How well do the UK's most visited websites protect their email from spoofing? We checked the public DNS records of the 1,000 most popular .uk domains on 16 October 2026 for SPF, DMARC, MTA-STS, TLS-RPT, BIMI, CAA and DNSSEC. The short version: most of them publish SPF and DMARC, but one in three still does not enforce DMARC, and the newer protections that stop email being intercepted in transit are rare outside the public sector.
These are popular, well-resourced sites. If you run a smaller business, use the numbers as a benchmark rather than a description of you, and check your own domain in under a minute.
Key takeaways
- One in three of the 1,000 most popular .uk domains still does not enforce DMARC with a quarantine or reject policy.
- 85.2% publish a DMARC record, but 19.6% sit at p=none, which only monitors and still lets spoofed email be delivered.
- Only 3.1% of commercial .uk domains publish MTA-STS, against 33.3% of public sector domains.
- Publish SPF, turn on DKIM, start DMARC at p=none with reporting, then move to quarantine and reject.
Key findings at a glance
Percentages are of the 998 domains that resolved (two of the 1,000 no longer existed).
| Check | All .uk domains | Commercial (.co.uk, .uk) | Public sector (.gov.uk, .ac.uk, .nhs.uk…) |
|---|---|---|---|
| SPF record published | 90.2% | 87.3% | 95.4% |
| DMARC record published | 85.2% | 80.8% | 95.8% |
| DMARC enforced (quarantine or reject) | 65.5% | 62.5% | 73.6% |
| DMARC at p=reject | 39.6% | 40.0% | 39.4% |
| DMARC with reporting (rua) | 77.6% | 71.1% | 94.4% |
| MTA-STS | 11.8% | 3.1% | 33.3% |
| TLS-RPT | 15.5% | 3.7% | 45.8% |
| BIMI | 7.7% | 9.1% | 4.2% |
| CAA | 12.6% | 10.5% | 16.7% |
| DNSSEC (validated) | 5.7% | 5.5% | 4.2% |
| Neither SPF nor DMARC | 8.4% | 11.1% | 3.7% |
Three things stand out:
- DMARC is widespread but often toothless. 85% publish a DMARC record, but almost one in five (19.6%) sits at
p=none, which only monitors. A spoofed email from those domains is still delivered. - Commercial sites lag the public sector on everything except BIMI. Government guidance and the NCSC's long push on email security show up clearly: public sector domains are far more likely to enforce DMARC, collect reports and run MTA-STS.
- Transport security is the gap nobody talks about. Only 3.1% of commercial domains publish MTA-STS, so the vast majority of UK business email can still be downgraded to an unencrypted connection by an attacker on the path.
SPF: almost universal, mostly configured sensibly
90.2% of domains publish an SPF record. Among them, the ending matters:
| SPF ending | Share of all domains | What it means |
|---|---|---|
-all (hard fail) |
47.7% | Unlisted servers should be rejected |
~all (soft fail) |
38.8% | Unlisted servers are suspicious, usually still delivered |
?all / +all |
0.9% | Neutral or "anyone may send", which offers no protection |
~all is not a mistake. With DMARC enforcing, many senders deliberately leave SPF at soft fail and let DMARC make the final decision. The real problems are the 0.9% using ?all or +all, which tells receivers not to worry about spoofing at all, and the 0.3% publishing two SPF records, which makes SPF fail with a permanent error.
If you are not sure what your record says, our SPF checker reads it and flags both problems, and the SPF record generator builds a valid one.
DMARC: published by most, enforced by two in three
DMARC is the record that tells receiving mail servers what to do with mail that fails SPF and DKIM alignment. Without enforcement, it does not stop anyone spoofing your domain.
| DMARC policy | All | Commercial | Public sector |
|---|---|---|---|
| No record | 14.8% | 19.2% | 4.2% |
p=none (monitor only) |
19.6% | 18.3% | 22.2% |
p=quarantine |
26.0% | 22.5% | 34.3% |
p=reject |
39.6% | 40.0% | 39.4% |
A few points worth drawing out:
- One in five commercial domains has no DMARC record at all. For domains that actually receive email (they publish MX records), the figure is 11.8% for commercial and 0.5% for the public sector.
p=noneis a starting point, not a destination. Around a fifth of domains are stuck there. That is the stage where you collect reports and fix legitimate senders, and it should last weeks, not years.- Reporting is missing on almost a third of commercial records. 71.1% of commercial domains include a
rua=address. Without it, the domain owner never sees who is sending as them, which makes moving to enforcement guesswork.
Gmail, Yahoo and Microsoft now require bulk senders to publish DMARC (even at p=none), so a missing record can hurt deliverability as well as security. See our guide to Gmail, Yahoo and Microsoft sender requirements, and the step-by-step path from monitoring to rejection in DMARC explained.
Check yours: the DMARC checker shows your policy and reporting address, and the DMARC record generator gives you a safe record to publish.
MTA-STS and TLS-RPT: the public sector is years ahead
SPF, DKIM and DMARC deal with who is allowed to send as your domain. MTA-STS deals with how mail reaches you: it tells other mail servers to deliver only over a verified, encrypted connection. TLS-RPT sends you reports when that fails.
| All | Commercial | Public sector | |
|---|---|---|---|
| MTA-STS | 11.8% | 3.1% | 33.3% |
| TLS-RPT | 15.5% | 3.7% | 45.8% |
A public sector domain is more than ten times as likely as a commercial one to publish MTA-STS. That reflects years of NCSC guidance for government email. For most businesses, MTA-STS is a short policy file plus two DNS records, and Google Workspace and Microsoft 365 both support it. Our guide to MTA-STS and TLS-RPT walks through the setup.
BIMI: the one area where business leads
BIMI lets a verified brand logo appear next to your emails in supporting inboxes, including Gmail. It requires DMARC at enforcement first, so it is a sign of mature email set-up.
9.1% of commercial domains publish BIMI, against 4.2% in the public sector, which makes sense: it is a marketing feature. If you are considering it, start with how to get your logo in Gmail.
CAA and DNSSEC: still rare
Two DNS protections outside email were also uncommon:
- CAA (12.6%) lists which certificate authorities may issue SSL certificates for the domain. It is one record and limits the damage if someone tries to obtain a certificate for your name. See CAA records explained.
- DNSSEC (5.7%) signs DNS answers so they cannot be forged in transit. Adoption is low across the board because it depends on the registrar and DNS host supporting it. See what DNSSEC is.
You can see both on any domain with our DNS lookup.
What this means for UK businesses
The domains in this study are among the most visited in the UK, run by organisations with IT teams. Even so:
- one in three does not enforce DMARC
- one in nine commercial domains has neither SPF nor DMARC
- fewer than one in thirty commercial domains protects mail in transit with MTA-STS
We have not measured smaller businesses here, so we will not put a number on them. But if your domain does not yet have SPF, DKIM and an enforced DMARC policy, you are behind organisations that are already behind the public sector.
A practical order of work
- Publish SPF listing every service that sends as you (website, newsletter, invoicing, Microsoft 365 or Google Workspace).
- Turn on DKIM with each of those providers. Finding your DKIM selector is the usual sticking point.
- Publish DMARC at
p=nonewith arua=address, read the reports for two to four weeks, and fix any legitimate sender that fails. - Move to
p=quarantine, thenp=reject. - Add MTA-STS and TLS-RPT, then CAA. Consider BIMI once DMARC is enforced.
Or run a free website audit: the email section checks SPF, DKIM, DMARC, MX, MTA-STS and BIMI in one go and gives you the exact records to fix.
Methodology
- Sample: the first 1,000 domains ending in
.ukin the Tranco top-1M list (list ID Y8JGG, retrieved 16 October 2026). Tranco ranks domains by popularity using several traffic data sources and is designed for research. - Checks: public DNS records only, queried through Cloudflare's DNS-over-HTTPS resolver on 16 October 2026: TXT at the apex (SPF),
_dmarc(DMARC),_mta-sts(MTA-STS),_smtp._tls(TLS-RPT),default._bimi(BIMI), CAA at the apex, MX, and the resolver's DNSSEC validation flag. - Segments: "commercial" means
.co.uk,.ltd.uk,.plc.uk,.me.ukand second-level.ukdomains; "public sector" means.gov.uk,.ac.uk,.nhs.uk,.police.uk,.sch.uk,.mod.ukand.parliament.uk; everything else (mainly.org.uk) is "other". "Other" is included in the "All" column. - Limitations: we read DNS only and did not send email or test delivery. CAA was checked at the apex only. A record being present does not prove it is correct (we did not validate DKIM, which needs a selector, or the MTA-STS policy file). BIMI was checked at the
defaultselector. Popular domains are not representative of all UK businesses. Results are a snapshot of a single day.
No individual domain is named in this report. We are happy to share the aggregate figures for research or journalism: contact hello@makeitflow.si.
Frequently asked questions
What percentage of UK websites have DMARC?
In our study of the 1,000 most popular .uk domains, 85.2% published a DMARC record, but only 65.5% enforced it with a quarantine or reject policy. Among commercial domains the figures were 80.8% and 62.5%.
Is p=none enough for DMARC?
No. p=none only monitors and asks receivers to send you reports; spoofed mail is still delivered. Use it for a few weeks to find legitimate senders, then move to p=quarantine and p=reject.
Why does the public sector score higher than businesses?
UK government organisations have followed NCSC email security guidance for years, which requires DMARC enforcement and recommends MTA-STS and TLS-RPT. Our data shows public sector domains are far more likely to enforce DMARC, collect reports and run MTA-STS.
What is MTA-STS and do I need it?
MTA-STS tells other mail servers to deliver email to you only over an encrypted, verified connection, which stops downgrade attacks. Only 3.1% of commercial .uk domains in our study had it, so adding it puts you ahead of most UK businesses.
How can I check my own domain?
Use our free email deliverability checker to see SPF, DKIM, DMARC and MX in one place, or run a full free audit at makeitflow.si.
Sources
- Tranco: A Research-Oriented Top Sites Ranking
- Tranco list Y8JGG
- RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC)
- RFC 8461: SMTP MTA Strict Transport Security (MTA-STS)
- RFC 8460: SMTP TLS Reporting
- NCSC: Email security and anti-spoofing
- Cloudflare: DNS over HTTPS JSON API
Written by the MakeItFlow team
We build the website audit these guides are based on. Every fact is checked against the primary sources listed above and this guide was last reviewed on 21 October 2026 . How we research and check
Check your own site in 30 seconds
Run a free audit covering speed, SEO, DNS, email authentication and security headers — and get a prioritised fix list.
