Research · October 2026
3 in 4 UK small businesses can be impersonated by email
We checked the public email security records of 256 UK small businesses — accountants, solicitors, estate agents, dentists and builders in six cities. Three in four gave receiving mail servers no instruction to reject email forged in their name.
Key findings
What we found
By sector
Dentists were least protected, solicitors most — but no sector was close to safe
Share of each sector’s domains by DMARC status. Sector samples are small, so treat differences as indicative.
| Sector | Domains | No DMARC | Monitor only | Enforced |
|---|---|---|---|---|
| Solicitors | 64 | 39% | 27% | 34% |
| Estate agents | 67 | 28% | 43% | 28% |
| Accountants | 57 | 42% | 37% | 21% |
| Builders | 21 | 57% | 24% | 19% |
| Dentists | 47 | 60% | 28% | 13% |
By city
Only 16% of the Birmingham firms we checked enforce DMARC
City samples mix different sectors (see method), so compare with care.
| City | Domains | No DMARC | Enforced |
|---|---|---|---|
| London | 56 | 41% | 34% |
| Glasgow | 32 | 31% | 31% |
| Bristol | 35 | 26% | 26% |
| Leeds | 29 | 48% | 24% |
| Manchester | 48 | 52% | 19% |
| Birmingham | 56 | 48% | 16% |
Why it matters
DMARC is the DNS record that tells the rest of the internet what to do with email that claims to come from your domain but fails authentication. Without it — or with it set to monitor only — a criminal can send email that appears to come from your own address: to your clients, asking them to pay a “new” bank account, or to your own staff, apparently from a director. That is the route behind most invoice, deposit and payment-diversion fraud.
The fix is free and mostly a matter of DNS. It is not instant: every service that sends email as you has to be set up properly first, which is why DMARC starts in monitoring mode. But monitoring is meant to be a step, and a third of the businesses we checked had stopped there.
Other findings
- 6% had no SPF record, and 1% had two SPF records, which breaks SPF entirely.
- Microsoft 365 handled email for 46% of the businesses, Google Workspace for 9%, and dedicated email-security gateways such as Mimecast and Proofpoint for about 11%.
- Businesses behind a dedicated email-security gateway enforced DMARC roughly twice as often (around half) as those using Microsoft 365 on its own (26%).
Check your own business
Our free email security checker shows your SPF, DKIM, DMARC and mail server records in a few seconds, in plain English. Nothing is stored. If DMARC is missing, the DMARC record generator builds a safe starting record, and our guide to SPF, DKIM and DMARC explains how to move from monitoring to enforcement.
Method
- Sample. Google Business listings for five sectors in six cities: accountants (Birmingham, Manchester), solicitors (London, Leeds), estate and letting agents (Glasgow, Bristol), dentists (Birmingham, Manchester) and builders (London). Up to 50 listings per search; 450 listings in total, 310 with a website.
- Cleaning. Social media and platform pages were removed, each website was reduced to its domain, and each domain was counted once, so chains with several branches count once. That left 280 domains, of which 5 no longer existed and 256 receive email (they have MX records). The figures on this page are for those 256.
- Checks. On 6 October 2026 we read each domain’s public DNS records: MX (to identify the email provider), SPF, and DMARC (policy, percentage and reporting address). “Enforced” means a single DMARC record with a policy of quarantine or reject applied to all mail.
Limits
- This is not a random sample of UK businesses: it covers firms with a Google listing and a website, in five sectors and six cities.
- The overall figures have a margin of error of roughly ±5 percentage points at 95% confidence. Sector and city figures rest on 21 to 67 domains each and are indicative, not rankings. The builders sample (21) is too small to quote on its own, and each city covers only one or two sectors.
- DMARC is not the only defence; some providers filter forged mail on other signals. We report whether a business has told receivers to reject forgeries, not whether a particular forgery would be delivered.
- We did not check DKIM (its records cannot be listed from DNS) or the SPF ten-lookup limit.
We publish aggregate figures only and will not name any business. Questions about the method: contact us.
Questions
About this research
What does “can be impersonated” mean here?
The domain either publishes no DMARC record, or publishes one set to p=none, which only monitors. Either way, nothing tells receiving mail servers to reject or quarantine email that fails authentication for that domain. Some providers may still filter forged mail on other signals, so it does not mean every forgery will arrive — only that the business has not told the world to block it.
Which businesses did you check, and will you name them?
Businesses with a Google Business listing and a website, in five sectors across six UK cities. We will not name any of them: the study is about how common the gap is, not about individual firms. If you want to know about your own domain, run it through our free email security checker.
Can I use these figures?
Yes. Please credit MyExchangeServer and link to this page, and quote the limits alongside sector or city figures — those samples are small.
How do I fix it for my own business?
Make sure every service that sends email as you passes SPF or DKIM, publish a DMARC record with a reporting address, read the reports for a few weeks, then move the policy to quarantine and finally reject. Our guide to SPF, DKIM and DMARC walks through it, and the DMARC record generator builds the record.
Want it fixed rather than explained?
Every MyExchangeServer mailbox comes with SPF, DKIM and DMARC set up and monitored. Or send us your checker results and an engineer will tell you what to fix first.
- Free assisted migration
- No set-up fee, no minimum term
- UK data centres, UK engineers