DMARC reporting · UK companies
What share of UK companies have dmarc-reporting?
54.58% of UK companies (95% CI 51.85–57.28%), measured across 1,288 companies on 2026-10-01.
Measured every Monday since 2026-08-01 — 3 observations to date. Last measured 2026-10-01.
How this is measured
Tier 0. Read the rua= tag from the _dmarc TXT record already fetched for dmarc-policy. Where a destination mailbox sits on another domain, RFC 9990 requires that domain to publish <policy-domain>._report._dmarc.<destination> (or a * wildcard at the same name) before a conforming receiver will send anything. Denominator: domains that have a DMARC record — a domain with no policy has nothing to report on and is excluded rather than counted as receiving nothing.
Passive measurement: a single DNS lookup, TLS handshake, or homepage GET per domain. Aggregate-only; no individual company is named. 95% Wilson confidence intervals. Population: national company registries (Companies House, Brreg, SIRENE), sampled by size band and resolved to email-active domains. Parked domains excluded. Snapshot: uk-companies-house-per600-seed20260728.
Licensed CC BY 4.0 — reuse with attribution to Quiet Failures. Download: JSON · CSV.
Check a specific domain against this control with the free Email authentication audit.
Why it matters
The reporting half of the p=none story, and the same shape: the record is valid, the checker is green, a reporting address is configured, and not one report has ever arrived. Without the feedback loop nobody ever learns which mail is failing, so the rollout from none to reject — the thing the policy exists to reach — never starts. unauthorised is the quieter of the two: the owner did everything visible correctly and the consent record is on a domain they may not control.
Limits of this measurement
Aggregate (rua) only; ruf uses the same consent mechanism but is rarely honoured and is not counted. Reporting is orthogonal to policy strength — a domain can enforce reject and still be blind, or sit at p=none and receive reports perfectly — so this is not a second reading of dmarc-policy. A destination that authorises the domain but silently drops the mail is indistinguishable from one that delivers it; consent is observable from outside, delivery is not.
The same check, other segments
- Germany (domains)93.58%
- Austria (domains)88.55%
- Italy (domains)85.87%
- Estonia (domains)84.78%
- Slovenia (domains)83.54%
- Hungary (domains)82.91%
- Japan (domains)82.52%
- Switzerland (domains)82.42%
Show the remaining 39 segments
- Croatia (domains)82.39%
- Greece (domains)82.35%
- Spain (domains)81.1%
- Poland (domains)80.99%
- the EU (domains)80.83%
- the Netherlands (domains)78.29%
- Argentina (domains)78.06%
- Brazil (domains)77.6%
- Turkey (domains)77.24%
- Belgium (domains)75.61%
- Romania (domains)74.6%
- France (domains)74.14%
- Lithuania (domains)74%
- Mexico (domains)71.93%
- Portugal (domains)71.9%
- global domains71.89%
- Malaysia (domains)70.64%
- Iceland (domains)68.57%
- Slovakia (domains)68%
- France small companies67.54%
- Norway small companies66.67%
- Bulgaria (domains)66.37%
- Singapore (domains)66.06%
- the UAE (domains)64.96%
- Luxembourg (domains)64.52%
- Chile (domains)64.17%
- Peru (domains)63.06%
- Saudi Arabia (domains)62.68%
- South Africa (domains)60.91%
- Norway micro companies60.13%
- UK small companies59.5%
- Australia (domains)58.68%
- New Zealand (domains)58.41%
- France companies58.12%
- Norway (domains)53.74%
- Norway companies53.28%
- Norway medium companies47.31%
- UK medium & large companies46.54%
- Norway large companies39.57%