Of 1,608 FCA-authorised UK firms whose domains we checked, only 267 — 16.6% — have DMARC configured to actually stop a forged email. The other 83.4% either have no DMARC record at all, or have one that is switched on and doing nothing.
These are brokers, advisers and intermediaries who email clients about their mortgage, their pension, their insurance claim. If somebody sends an email that claims to come from their address, in most cases it will be delivered.
We did not set out to run a study. We check what a firm's domain publishes about itself before we contact them, because there is no point offering to help with something that is already right. After 1,608 firms the pattern was consistent enough to be worth publishing.
What we found
| Firms | Share | |
|---|---|---|
| No DMARC record at all | 700 | 43.5% |
| DMARC present, but monitor-only | 556 | 34.6% |
| Not protected against forgery | 1,341 | 83.4% |
| DMARC enforcing | 267 | 16.6% |
Three other findings from the same set:
| Firms | Share | |
|---|---|---|
| No SPF record | 125 | 7.8% |
| Site not completing a secure connection | 174 | 10.8% |
| No HSTS | 1,000 | 62.2% |
| Clean on every check we ran | 90 | 5.6% |
Fewer than one firm in seventeen passed everything.
The monitor-only trap
The 34.6% with a monitor-only record are the ones we would worry about most, because they are the least likely to know.
DMARC has three settings. p=none watches and reports but lets everything through. p=quarantine sends failures to spam. p=reject refuses them outright. Starting at p=none is correct — you turn it on, watch for a few weeks to be sure your own legitimate email passes, then tighten it.
The problem is that this is a two-step job and the second step is easy to forget. Somebody publishes the record, the reports come in, nobody moves it on. A year later the firm has a DMARC record, would tell you so if asked, and is exactly as exposed as a firm with no record at all.
More than a third of the firms we checked are sitting in that gap.
It is not a small-firm problem
We expected the newest and smallest firms to be worst. They are not. Splitting the same set by how long each firm has been trading:
| Years trading | Firms | Not protected |
|---|---|---|
| Under 5 | 115 | 84.3% |
| 5–9 | 385 | 81.8% |
| 10–19 | 567 | 82.7% |
| 20–29 | 358 | 86.0% |
| 30+ | 174 | 83.3% |
There is no meaningful difference across thirty years of trading. A firm founded in the nineties is as likely to be exposed as one founded last year. That rules out the comfortable explanations — this is not about budget, maturity or how long a firm has had to get round to it. It is about nobody ever being told it was their job.
What DMARC actually does
Email was designed without any way to check that the sender is who they claim to be. Three records patch that:
- SPF lists the servers allowed to send email as your domain.
- DKIM signs your messages so tampering can be detected.
- DMARC is the instruction telling other mail servers what to do when a message fails those checks — and where to send reports about it.
Without DMARC there is no instruction, so the receiving server makes its own decision, and the usual decision is to deliver. That is the whole problem. SPF and DKIM without DMARC are a lock with nothing telling anyone to turn it.
Why it matters more for a regulated firm
Anyone can be impersonated. What makes it worse here is what the email would be about.
A forged email from a broker is credible in a way that a forged email from a retailer is not. It arrives in the middle of a real conversation about a real policy or a real completion date. It can carry new bank details for a transfer, or ask for documents that make the next fraud easier. The client has no way to tell it apart, because as far as their mail server is concerned it is genuine.
Under Consumer Duty a firm has to avoid foreseeable harm to customers. An impersonation route that the firm could close with one DNS record, and has not, is difficult to describe as unforeseeable.
How to fix it
If you have no record, publish this as a TXT record at _dmarc.yourdomain.co.uk:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.uk
That changes nothing about your mail flow. It starts the reports. Read them for two to four weeks and confirm every legitimate sender you use — your mail provider, your CRM, your e-signature tool, your accountant's portal — is passing.
Then tighten in stages:
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourdomain.co.uk
Raise pct to 100 once that is quiet, then move to p=reject. The staged approach matters: going straight to p=reject on a domain with an unknown sender list is how firms accidentally block their own invoices.
If you already have a record sitting at p=none, you have done the hard part. The remaining work is reading the reports and changing one word.
Method, and what we did not do
What we checked. For each firm we resolved the public DNS records for its domain — DMARC, SPF, MX — and made a single ordinary HTTPS request to the homepage to check the certificate and the response headers. That is the same information any mail server or browser sees when it deals with that domain.
Everything here is passive and public. We sent nothing to their mail servers, tested no logins, scanned no ports and probed nothing. There is no sense in which any firm was attacked, and nothing was accessed that is not published by the firm itself.
The sample. 1,608 firms listed as Authorised on the FCA Register — brokers, advisers, intermediaries and adjacent regulated businesses — filtered to those with a working website. It is not a random sample of the whole register, so read it as a large sample of the sector rather than a census.
No firm is named, and none will be. We hold the per-firm results and will not publish them, because a list of which regulated firms can be impersonated is a target list. Aggregate figures only.
We tell firms where we can reach them. We could find a published contact address for 674 of the 1,608. Those firms get told directly, with the exact record to publish, free, whether or not they ever become a customer. For the remaining 934 we have no reliable route in — which is a large part of why this is being published at all.
If you want your own domain checked
We will run the same checks on your domain and send you the result in plain English, with the exact record to publish. It is free, there is nothing to buy, and it takes about ten minutes of your IT person's time to act on.
Ask us to check your domain — or if you would rather do it yourself, everything needed is in this article.
Figures correct as at 1 September 2026. If you are a journalist and want the methodology in more detail, or the breakdown cut a different way, get in touch — we will share aggregate data but never the per-firm results.