Spoofhound research · published 2026-10-19
State of DMARC 2026 — United Kingdom
Three in four UK domains can be impersonated by email.
Spoofhound scanned the UK web — every mail-receiving .uk domain in the Tranco top one million plus 40,563 mapped UK businesses, 54,567 domains in all, the largest scan we’ve published — with the same engine behind our free domain check. The UK’s story is “started, not finished”: its best sites lead Europe, its high street does not.
Check your domain — freeThe headline
Three in four UK domains that receive email can be impersonated. Of 54,567 UK mail-receiving domains checked, 41,270 (75.6%) either publish no DMARC record, leave it in monitor-only mode, or have a broken record — so receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •24.4% enforced — better than France (15.7%), far behind Saudi Arabia (45.7%). The UK sits in the middle of the markets scanned so far, split almost evenly between quarantine (12.6%) and full reject (11.8%).
- •37.4% publish nothing at all — 20,419 domains with no DMARC record, no policy and no reporting address: their owners would never learn their domain is being abused.
- •37.7% are parked at p=none — the largest single group. More than 20,000 UK organisations did the first step, receive the reports (or don’t read them), and never tightened the policy. The UK’s problem isn’t ignorance of DMARC; it’s unfinished adoption.
DMARC across the UK web
The UK’s shape is “started, not finished”: monitor-only (37.7%) is the largest single group, fractionally ahead of no record at all (37.4%). Unlike Saudi Arabia, where adopters overwhelmingly reach p=reject, UK enforcers split almost evenly between quarantine and reject. The 257 broken records (duplicates, invalid or misspelt policies) are treated by receivers exactly like no record at all.
The rest of the stack
DMARC is the enforcement layer, but the scan covers the whole chain. Among the same 54,567 UK mail-receiving domains:
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all — any server anywhere may send as the domain | 5,694 (10.4%) |
| SPF | Record ends +all or ?all — published, but permits everyone anyway | 1,074 (2.0%) |
| Microsoft 365 DKIM | Both signing selectors broken — their outgoing mail can fail authentication today | 185 |
| MTA-STS | Protects inbound mail against interception — adopted | 1,359 (2.5%) |
| TLS-RPT | Reports failed secure delivery — adopted | 1,775 (3.3%) |
| BIMI | Verified logo in the inbox — live | 921 (1.7%) |
The average UK domain scores 36.4 out of 100 on the full check, and 44,033 (80.7%) carry at least one problem worth fixing. SPF hygiene is the UK’s weakest basic: at 10.4% missing, it is worse than France (9.2%) and Saudi Arabia (7.0%). The encryption and branding layers are thin everywhere, but the UK’s MTA-STS and TLS-RPT adoption (2.5% and 3.3%) is several times the French and Saudi rates — early-adopter territory, still a visible differentiator.
Small businesses against the popular web
The same gap as every market we scan, measured on the slice nobody else measures:
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| UK businesses with 1–3 locations (shops, offices, trades) | 40,032 | 41.5% | 37.9% | 20.1% |
| UK’s top-100,000-ranked .uk websites | 1,184 | 11.8% | 24.2% | 64.0% |
The popular web has largely done the work — 64% enforcement is the highest top-100k figure we’ve measured, ahead of France’s 55.8%. The high street hasn’t: 79.9% of UK small businesses can be impersonated by email, and 84.7% carry at least one email-security problem. The gap between the UK’s best and its high street — 64% against 20% — is the widest of any market scanned so far.
Who is most exposed
Enforcement by trade, worst first (UK mapped businesses, sectors with 400+ checked domains):
| Sector | Domains | No DMARC record | Enforced |
|---|---|---|---|
| Hairdressers | 1,685 | 55.3% | 6.0% |
| Florists | 514 | 46.9% | 9.3% |
| Beauty salons | 1,243 | 48.3% | 9.9% |
| Bakeries | 517 | 48.5% | 11.0% |
| Bicycle shops | 700 | 48.4% | 11.9% |
| Garages / car repair | 1,324 | 55.5% | 12.0% |
| Opticians | 551 | 47.7% | 12.3% |
| Breweries | 422 | 36.5% | 14.9% |
| Jewellers | 600 | 41.3% | 15.2% |
| Clothes shops | 1,582 | 35.3% | 17.0% |
| Car dealers | 983 | 51.3% | 22.7% |
| Estate agents | 2,062 | 36.0% | 25.0% |
| Accountants | 654 | 41.7% | 29.2% |
| Law firms | 984 | 34.7% | 38.1% |
| Company offices | 2,437 | 29.7% | 39.2% |
Two readings jump out. Three in four UK estate agents can be impersonated (25.0% enforced) — the businesses that email bank details for deposits, rent and completions, in the market where Friday-afternoon conveyancing fraud is a named crime pattern. And the professions handling the most sensitive money and data — accountants at 29.2%, law firms at 38.1% — do better than the high street but still leave most of their domains open. As everywhere, protection tracks IT support, not fraud exposure.
Methodology
Population. 54,567 UK domains that receive email (publish working MX records), from two sources: every .uk domain in the Tranco top-1-million research ranking of popular websites (41,547 mail-receiving), and 40,563 UK businesses mapped on OpenStreetMap with a website of their own (any domain ending; platform pages and social profiles excluded). 27,543 domains appear in both. Domains with no MX, and hosted-page domains the business doesn’t control, are excluded (22,434 .uk Tranco domains and 2,566 mapped businesses receive no mail).
Checks. Each domain was scanned by Spoofhound’s own engine — the same one behind the free domain check — covering SPF, DKIM (common selectors), DMARC, MTA-STS, TLS-RPT and BIMI, via DNS and policy-file fetches. Every figure reflects a scan within the 30 days to 2026-10-19.
Honest limits. A .uk-TLD population misses UK organisations that use only .com — the mapped-business source partly corrects this, since it includes any domain ending. DKIM can only be confirmed present, never absent, so no DKIM-absence claims are made. The business sample covers mapped businesses with websites, which skews towards visible, consumer-facing trades. “Enforced” means p=quarantine or p=reject on the organisational domain; pct<100 and broken records are counted as unenforced, as receivers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free