Research

UK Public Sector DMARC Tracker

Every domain in the official .gov.uk register, re-measured every hour. NCSC retired Mail Check on 31 March 2026 and named no replacement, so this is what the public sector’s email authentication actually looks like now, not what it was told to do. If your organisation is on this register and still needs a Mail Check replacement, start with the migration route from Mail Check or our DMARC services for UK organisations.

As of 26 October 2026, ShieldMarc’s tracker had a usable DNS reading for 7,908 of the 7,912 .gov.uk domains in the official register. 6,107 of them are parish, town and community councils or parish meetings, so every figure is split: 49.1% of parish councils and 67.1% of all other bodies are at enforcement (p=quarantine or p=reject), and 20.9% and 20.3% publish no DMARC record. Of those that publish DMARC, 50.1% of parish councils and 12.9% of other bodies send aggregate reports nowhere.

ShieldMarc’s figures on this page are licensed under CC BY 4.0: free to reuse with attribution. Cite as “ShieldMarc UK Public Sector DMARC Tracker” with the date. Every domain is also in the tracker’s CSV file. Updated continuously: 7,912 of 7,912 domains were re-measured in the last hour.

Domains tracked

7,912

scanned 26 October 2026

No DMARC at all

20.8%

−2.0 pts since baseline

Enforcing a policy

53.2%

+1.4 pts since baseline

Reports go nowhere

41.6%

+0.4 pts since baseline

Baseline is the first full scan, 27 July 2026. Mail Check closed on 31 March 2026 without publishing a final position, so there is no honest way to state where the estate stood on the day it retired; this tracker can only report from when it started measuring.

What the numbers say

Two findings stand out. First, NCSC told public bodies to move to a commercial DMARC product before Mail Check closed; on the latest scan 8.3% of domains publishing DMARC route their reports to one. Second, and more serious, 41.6% send aggregate reports nowhere at all. They publish a policy but collect no data, so nobody there can see whether the domain is being spoofed, or whether the organisation’s own legitimate mail is failing authentication.

A further 31.1% still point at the government reporting address. That address continues to accept mail, so those reports are still being delivered. Whether anyone analyses them now that Mail Check has closed is not something a DNS lookup can answer, and this tracker does not claim to know.

Read the split before quoting a headline

About three in four entries in the .gov.uk register are parish, town and community councils. Many of them have a single part-time clerk and no IT function at all. A single estate-wide percentage is therefore mostly a statement about parish councils, which is why the figures are split by body type below rather than averaged into one number.

How it is moving

Both lines are a share of the domains actually measured that day, so a night when DNS answers badly shrinks the denominator rather than inventing a drop. Days where nothing could be measured are left out instead of being drawn as zero.

Daily figures

The figures on this page as they stood at the last scan of each of the last 14 days (UTC), so a figure quoted with its date can be checked afterwards. They also move within a day as each hourly sweep lands, so a figure taken earlier in a day can differ a little from that day’s row. Each share gives the whole register first, then parish councils and all other bodies.

Enforcing and No DMARC are shares of the domains measured that day; Reports go nowhere is a share of those that publish DMARC. A share with no split, or a count marked “not kept”, is one that day’s snapshot did not record. Before 17 October 2026, 12 village and city councils that are parish tier were counted among other bodies, and before 22 October 2026 a further 88: councils whose name runs into a pc, tc or town suffix, group and joint parish councils, and parish meetings.

Where the estate went instead

NCSC told public bodies to move to a commercial DMARC product. These are the platforms the register actually moved to, counted from the reporting address each domain publishes. A body using a platform that sends reports to its own domain rather than the vendor’s will not appear here, so treat these as a floor.

Protected at the top, open underneath

349 domains publish an enforcing policy on the domain itself and sp=none beneath it. Those two tags together mean mail claiming to come from the organisation’s main address is checked, while mail from any subdomain of it is not, and a subdomain is exactly what someone spoofing a council would invent. It reads as protection in any summary that counts policies, which is why this page counts it separately. See those domains.

What has changed since the baseline

The most recent changes the tracker has seen since it started measuring, up to 25. A change is listed once the new policy has held for a full day, and it is shown against the last policy that also held for a day (for a domain's first change, the policy the tracker first read), so a domain whose answers flip back and forth between hourly sweeps is left out until it settles. Changes to and from no record follow the 3-day rule described under Method: a change to no record is listed while the record is still missing and has been found missing on 3 separate days, and a change back only if it had been. A shorter gap is skipped, like a flip. A first reading is not a change, so nothing appears on the strength of the tracker simply starting to measure. A domain with no delegation of its own answers with the registry wildcard's p=reject, so a move onto or off the wildcard is shown as the wildcard, not as the body strengthening or weakening a policy it never published (logged from 18 October 2026).

Search the register

Filter by body type, policy, or where reports are sent, and sort on any of the underlined columns. A domain is only labelled as having no DMARC after scans on 3 separate days each returned an authoritative negative (1,642 currently meet that bar). Until then it shows as “not yet confirmed” rather than being named. That is why the confirmed list is far shorter than the percentages above: those count every domain measured without a record on the latest scan, which is the right basis for a statistic about the estate, while naming an individual body needs the fuller evidence. Whatever you select goes into this page’s address, so a filtered view can be linked to or cited directly.

The whole register is also published as one file at /data/uk-public-sector-dmarc.csv: every domain and every column above, with no filter applied, and a stable address to cite. The download button in the table gives you whichever view you have selected instead.

Method

The source list is the official register of .gov.uk domain names published on data.gov.uk, snapshot dated 31 March 2026, the day Mail Check was retired. Entries that are DNS plumbing rather than organisational domains (validation labels, record hosts) are excluded.

Each domain’s _dmarc TXT record is read directly from public DNS, the same lookup any receiving mail server performs on every message. No mail is sent, no service is connected to, and nothing non-public is accessed.

A failed or timed-out lookup is recorded as a failed measurement, never as an absent record, and does not count towards the 3-day threshold. That threshold counts days rather than scans on purpose: the register is swept every hour, so counting scans would let a single bad quarter of an hour on one nameserver put a real public body on a published list. A domain leaves the “no DMARC” list on the first scan that finds a record (there is no threshold in that direction), so an organisation that fixes its configuration stops being listed within the hour rather than remaining on a stale page.

Because naming an organisation is the one output that could be unfair, an absent record is checked twice: the routine scan runs over one operator’s resolvers, and any domain that comes back without a record is asked again through an independent resolver over a different protocol. If the two disagree, that reading counts as a failed measurement for that domain rather than as evidence of absence.

What this page does not publish is as deliberate as what it does. Every finding here is derived from the DMARC record, but the record itself is not shown, exported, or served by the API, and neither are the addresses a domain sends its reports to. Those routinely contain a named individual’s work email address, and nothing the tracker exists to say requires them: whether reports go to government, to a commercial platform, or nowhere is the finding, and that is what is published.

If you work for a listed body: a row you think is wrong is worth telling us about, and we would rather hear it than have it stand. Get in touch and we will re-measure and correct it. If the row is right and you want it not to be, the “how to fix” link on it goes to a free checker for that domain: there is nothing to buy and no account needed.

One quirk of the register is worth knowing before quoting the enforcement figure. The .gov.uk zone carries a wildcard, so an entry that has never been delegated to its own nameservers still answers with a p=reject policy pointing at the government reporting address. Receiving mail servers really do see that policy, so those domains are counted as protected, but the body published nothing, and rows in that position are marked registry wildcard rather than credited with a record of their own. On the latest scan that is 34 of 7,912 entries.

Body type is inferred from the domain name. Parish, town and community councils and parish meetings almost all follow a naming convention, and so do NHS bodies and the emergency services. Principal councils mostly use the place name alone (birmingham.gov.uk), so a name cannot tell them from other bodies: they sit in “Other and unclassified” with central government. Treat the split as indicative and use the filters to check any group yourself.

If your domain is listed

Publishing a DMARC record costs nothing and takes one DNS change. Start at p=none with a reporting address so you can see your own mail flows before enforcing anything, then move to quarantine and reject once the reports are clean. Our free DMARC checker shows your current record, and the none-to-reject guide walks through the rollout. You do not need to buy anything from us to do this, and public sector bodies are welcome to cite this page.

If you supply one of the bodies listed rather than run it, the obligation reaching you is a different one. PPN 014 makes a Cyber Essentials certificate a condition of many public sector contracts, but Cyber Essentials does not require DMARC, SPF or DKIM: the email requirements sit in separate NCSC guidance. Our guide to the NCSC and Cyber Essentials email security requirements for UK public sector suppliers sets out which document says what, and quotes each one.

Contains public sector information licensed under the Open Government Licence v3.0. ShieldMarc’s own figures are CC BY 4.0, as set out under the headline. Last scan: 26 October 2026.