How many UK agencies have DMARC switched on?

Anyone can send an email that looks like it came from your agency: your name, your signature, your domain in the “from” line. One free setting, called DMARC, tells email providers to bin those fakes. In October 2026 we checked whether UK agencies, PR firms and architecture practices have it switched on. More than half do not.

What did we find?

Of 896 UK agencies, PR firms and architecture practices we checked on 7 October 2026, 54.1% had nothing stopping someone sending email as them. Only 18.3% were fully protected.

Group	What it means	Firms	Share
No working record	No DMARC record, or a broken one. Email providers get no instruction from you, so fakes are judged on other signals and often delivered.	164	18.3%
Monitor only (p=none)	Providers are asked to report failures, not act on them. Fakes are still delivered.	321	35.8%
Partly protected	Mostly p=quarantine: fakes go to the spam folder rather than being blocked.	247	27.6%
Fully protected (p=reject)	Providers are told to refuse email that fails the check.	164	18.3%

“Nothing stopping” means the first two groups. In both, a convincing fake can reach an inbox.

Which sectors are most exposed?

Architecture practices came out weakest. Nearly a third (31.3%) had no DMARC record at all, and only 13.6% were fully protected.

Sector	Firms checked	Nothing stopping fakes	No record	Fully protected
Architecture practices	214	61.7%	31.3%	13.6%
PR and communications	137	53.3%	13.9%	17.5%
Creative and marketing agencies	545	51.4%	14.3%	20.4%

The gaps look different. Agencies and PR firms usually have a record, but 37% to 39% leave it on monitor only. Practices are more likely never to have set one up.

Does company size make a difference?

Yes. Firms with fewer than 50 staff were three times as likely to have no record as firms with 250 or more (21.0% against 7.0%). They were also less than half as likely to be fully protected.

Staff	Firms	No record	Fully protected
Under 50	544	21.0%	16.2%
50 to 249	285	13.7%	18.9%
250 or more	57	7.0%	36.8%

The 250+ group is small, so treat its figures as a direction rather than a precise rate. Ten firms had no staff count and are left out of this table.

Does it matter whether you use Microsoft 365 or Google Workspace?

Firms on Google Workspace were more likely to be stuck on monitor only: 45.8%, against 32.5% on Microsoft 365. Full protection was similar (14.4% and 17.8%). We can see the pattern in the data, but not the cause, so we’re not going to guess at one.

Why is monitor-only so common?

Monitor-only is the largest single group, at 35.8%. It is meant to be step one: you watch the reports, find every system that sends email as you, then tighten the policy.

Two things in the data suggest many firms never take step two:

• More than half of the monitor-only firms (172 of 321) have no reporting address. Nobody receives the reports, so nothing is being monitored.
• p=none is the minimum that Google, Yahoo and Microsoft ask of bulk senders. A firm that set it up to keep newsletters out of spam has met that bar, and may reasonably believe the job is done.

The job is done for deliverability. It isn’t done for spoofing.

What this means for your agency

Ask whoever looks after your IT three questions:

1. Do we have a DMARC record?
2. Is it set to quarantine or reject, or only to monitor?
3. Who reads the reports?

If the answers are “yes”, “reject” and a named person, you’re ahead of more than four in five of the firms we checked. If not, the fix is free and is done in stages. The first stage is listing every system that sends email as you, such as Microsoft 365, your CRM, your newsletter tool and your accounts software.

The checker at the top of this page runs the same lookups we used for this research. Enter your domain and you’ll see where it stands.

How we did the research

We looked up public DNS records for each firm’s domain on 7 October 2026, using Google and Cloudflare’s public DNS servers. For every domain we read the DMARC record, the SPF record and the mail servers.

• Who: 896 UK firms recorded as creative or marketing agencies, PR and communications firms, or architecture practices. They come from Cubit’s marketing database, so they are not a random sample of every UK firm.
• Fully protected: p=reject applied to all mail. A reject policy applied to only part of the mail counts as partly protected.
• Excluded: domains that no longer exist and domains whose DNS failed to answer after repeated retries.
• Subdomains: if a domain had no record of its own, we checked its parent domain, as receiving mail servers do.
• One note on standards: the DMARC standard was updated in May 2026 (RFC 9989). One firm in the sample uses the new testing flag. Moving it from fully to partly protected changes no figure by more than 0.1 percentage points.

We report totals only. No firm is named.

Frequently asked questions

What is DMARC? DMARC is a free setting on your domain that tells email providers what to do with messages that claim to be from you but fail authentication. Our DMARC explainer covers how it works with SPF and DKIM.

Is p=none enough? No. p=none asks providers to report failures, not to act on them. A fake email sent in your name is still delivered.

Is quarantine good enough? It is a sound step. Fakes go to spam rather than the inbox, but they are still delivered somewhere. p=reject blocks them.

Will switching on DMARC block our real email? It can if you skip the monitoring stage. Any system that sends email as you, but isn’t set up to pass the checks, will fail once the policy is tightened. That is why it is done in stages.

Sources

• • Cubit Technology DNS check of 896 UK firms, 7 October 2026 (method above)
  • Google: Email sender guidelines
  • Microsoft: Outlook’s new requirements for high-volume senders
  • RFC 9989: the current DMARC standard