The CAC 40 locks down its email: 85% of groups enforce DMARC, against 34% of large French cities

KrakenShield barometer, October 2026: we looked at the corporate websites of the 40 companies in France’s CAC 40 index, from the outside and without forcing anything, using exactly the same method as our barometer of France’s 100 largest cities. The result is clear: 93% of graded sites get A or A+, none goes without HSTS and 85% of domains enforce a DMARC policy. Large groups have done their homework. The gap with the rest of the economy, however, is widening.

This barometer looks for no vulnerability: it only records what any visitor can see, and no company is named. Since the 40 companies of the index are public knowledge, we go further than usual: any count of one or two companies is masked, so that none can be recognised.

1. Flawless encryption

Of the 39 sites measured, all present a valid certificate, none still accepts TLS 1.0 or TLS 1.1, and all but one or two companies support TLS 1.3. No site serves its page in clear text over HTTP: 89.7% redirect to HTTPS, the others do not answer the robot on the HTTP port.

What it means: on the encryption layer, the CAC 40 is where it should be. Large cities come close (100% valid certificates, 93% on TLS 1.3), but 4% of them still accept retired versions.

2. HSTS everywhere, often at the maximum

None of the 30 assessable pages goes without HSTS. 80% enable it for at least a year, 73.3% extend it to subdomains and 43.3% ask to be included in the browsers’ preload list.

What it means: a visitor’s first connection cannot be diverted to an unencrypted version. Among large cities, 39.8% of sites still lack this header.

3. Email: the most striking gap

61.5% of domains are on DMARC p=reject and 23.1% on p=quarantine: in total, 84.6% ask mail providers to set aside emails that spoof their name. 12.8% remain in monitoring-only mode (p=none), and one or two companies have no record at all. SPF is present on 100% of domains, ending with a strict rule (-all) on 66.7%.

What it means: impersonating a large group by email, from its exact domain, has become hard. For the 100 largest cities, it is the opposite: 65.7% of domains enforce no DMARC policy, and only 13.1% are on reject.

The consequence: fraudsters do not give up, they move. A fake invoice sent “by” a subcontractor, a fake bank details change “from” a supplier or a fake notice “from” the city hall get through where the domain enforces no policy. The weak link is no longer the large group, it is its ecosystem.

4. Browser protections: widely deployed, not complete

80% of sites declare a Content-Security-Policy (against 31.2% for large cities), 83.3% protect against clickjacking and 90% send X-Content-Type-Options. Newer headers are less common: 50% for Referrer-Policy, 30% for Permissions-Policy. As a result, only 20% combine all six protections observed, but no site lacks them entirely.

The fix: the two missing headers take a few lines to add, with no risk to the site.

5. Cookies, a point in common with local authorities

53.3% of home pages set at least one cookie on the first visit. 20% set at least one without the Secure attribute, and 30% without HttpOnly: proportions comparable to those of large cities (19.4% without Secure). These cookies often come from third-party analytics or consent tools. Finally, 17.9% of domains publish a CAA record, twice as many as cities (8.1%), but still a minority.

6. A very high overall grade

With our simplified grade, 66.7% of graded sites get A+, 26.7% A, one or two companies B, and none C or F. For large cities, the share of A and A+ is 57.4%.

One last sign of maturity: 9 sites out of 39 answered our robot, which declares itself as such, with a filtering page. Large groups put their sites behind protection services that sort automated visitors. Their headers were not graded, which may slightly flatter the figures on this page.

What it changes for SMEs and mid-sized companies

The European NIS2 directive asks the entities in scope to manage the security of their supply chain. Large groups, already well protected, are therefore looking more and more at the configuration of their suppliers and subcontractors: DMARC, HSTS, certificates and headers are among the first checks, because they can be verified from the outside in seconds.

The settings that make the difference in this barometer require neither budget nor a dedicated team: a few DNS records and a few HTTP headers. It is the easiest gap to close.

Methodology Passive measurement carried out on 11 October 2026 on the corporate websites of the 40 companies in the CAC 40 (composition as of 9 October 2026, checked on Euronext), with the same method and grade as our large cities barometer. 39 sites measured successfully, 1 failure (HTTPS connection reset twice). Only the home page, its headers and public DNS records were read: no port scan, no vulnerability test, no form. Header indicators cover the 30 home pages served normally (9 sites returned an anti-bot filtering page). Limits: a snapshot at one date, corporate site only (neither online shops nor customer areas), email may use a different domain from the website, and a header being present does not guarantee an effective policy. No company is named and counts of one or two companies are masked.