42 Years After Germany Received Its First Email: eco Association Says Companies Must Take Responsibility for Email Security

A name, logo or plausible-looking sender address is not enough to reliably establish that an email really comes from a particular company. Nevertheless, 86 per cent of adults in Germany consider at least one of these visible features sufficient proof that an email can be trusted. This is according to a representative YouGov survey commissioned by eco - Association of the Internet Industry.

As a result, even 42 years after the first email was received in Germany, email remains the biggest gateway for cybercrime.

Fifty-two per cent of respondents generally consider an email trustworthy if it relates to a genuine customer relationship. Thirty-nine per cent rely on recognising the company name displayed, 32 per cent look for a sender address that includes the company's name and 21 per cent consider an email trustworthy if they have received no warning from their mailbox provider.

Seven per cent believe that none of the features covered by the survey reliably confirms that an email can be trusted.

"The results make it clear that companies must not leave it to their customers to assess whether their email communications are genuine. Names, domains and designs in emails can be imitated, which means that even vigilant users can fall victim to criminals," says Julia Janßen-Holldiek, Director of the Certified Senders Alliance (CSA), a service of the eco Association in cooperation with the German Dialogue Marketing Association (DDV).

"Trust begins not in the inbox, but in the domain and sending infrastructure. Brands must protect their digital sender identity and control their sending sources. They have a duty to configure their domains securely and monitor email traffic. Email service providers must also protect their platforms against misuse and respond quickly to incidents.

"Only then can mailbox providers filter out malicious messages before they reach recipients."

From personal trust to a technical chain of trust

The survey marks the 42nd anniversary of the first email sent to an independent German mail server on 3 August 1984. The recipient was Professor Michael Rotert, now Honorary President of the eco Association.

At the time, email communication between a small number of research institutions was based largely on mutual trust. In its original technical form, that first email would not meet today's authentication standards. Modern receiving systems might therefore be more likely to classify it as suspicious, move it to the spam folder or reject it.

Today, methods such as SPF, DKIM and DMARC help to verify an email's sending authorisation, signature and the domains it uses. For companies, however, setting up these methods once is not enough. Consistently high standards must be maintained throughout the entire sending chain.

Three tasks for companies

• Map all sending sources: Companies must know every internal system and external service provider that sends emails on their behalf, from newsletters and invoices to booking confirmations and password resets.
• Secure sender identity technically: SPF, DKIM and DMARC must be configured correctly, aligned with one another and monitored continuously.
• Monitor reputation and sending quality: Signs of abuse, complaints, undeliverable addresses and other quality metrics should be evaluated regularly, and problems should be resolved at an early stage.

Independently audited and measurable quality standards can help companies and sending platforms meet these requirements over the long term. For brands, this means greater control over their digital identity and reputation. Mailbox providers gain more reliable signals for evaluating messages. Recipients benefit from a more trustworthy inbox and more reliable delivery of wanted emails.

About the survey

The data from this survey is based on online interviews with members of the YouGov Panel who had agreed in advance to take part. A total of 2,057 people were surveyed between 22 and 24 July 2026. Quotas were set for age, gender, education, region, residential setting, voting behaviour and political interest, and the results were subsequently weighted accordingly. The results are representative of Germany's resident population aged 18 and over.