United Kingdom
432 domains · composite score 74.4 · surveyed 3 August 2026
United Kingdom places among the strongest in Europe, with a composite score of 74.4 against a European average of 65.0.
67.7% of United Kingdom domains enforce DMARC — meaning they instruct receiving servers to quarantine or reject mail that fails authentication. 85.3% publish a DMARC record at all, so the gap between the two is the share that are collecting reports without acting on them.
13.3% still accept TLS 1.0, a protocol deprecated in 2018 and prohibited for systems handling cardholder data under PCI DSS.
Against the European average
| Measure | United Kingdom | EU avg | Diff |
|---|---|---|---|
| SPF present | 88.6% | 90.1% | -1.5 |
| DKIM detected | 66.4% | 58.6% | +7.8 |
| DMARC present | 85.3% | 75.2% | +10.1 |
| DMARC enforcing | 67.7% | 43.9% | +23.8 |
| MTA-STS | 14.6% | 2.7% | +11.9 |
| Valid TLS certificate | 83.8% | 88.5% | -4.7 |
| TLS 1.0 enabled | 13.3% | 24.5% | -11.2 |
| TLS 1.3 supported | 80.9% | 84.6% | -3.7 |
| CAA records | 15.5% | 15.5% | 0 |
| HSTS | 52.3% | 45.1% | +7.2 |
| All five headers | 14.8% | 10.3% | +4.5 |
Green indicates better than the European average. For TLS 1.0, lower is better.
DMARC policy breakdown
Of the United Kingdom domains publishing a DMARC record, 46.3% use p=reject, 33% use p=quarantine, and 20.7% use p=none.
A p=none policy provides no protection against spoofing. It is intended as a short monitoring phase while an organisation identifies its legitimate senders, before moving to enforcement.
Nearby in the ranking
Method
Based on 432 United Kingdom domains sourced from the Tranco top-1M and attributed by ccTLD. Organisations using generic TLDs such as .com are not captured, so this measures domains registered under the national suffix rather than all organisations in the country.
Full method, limitations and raw data are on the survey page.