Country

United Kingdom

22,591 domains tracked. 18.8% at DMARC enforcement (p=reject or p=quarantine), backed by 4,249 enforced domains.

Domains tracked
22K+
22,591
DMARC enforcement
18.8%
p=reject + p=quarantine
Avg posture score
24.6
of 100
A-grade domains
328
9 A+ · 319 A

Authentication posture

per protocol

DMARC

policy enforcement: 18.8%
reject
10.1%
quarantine
8.7%
none
16.2%
missing
65.0%

SPF

pass rate: 42.7%
0
pass
42.7%
warn
0.6%
fail
56.7%
not found
0.0%

DKIM

pass rate: 31.0%
00
pass
31.0%
warn
0.0%
fail
68.9%
not found
0.0%

MTA-STS

pass rate: 1.9%
0
pass
1.9%
warn
0.5%
fail
97.6%
not found
0.0%

TLS-RPT

pass rate: 3.1%
0
pass
3.1%
warn
0.1%
fail
96.7%
not found
0.0%

BIMI

pass rate: 0.6%
0
pass
0.6%
warn
0.1%
fail
99.3%
not found
0.0%

Top performers

20 of 22,591 tracked
#DomainScoreGrade
1leedsbuildingsociety.co.uk98A+
2os.uk97A+
3htb.co.uk96A+
4aber.ac.uk95A+
5citysprint.co.uk95A+
6dreams.co.uk95A+
7iwoca.co.uk95A+
8simplybusiness.co.uk95A+
9teachfirst.org.uk95A+
10parkinsons.org.uk94A
11bathnes.gov.uk93A
12bathspa.ac.uk93A
13blue10.com93A
14cumbria.gov.uk93A
15dudley.gov.uk93A
16greatermanchester-ca.gov.uk93A
17healthspan.co.uk93A
18kent.gov.uk93A
19nexus.org.uk93A
20northyorks.gov.uk93A

How this is measured

Each tracked domain is scanned for SPF, DKIM, DMARC, MTA-STS, TLS-RPT, and BIMI. Result statuses (pass / fail / warn / not-found) and DMARC policy values are aggregated into this page nightly. The top performers list is capped at 20. The full corpus is much larger and is not enumerated publicly.

Data provenance

  • Scanner — Authex Labs public scanner (DNS, RFC-compliant)
  • Refreshed — daily at 04:05 UTC
  • Last seen 8 May 2026