
Software guards its name hardest: 97.6% block mail faking their address. Schools and universities least, at 57.1%, a gap of 40.5 points. A high number means that industry runs email security tightly, so expect your own setup to be looked at more closely there.
All 499 of the 499 companies we check answered today. The same real companies every morning, looked up in public DNS. This is what the people you email have set up, not a score on your own sending.
What these numbers mean
Does 88.4% enforcement mean my cold email gets rejected?
No. That 88.4% measures whether a company blocks mail forged as them, not how they treat mail arriving from you. Your delivery depends on your own domain's settings, not theirs.
Which gateways sit in front of the companies you email?
Proofpoint sits in front of 33.9% of the companies in our panel, Microsoft 365 in front of 26.1%, and Google Workspace in front of 18.8%. These are the gateways that scan your mail first, before it ever reaches an inbox.
What actually changed today?
aon.com and zoho.com both moved their SPF setting, the rule that lists which servers may send as their domain, from a loose setting to a strict one. Nothing else in the 499-company panel shifted, and the overall enforcement rate stayed at 88.4%.
Get this in your inbox every morning
One email a day: what changed in mailbox provider rules overnight, and the day's DMARC measurement. Free, and one click to stop.
We use your address to send this briefing and nothing else. Unsubscribe from any email.