Original research, published 15 October 2026
UK Accountancy Firm Email Security Report 2026
We checked the public email security records of 1,322 UK accountancy firms. More than two in three do not enforce DMARC, the setting that stops criminals sending email that pretends to come from the practice, and more than a third have no record at all.
By the ATS Connection team, offices in Arundel and Chichester. How we did it
Headline finding
68.1%
of 1,322 UK accountancy firms do not enforce DMARC on their email domain
- No valid DMARC record36.4%
- Monitor only (p=none)31.7%
- Quarantine18.5%
- Reject13.4%
Source: ATS Connection analysis of public DNS records, 15 October 2026.
1,322
UK accountancy firms checked on 15 October 2026
68.1%
do not enforce DMARC
36.4%
have no valid DMARC record at all
13.4%
use the strongest setting, p=reject
Key findings
Most UK accountancy firms leave their email domain open to spoofing.
DMARC is a free DNS record. Set to quarantine or reject, it tells Microsoft, Google and every other mail provider to stop email that claims to be from your domain but was not sent by you. Most accountancy firms we checked have not switched it on.
68.1%
More than two in three firms do not enforce DMARC
900 of 1,322 accountancy firms either have no DMARC record or only monitor (p=none), so nothing tells other mail servers to block email that fakes their address.
36.4%
Over a third have no DMARC record at all
481 firms have no valid DMARC record. That is a higher share than we found among UK law firms (31.3%).
79.3%
Small practices are the most exposed
Among practices with 1 to 10 staff, 406 of 512 do not enforce DMARC and 46.1% have no record at all. Among firms with more than 200 staff it is 27.6%.
13.4%
Only around one in seven uses reject
Just 177 firms have DMARC set to reject, the setting the National Cyber Security Centre recommends.
85.4%
Google Workspace firms do worst
88 of 103 firms on Google Workspace do not enforce DMARC, against 70.0% on Microsoft 365 and 50.8% behind an email security gateway.
54.7%
Most monitor-only records report to nobody
229 of the 419 firms on p=none have no reporting address, so the record neither blocks spoofed mail nor tells the practice it is happening.
Why it matters
Clients trust email from their accountant
Accountancy practices sit between their clients and HMRC, banks and payroll. A message from the practice’s own address asking a client to pay a tax bill to a new account, or to send a copy of their passport, is exactly the kind of email clients act on without a second thought.
The professional bodies see the same threat. ACCA has warned that phishing is the number one tactic cybercriminals use to breach accountancy practices. Across all UK businesses, the government’s Cyber Security Breaches Survey 2025 found that 85% of businesses that identified a breach or attack had experienced phishing, the most common type it recorded.
DMARC will not stop every scam. It does not block lookalike domains or a genuine mailbox that has been taken over. What it does stop is exact-domain spoofing, and the National Cyber Security Centre says a DMARC policy of reject on all of your domains is the best way to prevent spoofing of your email. Our guide to cyber security for accountants covers the wider controls practices need in 2026.
For comparison, our UK law firm study found that 59.6% of law firms did not enforce DMARC. Accountancy firms do worse, at 68.1%.
The findings in detail
Who is protected, and who is not.
Every chart below counts a firm as unprotected if it has no valid DMARC record or a policy of p=none. Hover or tap a bar for the underlying numbers.
DMARC policy across 1,322 UK accountancy firms
Share of firms at each DMARC setting, from no protection to full protection
- No valid DMARC record36.4%
- Monitor only (p=none)31.7%
- Quarantine18.5%
- Reject13.4%
View the data as a table
| DMARC setting | Firms | Share |
|---|---|---|
| No valid DMARC record | 481 | 36.4% |
| Monitor only (p=none) | 419 | 31.7% |
| Quarantine | 245 | 18.5% |
| Reject | 177 | 13.4% |
“No valid DMARC record” includes 16 firms whose record is present but broken. 9 firms that enforce DMARC apply it to only part of their mail (a pct value below 100).
Unprotected firms by firm size
Share of firms that do not enforce DMARC, by number of staff
View the data as a table
| Firm size | Firms checked | Not enforcing | Share |
|---|---|---|---|
| 1 to 10 staff | 512 | 406 | 79.3% |
| 11 to 50 staff | 497 | 338 | 68.0% |
| 51 to 200 staff | 144 | 61 | 42.4% |
| 201+ staff | 87 | 24 | 27.6% |
Staff numbers are estimates from the business database. 82 firms had no size listed; 86.6% of them do not enforce DMARC.
Unprotected firms by region
Share of firms that do not enforce DMARC, by where the firm is based
View the data as a table
| Region | Firms checked | Not enforcing | Share |
|---|---|---|---|
| London | 104 | 51 | 49.0% |
| Rest of England | 1,092 | 770 | 70.5% |
| Scotland | 68 | 37 | 54.4% |
| Wales | 31 | 24 | 77.4% |
| Northern Ireland | 27 | 18 | 66.7% |
London’s sample is weighted towards larger firms. Wales and Northern Ireland samples are small, so treat those figures as indicative. In Sussex, 75 of 103 accountancy firms (72.8%) do not enforce DMARC, in line with our Sussex business study.
Unprotected firms by how their email is delivered
Share of firms that do not enforce DMARC, grouped by the mail servers listed in their MX records
View the data as a table
| Email setup | Firms checked | Not enforcing | Share |
|---|---|---|---|
| Google Workspace | 103 | 88 | 85.4% |
| Other or web hosting provider | 111 | 86 | 77.5% |
| Microsoft 365, direct | 852 | 596 | 70.0% |
| Behind an email security gateway | 256 | 130 | 50.8% |
Security gateways include Mimecast, Proofpoint, Barracuda and similar filtering services. None of these platforms switches DMARC on for you: the record has to be added in your own DNS.
SPF results
SPF is usually there, but often set to soft fail.
SPF lists the servers allowed to send email for your domain. 27.2% of accountancy firms end it with soft fail (~all), which flags mail from unlisted servers as suspicious rather than failed. 327 firms (24.7%) neither enforce DMARC nor use a strict SPF record, and 34 have neither record.
| SPF result | Firms | Share | What it means |
|---|---|---|---|
| Hard fail (-all) | 864 | 65.4% | Mail from unlisted servers should fail |
| Soft fail (~all) | 359 | 27.2% | Mail from unlisted servers is suspicious, not failed |
| No SPF record | 42 | 3.2% | Nothing says which servers may send for the domain |
| Redirect to another record | 27 | 2.0% | Policy inherited from a provider record |
| Two or more SPF records | 12 | 0.9% | Invalid, so SPF returns an error for every message |
| Neutral (?all) | 12 | 0.9% | Makes no statement about unlisted servers |
| No “all” term | 5 | 0.4% | No instruction for unlisted servers |
| Pass all (+all) | 1 | 0.1% | Authorises any server on the internet |
DMARC policies explained, and how many accountancy firms use each
| Policy | What happens to spoofed email | Share of firms |
|---|---|---|
| No record | No instruction. Receivers decide for themselves and the firm gets no reports. | 36.4% |
| p=none | Monitor only. Spoofed mail is still delivered, but reports arrive if a reporting address is set. | 31.7% |
| p=quarantine | Mail that fails is sent to junk or held for review. | 18.5% |
| p=reject | Mail that fails is refused outright. This is the NCSC recommendation. | 13.4% |
Want to see which row your practice is in? Run your domain through our free DMARC and SPF checker.
What practices should do
Four steps from no record to p=reject
Getting to reject costs nothing but needs care, because a rushed policy can block your own invoices, engagement letters or client portal notifications. This is the order we follow with accountancy clients.
01
Check where you stand
Run your domain through a DMARC checker to see your current DMARC, SPF and mail setup. It takes seconds and needs no login.
02
Publish p=none with reporting
Add a DMARC record with a reporting address so you receive daily reports of every server sending email as your practice.
03
Fix every genuine sender
Make sure Microsoft 365 or Google Workspace, your practice management software, client portal, e-signature and payroll tools all pass SPF or DKIM.
04
Move to quarantine, then reject
Tighten the policy in stages and watch the reports. The NCSC notes that many organisations move from quarantine to reject in about three months.
Methodology
How we did the research
We looked only at public DNS records, the same information any mail server checks when it receives an email. We did not access any firm’s systems, and we do not name any firm.
Using this research. You are welcome to quote or chart these figures. Please credit ATS Connection and link to this page.
ATS Connection (2026), UK Accountancy Firm Email Security Report 2026: DMARC adoption across 1,322 UK accountancy firms. Published 15 October 2026. https://atsconnection.co.uk/research/accountancy-firm-email-security/
Sample
We started with 1,409 UK web domains listed as accounting firms in the Hunter company database, drawn from a national search and searches covering more than 80 UK towns and cities. We removed 62 domains that were not accountancy practices, such as professional bodies, regulators, software companies and businesses wrongly listed as accountants, and 23 overseas domains. Of the rest, 2 had no mail servers, leaving 1,322 accountancy firms that receive email on their domain.
What we checked
On 15 October 2026 we queried Google Public DNS for each firm’s DMARC record (_dmarc), its SPF record and its MX (mail server) records.
- A firm counts as enforcing DMARC if it publishes a single valid record with a policy of quarantine or reject.
- A firm counts as not enforcing DMARC if it has no record, a broken record or a policy of none.
- Email setup is taken from the MX records: Microsoft 365, Google Workspace, an email security gateway, or another provider.
- Firm size comes from the database’s staff estimate, and region from the firm’s listed head office.
Limitations
- This is not a random sample. It covers firms with a web presence in a commercial database, and it includes more large firms than the profession as a whole. Smaller firms did worst, so the true share across all UK practices is likely to be higher than our headline figure.
- The overall figure has a margin of error of about 2.5 percentage points at 95% confidence. Regional figures are less precise.
- We checked each firm’s main domain only, and we did not test DKIM or look for lookalike domains.
- DNS records change. A firm’s record may have changed since 15 October 2026.
Free Confidential Senior engineer 30 minutes
Get your practice’s email
locked down
A free, confidential review of your practice’s email security with one of our senior engineers, from our offices in Arundel and Chichester. We check your DMARC, SPF and DKIM setup, find every system that sends email as you and give you a safe plan to reach p=reject.
Email security for accountancy practices
- Your current DMARC, SPF and DKIM setup, in plain English
- Every system that sends email as your practice, identified
- A staged plan to quarantine and reject without blocking genuine mail
- Wider Microsoft 365 checks: MFA, mailbox rules and impersonation protection
Cyber Essentials Certified
Microsoft Partner
If it is urgent, call us on 01903 255 159.
FAQ
Accountancy email security: common questions
Straight answers about DMARC, spoofing and what this research means for your practice.
What is DMARC and why does it matter for accountants?
DMARC is a free DNS record that tells other mail servers what to do with email that claims to come from your domain but fails authentication. Set to quarantine or reject, it stops criminals sending email that shows your practice’s exact address, such as a request to a client to pay a tax bill into a new account.
How many UK accountancy firms do not enforce DMARC?
In our research, 68.1% of the 1,322 UK accountancy firms we checked on 15 October 2026 did not enforce DMARC: 36.4% had no valid record and 31.7% were set to monitor only.
Do accountancy firms do worse than law firms?
In our research, yes. 68.1% of accountancy firms did not enforce DMARC, compared with 59.6% of UK law firms. Accountancy firms were also more likely to have no DMARC record at all (36.4% against 31.3%).
Does DMARC stop all email fraud?
No. DMARC stops exact-domain spoofing, but it does not stop lookalike domains or emails sent from a genuine mailbox that has been compromised. Practices still need multi-factor authentication, impersonation protection, staff awareness and a call-back check for any change of bank details.
How long does it take to get to p=reject?
Usually a few months, depending on how many systems send email for the practice. You publish p=none with reporting, fix every legitimate sender so it passes SPF or DKIM, then move to quarantine and finally reject.
How can I check my practice's DMARC record?
Use our free DMARC and SPF checker. Enter your domain and it shows your DMARC policy, your SPF record and whether your domain could be spoofed, with a plain-English explanation of what to fix.
Can I use these figures?
Yes. Journalists, professional bodies and firms are welcome to quote or chart the findings. Please credit ATS Connection and link to this page.
Do you name the firms in the study?
No. We publish only totals and percentages. If you want to know your own result, our free DMARC checker will show it in seconds.
Next steps
Tools and guides for accountancy practices
Free DMARC and SPF checker
Test your practice’s domain in seconds and see whether it can be spoofed, with a plain-English fix list.
Check your domain: Free DMARC and SPF checkerIT support for accountants
Managed IT and cyber security for accountancy practices, kept running through busy season.
See the service: IT support for accountantsCyber security for accountants
The controls UK practices need in place to protect client data and stop payment fraud.
Read the guide: Cyber security for accountantsInvoice fraud and business email compromise
How criminals redirect genuine payments, and the process and IT controls that stop them.
Read the guide: Invoice fraud and business email compromiseUK Law Firm Email Security Report
Our study of 1,307 law firms: 59.6% do not enforce DMARC.
Read the report: UK Law Firm Email Security ReportSussex Business Email Security Report
Our study of 1,924 Sussex businesses and charities: 71.9% do not enforce DMARC.
Read the report: Sussex Business Email Security Report
