UK MSP DMARC audit: Q3 2026

The typical provider has published DMARC and enforces it, but stops short of the transport and DNS checks that lift a grade to an A. 76% send fakes to spam or refuse them (p=quarantine or p=reject), the same share as in Q2, while 1 provider of 192 passes all five transport and DNS checks.

Little changed over the summer. In the 109 days since the Q2 scan on 29 June, 3 providers strengthened their DMARC policy and none weakened it. Over the same period 5 SPF records grew past the 10-lookup limit, and 5 other providers fixed a setting that full enforcement needs.

Fewer providers reach the top grades than Q2 reported, because the Q2 report overstated the top end, which we have now corrected (see what changed since Q2). Against the corrected figures, the share at A or A+ is unchanged at 4%.

On 16 October 2026, between 19:27 and 19:30 UTC, we graded the primary domain of each of the 192 providers from the Q1 and Q2 editions with the ShieldMarc Security Grade: the same code our free Security Grade tool runs. We read public DNS, the registry's public RDAP record, the TLS certificate on the bare domain and, where a domain publishes MTA-STS, its public policy file. No email was sent, no system was accessed and nothing was tested for vulnerabilities.

Every scan completed: no lookup of ours failed, and every domain had a live MX record. One provider's registration reached its expiry date early on the day of the scan, and the registry had not yet shown it renewed, so the grade counted it as lapsed: that provider is a B and would otherwise be a B+. As in earlier editions, we publish aggregate figures only and name no provider.

How the grade works

The grade is built from 16 outside-in checks, grouped in the order to fix them: the basics (an SPF record, a DMARC record, a reporting address and a valid certificate), enforcement, full enforcement, and transport and DNS hardening (MTA-STS, TLS-RPT, DNSSEC, CAA and a registrar transfer lock), plus whether the registration has lapsed. DKIM is not graded, because it cannot be confirmed without seeing the domain's mail.

A domain that gets email authentication fully right, passing every check in the first three groups, earns a B. The five transport and DNS checks then lift it: for most domains, two make a B+, three an A and four or more an A+.

What changed in the grade since Q2

We made the grade stricter between the editions, and in places fairer. Each change applies to every domain the free tool grades, not only to this audit:

• Certificate issuance (CAA). In Q2 a domain whose DNS Cloudflare hosts passed without a CAA record. With no CAA record any certificate authority may issue for a domain (RFC 8659), so it no longer passes, and nor does a record that covers wildcard certificates only. This affects all 60 providers on Cloudflare and 1 other.
• DNSSEC has to validate. Q2 counted a zone that published DNSSEC keys. Validating resolvers use them only when the parent zone holds a DS record, so 6 providers that publish keys without one no longer pass.
• MTA-STS and TLS-RPT have to work. A record is no longer enough. MTA-STS needs a valid record, a policy file senders can fetch and a mode other than none; TLS-RPT needs one record with a usable reporting address. 6 MTA-STS and 2 TLS-RPT records fail on this.
• SPF has to be usable. A record that receivers reject outright (such as a syntax error, an include or redirect= that points at no SPF record, or more than two lookups that find nothing) now fails the SPF record check; in Q2 any record passed. 4 providers fail on this.
• SPF is read through redirect=. Q2 read only the top-level record, so a record that ends in its redirect= target scored as having no ending. 10 providers now pass because of this.
• Reporting addresses at another domain need permission. Receivers that follow the standard send reports there only when that domain authorises them (RFC 9990 section 4). 2 providers name an address that has not, and now fail the reporting check.
• No DMARC, no policy. Without a usable DMARC record, the check that a policy applies to all mail now fails; it passed in Q2. This affects the 6 providers with no DMARC record.
• Registration. A registry that shows no lock status is no longer read as “no lock”. A renewal due within 30 days no longer fails; only a registration that has lapsed does.

On today's DNS, these changes lower 37 grades and raise 10. The Cloudflare change is involved in 30 of the 37 falls, and reading SPF through redirect= in 9 of the 10 rises.

B is the most common grade and C the average. Read cumulatively, 4% of providers earn an A or A+, 47% reach a B or better and 53% score a C or below.

The top is thin and the tail is long: 8 providers earn an A or A+, while 45 (23%) sit at D or F. Most of those 45 publish monitoring only (p=none) or no DMARC record.

Each band maps onto a few configuration choices, so a provider can see what is holding it where it is. The table counts each band's DMARC policy and hardening, and the notes below it say what holds each band back.

• A or A+ (8 providers): refusal plus hardening. Every one refuses fakes (p=reject) on the domain and its subdomains and passes at least three of the five transport and DNS checks. 7 of the 8 have MTA-STS and TLS-RPT working.
• B or B+ (82 providers): strong DMARC, little hardening. 63 refuse fakes and 19 send them to spam, and 14 have MTA-STS and TLS-RPT working. 8 already pass three or more transport and DNS checks: what holds them below an A is enforcement, such as p=quarantine instead of p=reject, or an SPF record over 10 lookups.
• C (57 providers): enforcement short of refusal. 49 send fakes to spam (p=quarantine), 4 refuse them and 4 publish monitoring only. 4 have MTA-STS and TLS-RPT working.
• D or F (45 providers): little or no enforcement. 36 publish monitoring only, 6 no DMARC record, and 3 send fakes to spam but have an SPF record receivers cannot use. 18 receive no reports, so they cannot see who sends email as them.

Most providers have the basics in place and lose marks from full enforcement onwards. The first table counts the providers that pass every check in a group; the second shows each check on its own.

A check that could not apply to a domain is left out of its count: 4 bare domains had no website that answered, 1 domain has no SPF record to count lookups in, and for 2 names the registry shows no lock status or expiry date. The steepest drop is from enforcement (76%) to full enforcement (30%): refusing fakes on the domain and its subdomains, and keeping SPF within 10 lookups, is where most providers stop.

97% of providers publish a DMARC record and 76% enforce it: 39% refuse fakes (p=reject) and 37% send them to spam (p=quarantine). 21% publish monitoring only (p=none), which expresses no preference about mail that fails, and 3% publish no DMARC record.

Subdomains are a gap at the top. Of the 75 providers that refuse fakes on their main domain, 9 set a weaker policy for subdomains (sp=none or sp=quarantine), so mail from an invented subdomain is not refused.

SPF is near universal but often too long. 189 providers end their SPF record in ~all or -all, but 19 of the 191 with an SPF record (10%) need 11 to 18 DNS lookups to evaluate it. Over 10, receivers that follow the standard stop with a permanent error once they pass the tenth lookup (RFC 7208 section 4.6.4), so SPF does not pass for mail from any service listed after that point. 5 of the 19 were within the limit in June.

26 providers (14%) receive no aggregate reports. 24 publish no reporting address (rua=). The other 2 name an address at another domain that has not published the authorisation record receivers look for, so no reports arrive.

66 providers still publish a pct= tag, which RFC 9989 retired. For 63 it is pct=100 and does nothing; 3 set it below 100, so receivers on the older standard apply the policy to only part of their mail.

Transport and DNS hardening is what lifts a strong domain from a B to an A, and it is where the sector is weakest. 1 provider passes all five checks, 17 pass three or more and 51 pass none.

Of the 27 MTA-STS policies senders can use, 14 are in enforce mode and 13 in testing mode, which asks senders to report problems but still deliver. 6 more providers publish an MTA-STS record that does not work: for 4 the policy file cannot be fetched (a certificate error, a redirect, a missing host and a host that does not answer), 1 record lacks its id= tag and 1 policy is set to mode: none. The MTA-STS checker shows which applies to a domain.

21 providers (11%) have DNSSEC that validates. 6 more publish DNSSEC keys but no DS record at the parent zone, so validating resolvers treat those zones as unsigned. For each of them the missing step is publishing the DS record through the registrar.

CAA is the rarest control, at 9 providers (5%). None of the 60 providers whose DNS Cloudflare hosts publishes a CAA record. On those zones one record is enough: Cloudflare then adds records for the certificate authorities it uses while Universal SSL is on, as our guide to CAA records explains.

119 of the 190 names whose registry shows a lock status (63%) have a transfer lock. This figure cannot be compared with Q2, because our June scan read no lock status for any .uk name.

Each provider is mapped to its publicly listed headquarters. Differences are modest and many regions are small, so read the n before the grade.

Wales (2 providers), providers headquartered outside the UK (18) and the North East (6) average a B. Every other region averages a C. London and the South East, with 40 providers each, are both a C, with 58% and 43% of providers at B or better.

What the providers changed

Very little. On the measures both editions read the same way, using the Q2 definitions, the totals barely moved:

Three providers strengthened their DMARC policy: one moved from p=quarantine to p=reject, one from p=none to p=reject, and one that had no DMARC record in June now publishes p=none. None weakened its policy. Between Q1 and Q2, 10 providers had advanced theirs.

Other changes were few too. 1 provider added a reporting address, 1 added CAA records, 1 removed its MTA-STS record, 1 removed DNSSEC, 1 changed its SPF ending from -all to ~all and 1 now serves a valid certificate. 5 SPF records grew past the 10-lookup limit, while 5 other providers now pass a full-enforcement check they failed in June (SPF lookups, pct= or sp=; the June data does not say which).

Why grades moved

46 providers have a different grade from Q2: 24 higher and 22 lower. Few of those moves come from the providers. Three things moved grades:

• Data we could not read in June. Our June scan read no transfer-lock status or expiry date for any of the 95 .uk names, or for 3 others, and counted each as having no lock. This time it read all 95 .uk names, and 35 .co.uk names show a lock.
• A stricter grade. The changes listed in the method lower 37 grades and raise 10.
• The providers. The policy, reporting, CAA, SPF and MTA-STS changes above.

We also found errors in the Q2 report: it credited Cloudflare-hosted domains with the CAA check, counted unread .uk lock data as no lock, and listed DKIM among the graded checks. The Q2 2026 audit now carries a correction. Corrected, 4% of providers earned an A or A+ in Q2, not 6%, and 25% sat at D or F, not 22%.

Against the corrected Q2 figures, the top is unchanged at 4% and slightly fewer providers sit at D or F. The rise in B or better, from 41% to 47%, comes mostly from how we read the records rather than from providers: of the 13 providers that moved up to B or better, 10 did so because of .uk registration records we can now read or SPF endings we now read through redirect=, 2 because they tightened their DMARC policy and 1 because it fixed a full-enforcement setting.

Each step moves most providers up one band, and the DMARC steps follow the NCSC's phased anti-spoofing guidance. Move on enforcement when the reports say it is safe, not by the calendar: our guide to moving from p=none to p=reject covers it, and our guide to DMARC for MSPs covers running it across client domains.

• D or F to C: publish DMARC with a reporting address (rua=), then move from monitoring only to p=quarantine once the reports show your legitimate services passing.
• C to B: move from p=quarantine to p=reject when the reports are clean, set sp=reject, remove any pct= tag and keep SPF within 10 lookups. The SPF checker counts them.
• B to A: once every check in the first three groups passes, pass three of the five transport and DNS checks. The usual three are MTA-STS, TLS-RPT and a registrar transfer lock. Serve the MTA-STS policy file at https://mta-sts.example.com/.well-known/mta-sts.txt over HTTPS, with a valid certificate and no redirect.
• A to A+: add a fourth: DNSSEC, with the DS record published through your registrar, or CAA records that name your certificate authorities (on Cloudflare, one record is enough).
• At any grade: if your reporting address is at another domain, check that the domain publishes the authorisation record for you. Without it, no reports arrive.

We plan to re-scan the same 192 providers for a Q4 2026 edition. If you run a UK MSP and would like to be included, or you think a result is wrong, open a ticket and we will check it before the next edition.