Original research, published 15 October 2026
Care and Health Provider Email Security Report 2026
We checked the public email security records of 10,774 CQC-registered care homes, home care agencies, dental practices and clinics in England. More than four in five do not enforce DMARC, the setting that stops criminals sending email that pretends to come from the provider.
By the ATS Connection team, offices in Arundel and Chichester. How we did it
Headline finding
83.4%
of 10,774 care and health providers in England do not enforce DMARC on their email domain
- No valid DMARC record50.1%
- Monitor only (p=none)33.3%
- Quarantine9.5%
- Reject7.1%
Source: ATS Connection analysis of public DNS records, 15 October 2026.
10,774
care and health providers checked on 15 October 2026
83.4%
do not enforce DMARC
50.1%
have no valid DMARC record at all
7.1%
use the strongest setting, p=reject
Key findings
Most care and health providers leave their email domain open to spoofing.
DMARC is a free DNS record. Set to quarantine or reject, it tells Microsoft, Google and every other mail provider to stop email that claims to be from your domain but was not sent by you. Most of the providers we checked have not switched it on.
83.4%
More than four in five providers do not enforce DMARC
8,984 of 10,774 providers either have no DMARC record or only monitor (p=none), so nothing tells other mail servers to block email that fakes their address.
89.2%
Dental practices are the most exposed
2,422 of 2,715 dental practices do not enforce DMARC, and 54.1% have no record at all. Home care and supported living providers follow at 85.8%, and care homes at 78.1%.
85.8%
Single-site providers do far worse than groups
Among providers with one registered location, 7,857 of 9,158 do not enforce DMARC. Among groups with six or more locations it is 48.3%.
50.1%
Half have no DMARC record at all
5,393 providers have no valid DMARC record. That is a higher share than we found among UK law firms (31.3%) or accountancy firms (36.4%).
8.7%
1,105 listed web domains no longer exist
Of the 12,660 website domains listed in the CQC directory that we checked, 1,105 (8.7%) did not exist in DNS. A lapsed domain may be available for anyone to register, including someone who wants to impersonate the provider.
10.4%
One in ten websites failed a basic HTTPS check
1,199 of the website addresses listed in the CQC directory would not load over a trusted HTTPS connection when we checked.
Why it matters
Families, councils and the NHS trust email from care providers
Care homes, home care agencies and clinics exchange email every day with families, local authority commissioners, GP surgeries, pharmacies and hospitals. A message from the provider’s own address asking a family to pay fees into a new account, or asking a pharmacy to change a delivery, is exactly the kind of email people act on.
The sector has made real progress on data security. Digital Care Hub reported that 76.5% of CQC-registered adult social care services had an up-to-date Data Security and Protection Toolkit at the June 2026 deadline, and a published toolkit is required before a care provider can sign up for NHSmail. But NHSmail protects the nhs.net address. It does nothing to stop someone spoofing the provider’s own domain, the one on its website, invoices and letters to families.
Across all UK businesses, the government’s Cyber Security Breaches Survey 2025 found that 85% of businesses that identified a breach or attack had experienced phishing, the most common type it recorded. The National Cyber Security Centre says a DMARC policy of reject on all of your domains is the best way to prevent spoofing of your email. Our plain-English guide to the DSPT covers the wider controls care providers need.
The findings in detail
Who is protected, and who is not.
Every chart below counts a provider as unprotected if it has no valid DMARC record or a policy of p=none. Hover or tap a bar for the underlying numbers.
DMARC policy across 10,774 care and health providers
Share of providers at each DMARC setting, from no protection to full protection
- No valid DMARC record50.1%
- Monitor only (p=none)33.3%
- Quarantine9.5%
- Reject7.1%
View the data as a table
| DMARC setting | Providers | Share |
|---|---|---|
| No valid DMARC record | 5,393 | 50.1% |
| Monitor only (p=none) | 3,591 | 33.3% |
| Quarantine | 1,022 | 9.5% |
| Reject | 768 | 7.1% |
“No valid DMARC record” includes 89 providers whose record is present but broken or could not be read. 53 providers that enforce DMARC apply it to only part of their mail (a pct value below 100).
Unprotected providers by type of service
Share of providers that do not enforce DMARC, by the main service registered with the CQC
View the data as a table
| Type of service | Providers checked | Not enforcing | Share |
|---|---|---|---|
| Dental practices | 2,715 | 2,422 | 89.2% |
| Home care and supported living | 4,500 | 3,859 | 85.8% |
| Care homes | 2,508 | 1,958 | 78.1% |
| Clinics and other healthcare | 1,051 | 745 | 70.9% |
Home care includes supported living and shared lives services. Clinics and other healthcare includes independent clinics, hospitals, hospices, diagnostic, rehabilitation and other services. GP practices are not included.
Unprotected providers by size
Share of providers that do not enforce DMARC, by number of CQC-registered locations
View the data as a table
| Size | Providers checked | Not enforcing | Share |
|---|---|---|---|
| 1 location | 9,158 | 7,857 | 85.8% |
| 2 to 5 locations | 1,266 | 958 | 75.7% |
| 6 or more locations | 350 | 169 | 48.3% |
We count locations that share the same website domain. A franchise network that uses one domain counts once.
Unprotected providers by region
Share of providers that do not enforce DMARC, by the English region where most of their locations are
View the data as a table
| Region | Providers checked | Not enforcing | Share |
|---|---|---|---|
| London | 1,908 | 1,626 | 85.2% |
| East | 1,236 | 1,044 | 84.5% |
| North East | 267 | 225 | 84.3% |
| East Midlands | 943 | 793 | 84.1% |
| Yorkshire & Humberside | 743 | 620 | 83.4% |
| South East | 2,197 | 1,825 | 83.1% |
| North West | 1,166 | 962 | 82.5% |
| South West | 1,217 | 997 | 81.9% |
| West Midlands | 1,096 | 891 | 81.3% |
Every English region is above 80%, from the West Midlands (81.3%) to London (85.2%), so this is a national problem rather than a local one. In Sussex, 381 of 522 providers (73.0%) do not enforce DMARC, against 71.9% in our Sussex business study.
Unprotected providers by how their email is delivered
Share of providers that do not enforce DMARC, grouped by the mail servers listed in their MX records
View the data as a table
| Email setup | Providers checked | Not enforcing | Share |
|---|---|---|---|
| Other or web hosting provider | 4,007 | 3,655 | 91.2% |
| Google Workspace | 1,159 | 1,050 | 90.6% |
| Microsoft 365, direct | 4,815 | 3,784 | 78.6% |
| Behind an email security gateway | 793 | 495 | 62.4% |
Security gateways include Mimecast, Proofpoint, Barracuda and similar filtering services. None of these platforms switches DMARC on for you: the record has to be added in your own DNS.
Website basics
One in ten websites failed a basic HTTPS check.
We also loaded the website address each provider lists in the CQC directory over HTTPS. 1,199 of 11,555 sites (10.4%) would not load over a trusted HTTPS connection. Common causes are a missing, expired or mismatched certificate, or a listed address that no longer works. A further 282 (2.4%) did not respond within 10 seconds.
Browsers warn visitors away from these sites, and any enquiry or referral form served without HTTPS sends information unencrypted. A certificate is usually a quick fix through the web host.
| Type of service | Websites checked | No valid HTTPS | Share |
|---|---|---|---|
| Care homes | 2,716 | 439 | 16.2% |
| Home care and supported living | 4,766 | 442 | 9.3% |
| Dental practices | 2,930 | 229 | 7.8% |
| Clinics and other healthcare | 1,143 | 89 | 7.8% |
SPF results
SPF is often missing, or set to soft fail.
SPF lists the servers allowed to send email for your domain. 39.5% of providers end it with soft fail (~all), which flags mail from unlisted servers as suspicious rather than failed. 4,889 providers (45.4%) neither enforce DMARC nor use a strict SPF record, and 783 have neither record.
| SPF result | Providers | Share | What it means |
|---|---|---|---|
| Hard fail (-all) | 5,341 | 49.6% | Mail from unlisted servers should fail |
| Soft fail (~all) | 4,259 | 39.5% | Mail from unlisted servers is suspicious, not failed |
| No SPF record | 872 | 8.1% | Nothing says which servers may send for the domain |
| Redirect to another record | 41 | 0.4% | Policy inherited from a provider record |
| Two or more SPF records | 99 | 0.9% | Invalid, so SPF returns an error for every message |
| Neutral (?all) | 118 | 1.1% | Makes no statement about unlisted servers |
| No “all” term | 37 | 0.3% | No instruction for unlisted servers |
| Pass all (+all) | 7 | 0.1% | Authorises any server on the internet |
DMARC policies explained, and how many care and health providers use each
| Policy | What happens to spoofed email | Share of providers |
|---|---|---|
| No record | No instruction. Receivers decide for themselves and the provider gets no reports. | 50.1% |
| p=none | Monitor only. Spoofed mail is still delivered, but reports arrive if a reporting address is set. | 33.3% |
| p=quarantine | Mail that fails is sent to junk or held for review. | 9.5% |
| p=reject | Mail that fails is refused outright. This is the NCSC recommendation. | 7.1% |
Want to see which row you are in? Run your domain through our free DMARC and SPF checker.
What providers should do
Four steps from no record to p=reject
Getting to reject costs nothing but needs care, because a rushed policy can block your own invoices, rota emails or messages from your care planning system. This is the order we follow with care clients.
01
Check where you stand
Run your domain through a DMARC checker to see your current DMARC, SPF and mail setup. It takes seconds and needs no login.
02
Publish p=none with reporting
Add a DMARC record with a reporting address so you receive daily reports of every server sending email as your service.
03
Fix every genuine sender
Make sure Microsoft 365 or Google Workspace, your care planning and rostering software, payroll, website forms and newsletter tools all pass SPF or DKIM.
04
Move to quarantine, then reject
Tighten the policy in stages and watch the reports. The NCSC notes that many organisations move from quarantine to reject in about three months.
Methodology
How we did the research
We looked only at public records: the CQC care directory and public DNS, the same information any mail server checks when it receives an email. We did not access any provider’s systems, and we do not name any provider.
Using this research. You are welcome to quote or chart these figures. Please credit ATS Connection and link to this page.
ATS Connection (2026), Care and Health Provider Email Security Report 2026: DMARC adoption across 10,774 CQC-registered providers in England. Published 15 October 2026. https://atsconnection.co.uk/research/care-provider-email-security/
Sample
We started with the CQC care directory published on 14 October 2026, which lists every active location registered with the Care Quality Commission in England. We kept locations with a website listed and removed GP practices, NHS bodies, councils and prison healthcare, as most of these use NHS or public sector email. Locations that share a website domain were grouped, so each provider counts once. That gave 12,660 provider domains. Of these, 1,886 had no mail servers or no longer exist, leaving 10,774 providers that receive email on their domain.
What we checked
On 15 October 2026 we queried Google Public DNS for each provider’s DMARC record (_dmarc), its SPF record and its MX (mail server) records, and loaded the website address listed for it in the CQC directory over HTTPS.
- A provider counts as enforcing DMARC if it publishes a single valid record with a policy of quarantine or reject.
- A provider counts as not enforcing DMARC if it has no record, a broken record or a policy of none.
- Type of service comes from the CQC service types. Each location is classed as a care home, home care, dental or other service, and each domain takes the type that most of its locations have.
- Size is the number of CQC-registered locations using the domain. Region is the region where most of those locations are.
- A website counts as no valid HTTPS if the listed address would not load over a trusted HTTPS connection. Sites that did not respond within 10 seconds are reported separately.
Limitations
- The study covers providers that list a website in the CQC directory. About half of locations do not, and these are likely to be smaller providers.
- The overall figure has a margin of error of about 0.7 percentage points at 95% confidence. Figures for smaller groups are less precise.
- We checked each provider’s main domain only, and we did not test DKIM or look for lookalike domains.
- DNS records and websites change. A provider’s setup may have changed since 15 October 2026.
Contains public sector information licensed under the Open Government Licence v3.0, from the Care Quality Commission care directory.
Free Confidential Senior engineer 30 minutes
Get your service's email
locked down
A free, confidential review of your email security with one of our senior engineers, from our offices in Arundel and Chichester. We check your DMARC, SPF and DKIM setup, find every system that sends email as you and give you a safe plan to reach p=reject.
Email security for care providers
- Your current DMARC, SPF and DKIM setup, in plain English
- Every system that sends email as your service, identified
- A staged plan to quarantine and reject without blocking genuine mail
- Wider checks that support your DSPT: MFA, mailbox rules and impersonation protection
Cyber Essentials Certified
Microsoft Partner
If it is urgent, call us on 01903 255 159.
FAQ
Care email security: common questions
Straight answers about DMARC, spoofing and what this research means for your service.
What is DMARC and why does it matter for care providers?
DMARC is a free DNS record that tells other mail servers what to do with email that claims to come from your domain but fails authentication. Set to quarantine or reject, it stops criminals sending email that shows your exact address, such as a request to a family to pay care fees into a new account.
How many care and health providers do not enforce DMARC?
In our research, 83.4% of the 10,774 CQC-registered care and health providers we checked on 15 October 2026 did not enforce DMARC: 50.1% had no valid record and 33.3% were set to monitor only.
Does NHSmail protect my own email domain?
No. NHSmail gives your staff secure nhs.net addresses, but it does not protect the domain on your website, invoices and letters. DMARC, set to quarantine or reject on that domain, is what stops criminals sending email that appears to come from it.
Will DMARC block emails from our care planning or rota software?
Not if it is set up in stages. Starting at p=none with reporting shows every system that sends email as you, so each one can be set up to pass SPF or DKIM before the policy is tightened to quarantine and reject.
Does DMARC stop all email fraud?
No. DMARC stops exact-domain spoofing, but it does not stop lookalike domains or emails sent from a genuine mailbox that has been compromised. Providers still need multi-factor authentication, staff awareness and a call-back check for any change of bank details.
How long does it take to get to p=reject?
Usually a few months, depending on how many systems send email for you. You publish p=none with reporting, fix every legitimate sender so it passes SPF or DKIM, then move to quarantine and finally reject.
How can I check my own DMARC record?
Use our free DMARC and SPF checker. Enter your domain and it shows your DMARC policy, your SPF record and whether your domain could be spoofed, with a plain-English explanation of what to fix.
Can I use these figures?
Yes. Journalists, care associations, councils and providers are welcome to quote or chart the findings. Please credit ATS Connection and link to this page.
Do you name the providers in the study?
No. We publish only totals and percentages. If you want to know your own result, our free DMARC checker will show it in seconds.
Next steps
Tools and guides for care providers
Free DMARC and SPF checker
Test your domain in seconds and see whether it can be spoofed, with a plain-English fix list.
Check your domain: Free DMARC and SPF checkerIT support for care homes
Managed IT and cyber security for care homes and care providers, with resident data kept secure.
See the service: IT support for care homesDSPT for care homes
A plain-English guide to the Data Security and Protection Toolkit for care homes and home care providers.
Read the guide: DSPT for care homesInvoice fraud and business email compromise
How criminals redirect genuine payments, and the process and IT controls that stop them.
Read the guide: Invoice fraud and business email compromiseUK Accountancy Firm Email Security Report
Our study of 1,322 accountancy firms: 68.1% do not enforce DMARC.
Read the report: UK Accountancy Firm Email Security ReportSussex Business Email Security Report
Our study of 1,924 Sussex businesses and charities: 71.9% do not enforce DMARC.
Read the report: Sussex Business Email Security Report
