Research

UK Public Sector DMARC Tracker

Every domain in the official .gov.uk register, re-measured every hour. NCSC retired Mail Check on 31 March 2026 and named no replacement, so this is what the public sector’s email authentication actually looks like now, not what it was told to do. If your organisation is on this register and still needs a Mail Check replacement, start with the migration route from Mail Check or our DMARC services for UK organisations.

As of 2026-09-11, of the 7,912 .gov.uk domains in the official register, 7,908 were measured on the latest scan: 21.6% publish no DMARC record, 53.2% are at enforcement (p=quarantine or p=reject), and 41.7% of those that do publish DMARC send aggregate reports nowhere.

Continuously updated. Last measurement 2026-09-11 01:00 UTC; 7,912 of 7,912 domains re-measured in the last hour.

Domains tracked

7,912

scanned 2026-09-11

No DMARC at all

21.6%

−1.2 pts since baseline

Enforcing a policy

53.2%

+1.4 pts since baseline

Reports go nowhere

41.7%

+0.5 pts since baseline

Baseline is the first full scan, 2026-07-27. Mail Check closed on 31 March 2026 without publishing a final position, so there is no honest way to state where the estate stood on the day it retired; this tracker can only report from when it started measuring.

What the numbers say

Two findings stand out. First, NCSC told public bodies to move to a commercial DMARC product before Mail Check closed; on the latest scan 8.3% of domains publishing DMARC route their reports to one. Second, and more serious, 41.7% send aggregate reports nowhere at all. They publish a policy but collect no data, so nobody there can see whether the domain is being spoofed, or whether the organisation’s own legitimate mail is failing authentication.

A further 31.5% still point at the government reporting address. That address continues to accept mail, so those reports are still being delivered. Whether anyone analyses them now that Mail Check has closed is not something a DNS lookup can answer, and this tracker does not claim to know.

Read the split before quoting a headline

About seven in ten entries in the .gov.uk register are parish, town and community councils. Many of them have a single part-time clerk and no IT function at all. A single estate-wide percentage is therefore mostly a statement about parish councils, which is why the figures are split by body type below rather than averaged into one number.

How it is moving

Both lines are a share of the domains actually measured that day, so a night when DNS answers badly shrinks the denominator rather than inventing a drop. Days where nothing could be measured are left out instead of being drawn as zero.

Where the estate went instead

NCSC told public bodies to move to a commercial DMARC product. These are the platforms the register actually moved to, counted from the reporting address each domain publishes. A body using a platform that sends reports to its own domain rather than the vendor’s will not appear here, so treat these as a floor.

Protected at the top, open underneath

357 domains publish an enforcing policy on the domain itself and sp=none beneath it. Those two tags together mean mail claiming to come from the organisation’s main address is checked, while mail from any subdomain of it is not, and a subdomain is exactly what someone spoofing a council would invent. It reads as protection in any summary that counts policies, which is why this page counts it separately. See those domains.

What has changed since the baseline

Every domain observed moving from one published policy to another since this tracker started measuring. The register is swept every hour, so a change is usually visible here the same day it is made. A first reading is not a change, so nothing appears on the strength of the tracker simply starting to measure.

Search the register

Filter by body type, policy, or where reports are sent, and sort on any of the underlined columns. A domain is only labelled as having no DMARC after scans on 3 separate days each returned an authoritative negative (1,706 currently meet that bar). Until then it shows as “not yet confirmed” rather than being named. That is why the confirmed list is far shorter than the percentages above: those count every domain measured without a record on the latest scan, which is the right basis for a statistic about the estate, while naming an individual body needs the fuller evidence. Whatever you select goes into this page’s address, so a filtered view can be linked to or cited directly.

The whole register is also published as one file at /data/uk-public-sector-dmarc.csv — every domain and every column above, with no filter applied, and a stable address to cite. The download button in the table gives you whichever view you have selected instead.

Method

The source list is the official register of .gov.uk domain names published on data.gov.uk, snapshot dated 31 March 2026, the day Mail Check was retired. Entries that are DNS plumbing rather than organisational domains (validation labels, record hosts) are excluded.

Each domain’s _dmarc TXT record is read directly from public DNS, the same lookup any receiving mail server performs on every message. No mail is sent, no service is connected to, and nothing non-public is accessed.

A failed or timed-out lookup is recorded as a failed measurement, never as an absent record, and does not count towards the 3-day threshold. That threshold counts days rather than scans on purpose: the register is swept every hour, so counting scans would let a single bad quarter of an hour on one nameserver put a real public body on a published list. A domain leaves the “no DMARC” list on the first scan that finds a record — there is no threshold in that direction — so an organisation that fixes its configuration stops being listed within the hour rather than remaining on a stale page.

Because naming an organisation is the one output that could be unfair, an absent record is checked twice: the routine scan runs over one operator’s resolvers, and any domain that comes back without a record is asked again through an independent resolver over a different protocol. If the two disagree, that reading counts as a failed measurement for that domain rather than as evidence of absence.

What this page does not publish is as deliberate as what it does. Every finding here is derived from the DMARC record, but the record itself is not shown, exported, or served by the API, and neither are the addresses a domain sends its reports to. Those routinely contain a named individual’s work email address, and nothing the tracker exists to say requires them: whether reports go to government, to a commercial platform, or nowhere is the finding, and that is what is published.

If you work for a listed body: a row you think is wrong is worth telling us about, and we would rather hear it than have it stand. Get in touch and we will re-measure and correct it. If the row is right and you want it not to be, the “how to fix” link on it goes to a free checker for that domain — there is nothing to buy and no account needed.

One quirk of the register is worth knowing before quoting the enforcement figure. The .gov.uk zone carries a wildcard, so an entry that has never been delegated to its own nameservers still answers with a p=reject policy pointing at the government reporting address. Receiving mail servers really do see that policy, so those domains are counted as protected, but the body published nothing, and rows in that position are marked registry wildcard rather than credited with a record of their own. On the latest scan that is 14 of 7,912 entries.

Body type is inferred from naming convention, which is imperfect: some councils do not follow one. Treat the split as indicative and use the filters to check any group yourself.

If your domain is listed

Publishing a DMARC record costs nothing and takes one DNS change. Start at p=none with a reporting address so you can see your own mail flows before enforcing anything, then move to quarantine and reject once the reports are clean. Our free DMARC checker shows your current record, and the none-to-reject guide walks through the rollout. You do not need to buy anything from us to do this, and public sector bodies are welcome to cite this page.

If you supply one of the bodies listed rather than run it, the obligation reaching you is a different one. PPN 014 makes a Cyber Essentials certificate a condition of many public sector contracts, but Cyber Essentials does not require DMARC, SPF or DKIM — the email requirements sit in separate NCSC guidance. Our guide to the NCSC and Cyber Essentials email security requirements for UK public sector suppliers sets out which document says what, and quotes each one.

Contains public sector information licensed under the Open Government Licence v3.0. Figures on this page are free to reuse with attribution. Last scan: 2026-09-11.