DMARC aggregates: Law firms (UK)
Region: UKSector: Legal
October 2026 snapshot, as of 31 October 2026. Next refresh due on or after 28 November 2026.
How the 28 answered domains in this group of the fixed 338-domain sample set their DMARC policy and where they ask for reports to be sent. Counts and shares; no domain is named.
DMARC policy
| Policy | Domains | Share of 28 |
|---|---|---|
| p=reject | 21 | 75.0% |
| p=quarantine | 1 | 3.6% |
| p=none | 4 | 14.3% |
| No valid DMARC record | 2 | 7.1% |
Where DMARC reports are sent
| Report routing | Domains | Share of 28 |
|---|---|---|
| External address, US-headquartered organisation | 2 | 7.1% |
| External address, UK- or EU-headquartered organisation | 7 | 25.0% |
| External address, headquarters not classified | 14 | 50.0% |
| Reports to the domain's own addresses | 3 | 10.7% |
| DMARC record with no report address | 0 | 0.0% |
| No valid DMARC record | 2 | 7.1% |
External report address while the policy was p=none: 4 (14.3%).
In a group of 28, one domain is 3.6 percentage points.
What changed since last month
The October 2026 snapshot is the baseline for the monthly refresh. The next refresh of the same 338 domains is due on or after 28 November 2026; changes will then be shown here as counts, with no domain named.
Compare with all sector groups or the press and data kit.
Sample, date and method
Sample. A fixed, pre-declared list of 338 organisation domains (249 UK, 86 EU, 3 without a sector label), defined by the domain list of the FaultyPacket 338-domain DMARC study file published on 28 October 2026. The list is frozen: no domain is added, removed or swapped, and the run stops if the list changes. Sector and region tags come from the label each domain carries in the FaultyPacket 1,611-domain study file of 29 October 2026; the 3 domains without a label count in the overall figures and in no sector.
Date. Queries ran from 2026-10-31T08:03:47Z to 2026-10-31T08:10:41Z (UTC). 336 of 338 domains returned an answer.
Method. For every domain in the fixed list, the TXT record at _dmarc.<domain> was requested from two public DNS-over-HTTPS resolvers (1.1.1.1 via cloudflare-dns.com and 8.8.8.8 via dns.google) at no more than two queries per second. Where both answered with different text, the query was repeated once; where both answered, the 1.1.1.1 answer is the one counted. Policy is the p= tag of a single valid v=DMARC1 record; no record, more than one record, or an unrecognised p= value counts as no valid DMARC record. Report addresses are the mailto: hosts in rua= and ruf=. External means a host outside the domain and its subdomains. Collector headquarters come from the FaultyPacket provider list (version T0-T5-v2.2-2026-10-28+sha9d5155ea38); a host not on the list, or a company listed with more than one headquarters region, counts as headquarters not classified. No other records, web pages, contact details or personal data were collected.
Disclaimer. Observed routing, not a legal finding. A DMARC record shows where a domain asks for reports to be sent. It does not show contracts, transfer safeguards, where reports are stored, or whether any law applies to any organisation.
Data file: aggregate JSON · CSV · open API. Licence: CC BY 4.0. No domain names are published in these files.
Domain-level detail, corrections and right of reply
Journalists and researchers can request domain-level detail with the methodology note; requests are reviewed individually. Email [email protected] with your name, publication or institution and the question you are researching.
We do not send domain-level data automatically. Each request is logged and reviewed by a person before anything is shared.
Corrections and right of reply: if you think a figure here is wrong, or an organisation in the sample wants to reply, email [email protected]. We check the claim against the public DNS record and correct the page where needed.