Observatory notes
October 2026 snapshot, as of 31 October 2026. Next refresh due on or after 28 November 2026.
Short notes that set the 338-domain sample's aggregate figures next to a current regulatory step, such as NIS2 transposition or the UK Cyber Security and Resilience Bill. Each note cites official sources and is re-checked twice a day; a note whose source can no longer be confirmed is taken out of search.
- UK Cyber Security and Resilience Bill reaches Lords third reading: what the UK part of the sample shows (31 October 2026)
- NIS2 transposition: Commission court referrals and what the EU part of the sample shows (31 October 2026)
Press and data kit · Sector aggregates
Domain-level detail, corrections and right of reply
Journalists and researchers can request domain-level detail with the methodology note; requests are reviewed individually. Email [email protected] with your name, publication or institution and the question you are researching.
We do not send domain-level data automatically. Each request is logged and reviewed by a person before anything is shared.
Corrections and right of reply: if you think a figure here is wrong, or an organisation in the sample wants to reply, email [email protected]. We check the claim against the public DNS record and correct the page where needed.
Correction, 31 October 2026. The 28 October 2026 study file (uk-eu-338-domain-dmarc-audit-2026.json) set its US-headquartered flag and collector tiers with an older vendor rule. Its headline is now restated from this October 2026 snapshot: 259 of the 336 domains that answered (77%) send DMARC reports to an outside address, 109 of the 336 (32%) to a US-headquartered organisation, and a further 104 to outside addresses whose headquarters are not classified. A recheck later the same day counted the same 109; these figures come from the snapshot, not the recheck. The file's per-domain flags still follow the older rule and should not be summed.