MTA-STS · UK medium & large companies

What share of UK medium & large companies have no enforcing MTA-STS policy (absent or testing mode)?

98.59%

98.59% of UK medium & large companies (95% CI 97.68–99.14%), measured across 1,061 companies on 2026-10-01.

enforce: 1.41%testing (not enforced): 0.75%no record: 97.83%
enforce · 1.41%testing (not enforced) · 0.75%no record · 97.83%
Trend

Measured every Monday since 2026-08-01 — 13 observations to date. Last measured 2026-10-01.

How this is measured

Tier 0 + 3a. TXT at _mta-sts.<domain>; if present, fetch https://mta- sts.<domain>/.well-known/mta-sts.txt and read mode. Denominator: has_mx.

Passive measurement: a single DNS lookup, TLS handshake, or homepage GET per domain. Aggregate-only; no individual company is named. 95% Wilson confidence intervals. Population: national company registries (Companies House, Brreg, SIRENE), sampled by size band and resolved to email-active domains. Parked domains excluded. Snapshot: uk-companies-house-per600-seed20260728.

Licensed CC BY 4.0 — reuse with attribution to Quiet Failures. Download: JSON · CSV.

Check a specific domain against this control with the free Email authentication audit.

Why it matters

The declared-vs-enforcing split is exactly the brand thesis. mode: testing publishes a policy, produces reports, and does not require TLS — downgrade attacks still work. The DNS record alone looks like adoption; only the fetched policy reveals whether it bites.

The same check, other segments

Show the remaining 65 segments

Share or cite this figure

Reuse is free under CC BY 4.0 — attribution to Quiet Failures is all we ask.

Post on X

Embed this stat

Free to reuse under CC BY 4.0 — the card links back and updates as the data does.

<iframe src="https://quietfailures.com/embed/mta-sts/gb-medium-large" width="380" height="210" style="border:0;max-width:100%" loading="lazy" title="What share of UK medium & large companies have no enforcing MTA-STS policy (absent or testing mode)?"></iframe>