DMARC sector aggregates: 338-domain UK and EU sample
October 2026 snapshot, as of 31 October 2026. Next refresh due on or after 28 November 2026.
Totals by DMARC policy and by where reports are sent, for each sector group with at least 10 domains in the fixed sample. Each group is tagged by region and sector. No domain is named.
| Group | n | p=reject | p=none | No valid record | External report address | US-headquartered report address |
|---|---|---|---|---|---|---|
| All answered domains of the 338 Region: UK and EUSector: All | 336 | 61.9% | 14.9% | 3.6% | 77.1% | 32.4% |
| Listed companies and retail Region: UKSector: Listed and retail | 90 | 56.7% | 21.1% | 5.6% | 76.7% | 34.4% |
| Accountancy, fintech, insurance and wealth Region: UKSector: Finance | 49 | 81.6% | 6.1% | 0.0% | 85.7% | 32.7% |
| Managed IT, hosting and security suppliers Region: UKSector: IT suppliers | 48 | 37.5% | 25.0% | 6.2% | 68.8% | 33.3% |
| Housing, utilities, transport and infrastructure Region: UKSector: Infrastructure | 34 | 67.6% | 11.8% | 0.0% | 88.2% | 50.0% |
| Law firms Region: UKSector: Legal | 28 | 75.0% | 14.3% | 7.1% | 82.1% | 7.1% |
| Germany (mixed sectors) Region: EUSector: Germany | 29 | 62.1% | 13.8% | 3.4% | 72.4% | 13.8% |
| Nordics, Ireland and eastern Europe (mixed sectors) Region: EUSector: Nordics, Ireland, east | 24 | 66.7% | 8.3% | 4.2% | 70.8% | 50.0% |
| France (mixed sectors) Region: EUSector: France | 19 | 52.6% | 10.5% | 0.0% | 73.7% | 36.8% |
| Benelux, Switzerland, Austria, Italy and Spain (mixed sectors) Region: EUSector: Benelux, Alpine, south | 14 | 71.4% | 0.0% | 0.0% | 71.4% | 28.6% |
Small groups move quickly: in a group of 14, one domain is about 7 percentage points. 3 domains carry no sector label and count in the overall row but in no sector group.
What changed since last month
The October 2026 snapshot is the baseline for the monthly refresh. The next refresh of the same 338 domains is due on or after 28 November 2026; changes will then be shown here as counts, with no domain named.
Sample, date and method
Sample. A fixed, pre-declared list of 338 organisation domains (249 UK, 86 EU, 3 without a sector label), defined by the domain list of the FaultyPacket 338-domain DMARC study file published on 28 October 2026. The list is frozen: no domain is added, removed or swapped, and the run stops if the list changes. Sector and region tags come from the label each domain carries in the FaultyPacket 1,611-domain study file of 29 October 2026; the 3 domains without a label count in the overall figures and in no sector.
Date. Queries ran from 2026-10-31T08:03:47Z to 2026-10-31T08:10:41Z (UTC). 336 of 338 domains returned an answer.
Method. For every domain in the fixed list, the TXT record at _dmarc.<domain> was requested from two public DNS-over-HTTPS resolvers (1.1.1.1 via cloudflare-dns.com and 8.8.8.8 via dns.google) at no more than two queries per second. Where both answered with different text, the query was repeated once; where both answered, the 1.1.1.1 answer is the one counted. Policy is the p= tag of a single valid v=DMARC1 record; no record, more than one record, or an unrecognised p= value counts as no valid DMARC record. Report addresses are the mailto: hosts in rua= and ruf=. External means a host outside the domain and its subdomains. Collector headquarters come from the FaultyPacket provider list (version T0-T5-v2.2-2026-10-28+sha9d5155ea38); a host not on the list, or a company listed with more than one headquarters region, counts as headquarters not classified. No other records, web pages, contact details or personal data were collected.
Disclaimer. Observed routing, not a legal finding. A DMARC record shows where a domain asks for reports to be sent. It does not show contracts, transfer safeguards, where reports are stored, or whether any law applies to any organisation.
Data file: aggregate JSON · CSV · open API. Licence: CC BY 4.0. No domain names are published in these files.
Press and data kit · Observatory notes
Domain-level detail, corrections and right of reply
Journalists and researchers can request domain-level detail with the methodology note; requests are reviewed individually. Email [email protected] with your name, publication or institution and the question you are researching.
We do not send domain-level data automatically. Each request is logged and reviewed by a person before anything is shared.
Corrections and right of reply: if you think a figure here is wrong, or an organisation in the sample wants to reply, email [email protected]. We check the claim against the public DNS record and correct the page where needed.