Original research, published 15 October 2026
Sussex Business Email Security Report 2026
We checked the public email security records of 1,924 businesses and charities across East and West Sussex. Almost three in four do not enforce DMARC, the setting that stops criminals sending email that pretends to come from them.
By the ATS Connection team, offices in Arundel and Chichester. How we did it
Headline finding
71.9%
of 1,924 Sussex businesses and charities do not enforce DMARC on their email domain
- No valid DMARC record28.3%
- Monitor only (p=none)43.7%
- Quarantine16.9%
- Reject11.1%
Source: ATS Connection analysis of public DNS records, 15 October 2026.
1,924
Sussex businesses and charities checked
71.9%
do not enforce DMARC
28.3%
have no valid DMARC record at all
11.1%
use the strongest setting, p=reject
Key findings
Most Sussex businesses leave their email domain open to spoofing.
DMARC is a free DNS record. Set to quarantine or reject, it tells Microsoft, Google and every other mail provider to stop email that claims to be from your domain but was not sent by you. Most Sussex organisations we checked have not switched it on.
71.9%
Almost three in four do not enforce DMARC
1,384 of 1,924 Sussex organisations either have no DMARC record or only monitor (p=none), so nothing tells other mail servers to block email that fakes their address.
11.1%
Only one in nine uses the strongest setting
Just 214 organisations have DMARC set to reject, the setting the National Cyber Security Centre recommends.
83.3%
The smallest businesses are the most exposed
Among businesses with 1 to 10 staff, 693 of 832 do not enforce DMARC. Among those with more than 200 staff it is 12 of 43.
62% to 78%
No Sussex town does well
In every town with at least 40 organisations in our sample, at least three in five are unprotected, from East Grinstead (61.8%) to Hastings (78.3%).
87.8%
Hospitality and charities are most at risk
130 of 148 hospitality, leisure and events businesses and 115 of 135 charities do not enforce DMARC. Technology firms (55.7%) and legal firms (56.7%) do best, and even they are above half.
61.5%
Most monitor-only records report to nobody
517 of the 840 organisations on p=none have no reporting address, so their record neither blocks spoofed mail nor tells them it is happening.
Why it matters
The fake invoice that looks exactly like yours
Phishing is the attack UK businesses meet most. The government’s Cyber Security Breaches Survey 2025 found that 85% of businesses that identified a breach or attack in the previous 12 months had experienced phishing, the most common type of breach or attack it recorded.
Without an enforced DMARC policy, a criminal can send an email that shows your business’s exact address in the From line: a supplier invoice with new bank details, a request to a customer to pay a deposit, or a message to your own staff that appears to come from the owner. Your customers and suppliers have no easy way to tell it apart from the real thing.
DMARC will not stop every scam. It does not block lookalike domains or a genuine mailbox that has been taken over. What it does stop is exact-domain spoofing, and the National Cyber Security Centre says a DMARC policy of reject on all of your domains is the best way to prevent spoofing of your email. Our guide to invoice fraud and business email compromise covers the wider controls.
For comparison, our UK law firm study found that 59.6% of law firms did not enforce DMARC. Across Sussex businesses and charities of every kind, it is 71.9%.
The findings in detail
Where Sussex is protected, and where it is not.
Every chart below counts an organisation as unprotected if it has no valid DMARC record or a policy of p=none. Hover or tap a bar for the underlying numbers.
DMARC policy across 1,924 Sussex businesses and charities
Share of organisations at each DMARC setting, from no protection to full protection
- No valid DMARC record28.3%
- Monitor only (p=none)43.7%
- Quarantine16.9%
- Reject11.1%
View the data as a table
| DMARC setting | Organisations | Share |
|---|---|---|
| No valid DMARC record | 544 | 28.3% |
| Monitor only (p=none) | 840 | 43.7% |
| Quarantine | 326 | 16.9% |
| Reject | 214 | 11.1% |
“No valid DMARC record” includes 6 organisations whose record is present but broken. 22 organisations that enforce DMARC apply it to only part of their mail (a pct value below 100).
Unprotected organisations by town
Share that do not enforce DMARC, for every town with at least 40 organisations in the sample
View the data as a table
| Town | Organisations checked | Not enforcing | Share |
|---|---|---|---|
| Hastings | 46 | 36 | 78.3% |
| Worthing | 184 | 141 | 76.6% |
| Chichester | 196 | 149 | 76.0% |
| Hove | 149 | 113 | 75.8% |
| Eastbourne | 126 | 92 | 73.0% |
| Brighton | 474 | 345 | 72.8% |
| Lewes | 71 | 51 | 71.8% |
| Burgess Hill | 59 | 42 | 71.2% |
| Haywards Heath | 86 | 61 | 70.9% |
| Littlehampton | 49 | 34 | 69.4% |
| Bognor Regis | 48 | 32 | 66.7% |
| Horsham | 130 | 86 | 66.2% |
| Crawley | 179 | 116 | 64.8% |
| East Grinstead | 68 | 42 | 61.8% |
Differences between towns are mostly within the margin of error, which ranges from about 4 points for Brighton to about 13 points for the smallest towns. Shoreham-by-Sea (32) and Arundel (27) are included in every other figure but are too small to show on their own. By area: Brighton and Hove 73.5%, West Sussex 70.6%, rest of East Sussex 73.7%.
Unprotected organisations by sector
Share that do not enforce DMARC, grouped by the sector listed in the business database
View the data as a table
| Sector | Organisations checked | Not enforcing | Share |
|---|---|---|---|
| Hospitality, leisure and events | 148 | 130 | 87.8% |
| Charities and non-profits | 135 | 115 | 85.2% |
| Construction, architecture and engineering | 247 | 196 | 79.4% |
| Marketing, media and creative | 167 | 129 | 77.2% |
| Health, care and wellbeing | 99 | 76 | 76.8% |
| Retail and wholesale | 128 | 98 | 76.6% |
| Accountancy | 99 | 75 | 75.8% |
| Property and estate agents | 100 | 71 | 71.0% |
| Finance and insurance | 145 | 102 | 70.3% |
| Recruitment and HR | 100 | 67 | 67.0% |
| Manufacturing, transport and industry | 223 | 133 | 59.6% |
| Legal | 141 | 80 | 56.7% |
| Technology | 131 | 73 | 55.7% |
Accountancy stands out in a different way: 45.5% of accountancy practices have no DMARC record at all, the highest of any sector. 61 organisations in other sectors are included in every other figure.
Unprotected organisations by size
Share that do not enforce DMARC, by number of staff
View the data as a table
| Size | Organisations checked | Not enforcing | Share |
|---|---|---|---|
| 1 to 10 staff | 832 | 693 | 83.3% |
| 11 to 50 staff | 947 | 627 | 66.2% |
| 51 to 200 staff | 74 | 32 | 43.2% |
| 201+ staff | 43 | 12 | 27.9% |
Staff numbers are estimates from the business database. 28 organisations had no size listed.
Unprotected organisations by email setup
Share that do not enforce DMARC, grouped by the mail servers in their MX records
View the data as a table
| Email setup | Organisations checked | Not enforcing | Share |
|---|---|---|---|
| Other or web hosting provider | 236 | 198 | 83.9% |
| Google Workspace | 383 | 314 | 82.0% |
| Microsoft 365, direct | 1,125 | 774 | 68.8% |
| Behind an email security gateway | 180 | 98 | 54.4% |
Security gateways include Mimecast, Proofpoint, Barracuda and similar filtering services. None of these platforms switches DMARC on for you: the record has to be added in your own DNS.
SPF results
SPF is usually there, but often set to soft fail.
SPF lists the servers allowed to send email for your domain. 36.4% of Sussex organisations end it with soft fail (~all), which flags mail from unlisted servers as suspicious rather than failed, and 4.8% have no SPF record at all. 669 organisations (34.8%) neither enforce DMARC nor use a strict SPF record, and 64 have neither record.
| SPF result | Organisations | Share | What it means |
|---|---|---|---|
| Hard fail (-all) | 1,070 | 55.6% | Mail from unlisted servers should fail |
| Soft fail (~all) | 700 | 36.4% | Mail from unlisted servers is suspicious, not failed |
| No SPF record | 93 | 4.8% | Nothing says which servers may send for the domain |
| Neutral (?all) | 23 | 1.2% | Makes no statement about unlisted servers |
| Two or more SPF records | 18 | 0.9% | Invalid, so SPF returns an error for every message |
| Redirect to another record | 10 | 0.5% | Policy inherited from a provider record |
| No “all” term | 6 | 0.3% | No instruction for unlisted servers |
| Pass all (+all) | 4 | 0.2% | Authorises any server on the internet |
DMARC policies explained, and how many Sussex organisations use each
| Policy | What happens to spoofed email | Share |
|---|---|---|
| No record | No instruction. Receivers decide for themselves and the organisation gets no reports. | 28.3% |
| p=none | Monitor only. Spoofed mail is still delivered, but reports arrive if a reporting address is set. | 43.7% |
| p=quarantine | Mail that fails is sent to junk or held for review. | 16.9% |
| p=reject | Mail that fails is refused outright. This is the NCSC recommendation. | 11.1% |
Want to see which row your business is in? Run your domain through our free DMARC and SPF checker.
What to do about it
Four steps from no record to p=reject
Getting to reject costs nothing but needs care, because a rushed policy can block your own invoices, booking confirmations or newsletters. This is the order we follow with clients.
01
Check where you stand
Run your domain through a DMARC checker to see your current DMARC, SPF and mail setup. It takes seconds and needs no login.
02
Publish p=none with reporting
Add a DMARC record with a reporting address so you receive daily reports of every server sending email as your business.
03
Fix every genuine sender
Make sure Microsoft 365 or Google Workspace, your accounts package, booking system, newsletter tool and website forms all pass SPF or DKIM.
04
Move to quarantine, then reject
Tighten the policy in stages and watch the reports. The NCSC notes that many organisations move from quarantine to reject in about three months.
Methodology
How we did the research
We looked only at public DNS records, the same information any mail server checks when it receives an email. We did not access any organisation’s systems, and we do not name anyone.
Using this research. You are welcome to quote or chart these figures. Please credit ATS Connection and link to this page.
ATS Connection (2026), Sussex Business Email Security Report 2026: DMARC adoption across 1,924 Sussex businesses and charities. Published 15 October 2026. https://atsconnection.co.uk/research/sussex-business-email-security/
Sample
We collected 2,013 web domains for organisations with a head office in 16 Sussex towns, from the Hunter company database. We searched sector by sector and town by town, concentrating on businesses with 1 to 50 staff. We removed 50 public sector bodies, schools, colleges and universities, and 34 overseas domains. Of the rest, 5 had no mail servers, leaving 1,924 Sussex businesses and charities that receive email on their domain.
What we checked
On 15 October 2026 we queried Google Public DNS for each organisation’s DMARC record (_dmarc), its SPF record and its MX (mail server) records.
- An organisation counts as enforcing DMARC if it publishes a single valid record with a policy of quarantine or reject.
- It counts as not enforcing DMARC if it has no record, a broken record or a policy of none.
- Email setup is taken from the MX records: Microsoft 365, Google Workspace, an email security gateway, or another provider.
- Town, sector and size come from the business database. Brighton and Hove are counted as one area in the area figures.
Limitations
- This is not a random sample of every Sussex business. It covers organisations with a website listed in a commercial database, and the sector mix reflects how we searched rather than the make-up of the local economy.
- The overall figure has a margin of error of about 2.0 percentage points at 95% confidence. Town and sector figures are less precise, so small differences between them should not be read as real.
- We checked each organisation’s main domain only, and we did not test DKIM or look for lookalike domains.
- DNS records change. An organisation’s record may have changed since 15 October 2026.
Free No obligation Senior engineer 30 minutes
Get your business email
locked down
A free review of your email security with one of our senior engineers, from our offices in Arundel and Chichester. We check your DMARC, SPF and DKIM setup, find every service that sends email as you and give you a safe plan to reach p=reject.
Email security for Sussex businesses
- Your current DMARC, SPF and DKIM setup, in plain English
- Every system that sends email as your business, identified
- A staged plan to quarantine and reject without blocking genuine mail
- Wider Microsoft 365 checks: MFA, mailbox rules and impersonation protection
Cyber Essentials Certified
Microsoft Partner
If it is urgent, call us on 01903 255 159.
FAQ
Sussex email security: common questions
Straight answers about DMARC, spoofing and what this research means for your business.
What is DMARC and why does it matter for my business?
DMARC is a free DNS record that tells other mail servers what to do with email that claims to come from your domain but fails authentication. Set to quarantine or reject, it stops criminals sending email that shows your exact address, such as a fake invoice with new bank details sent to your customers.
How many Sussex businesses do not enforce DMARC?
In our research, 71.9% of the 1,924 Sussex businesses and charities we checked on 15 October 2026 did not enforce DMARC: 28.3% had no valid record and 43.7% were set to monitor only.
Which Sussex towns are most at risk?
Every town with at least 40 organisations in our sample had at least three in five unprotected, from East Grinstead (61.8%) to Hastings (78.3%). The differences between towns are mostly within the margin of error, so the problem is best seen as county-wide.
Does DMARC stop all email fraud?
No. DMARC stops exact-domain spoofing, but it does not stop lookalike domains or emails sent from a genuine mailbox that has been compromised. Businesses still need multi-factor authentication, impersonation protection, staff awareness and a call-back check for any change of bank details.
Is DMARC hard to set up?
The record itself takes minutes. The care is in making sure every system that sends email for you, from your accounts package to your website forms, passes SPF or DKIM before you move to quarantine and reject. Most small businesses get there in a few months.
How can I check my own DMARC record?
Use our free DMARC and SPF checker. Enter your domain and it shows your DMARC policy, your SPF record and whether your domain could be spoofed, with a plain-English explanation of what to fix.
How was this research carried out?
On 15 October 2026 we checked the public DNS records of 1,924 Sussex businesses and charities, taken from a commercial business database. We recorded each organisation’s DMARC policy, SPF record and mail servers. The full method and its limitations are set out on this page.
Can I use these figures?
Yes. Journalists, business groups and councils are welcome to quote or chart the findings. Please credit ATS Connection and link to this page.
Do you name the businesses in the study?
No. We publish only totals and percentages. If you want to know your own result, our free DMARC checker will show it in seconds.
Next steps
Tools and guides for Sussex businesses
Free DMARC and SPF checker
Test your domain in seconds and see whether it can be spoofed, with a plain-English fix list.
Check your domain: Free DMARC and SPF checkerCyber security services
Managed cyber security for Sussex businesses, from MFA and email protection to monitoring and response.
See the service: Cyber security servicesCyber Essentials in Sussex
Readiness review, fixes and submission for Cyber Essentials and Cyber Essentials Plus, from a provider certified itself.
See the service: Cyber Essentials in SussexInvoice fraud and business email compromise
How criminals redirect genuine payments, and the process and IT controls that stop them.
Read the guide: Invoice fraud and business email compromiseUK Law Firm Email Security Report
Our national study of 1,307 law firms: 59.6% do not enforce DMARC.
Read the report: UK Law Firm Email Security ReportIT support across Sussex
Fixed-price managed IT support from our offices in Arundel and Chichester, with engineers across the county.
See the service: IT support across Sussex
