Original research, published 15 October 2026
UK Law Firm Email Security Report 2026
We checked the public email security records of 1,307 UK law firms. Three in five do not enforce DMARC, the setting that tells other mail servers to block email that pretends to come from the firm. Small firms are the most exposed.
By the ATS Connection team, offices in Arundel and Chichester. How we did it
Headline finding
59.6%
of 1,307 UK law firms do not enforce DMARC on their email domain
- No valid DMARC record31.3%
- Monitor only (p=none)28.3%
- Quarantine20.3%
- Reject20.1%
Source: ATS Connection analysis of public DNS records, 15 October 2026.
1,307
UK law firms checked on 15 October 2026
59.6%
do not enforce DMARC
31.3%
have no valid DMARC record at all
20.1%
use the strongest setting, p=reject
Key findings
Most UK law firms leave their email domain open to spoofing.
DMARC is a free DNS record. Set to quarantine or reject, it tells Microsoft, Google and every other mail provider to stop email that claims to be from your domain but was not sent by you. Most firms we checked have not switched it on.
59.6%
Three in five firms do not enforce DMARC
779 of 1,307 firms either have no DMARC record or only monitor (p=none). In both cases nothing in their DNS tells other mail servers to block email that fails the checks.
31.3%
Almost a third have no DMARC record at all
409 firms have no valid DMARC record, so receiving servers get no instruction from the firm about spoofed mail and the firm gets no reports about it.
80.1%
Small firms are the most exposed
Among firms with 1 to 10 staff, 214 of 267 do not enforce DMARC and half have no record at all. Among firms with more than 200 staff the figure falls to 19.3%.
54.4%
Sussex firms sit close to the national picture
68 of the 125 Sussex law firms we checked do not enforce DMARC. For the smallest Sussex firms, 1 to 10 staff, it is 32 of 38.
48.1%
Almost half of monitor-only records report to nobody
178 of the 370 firms on p=none have no reporting address, so the record neither blocks spoofed mail nor tells the firm it is happening.
22.0%
One in five is open on both checks
287 firms neither enforce DMARC nor use a strict SPF record. Of these, 28 have no DMARC record and no SPF record at all.
Why it matters
Email impersonation is the fraud law firms report most
Law firms move client money and sensitive documents by email, which makes them a natural target for impersonation. The Solicitors Regulation Authority says email modification fraud was the most common type of cyber incident reported to it, accounting for 68 percent of the reports it received between 2016 and 2019, and that modified emails often impersonate the firm or the client to obtain money or information.
Across all UK businesses the pattern is the same. The government’s Cyber Security Breaches Survey 2025 found that 85% of businesses that identified a breach or attack in the previous 12 months had experienced phishing, the most common type of breach or attack it recorded.
DMARC will not stop every scam. It does not block lookalike domains or a genuine mailbox that has been taken over. What it does stop is the simplest attack of all: a criminal sending email that shows your firm’s exact address in the From line. The National Cyber Security Centre says a DMARC policy of reject on all of your domains is the best way to prevent spoofing of your email, and the SRA points firms to the same advice.
For conveyancing teams in particular, a spoofed email from the firm’s own domain asking a buyer to send completion money to new bank details is exactly the scenario our guide to Friday afternoon fraud covers. Our guide to invoice fraud and business email compromise explains the wider controls.
The findings in detail
Who is protected, and who is not.
Every chart below counts a firm as unprotected if it has no valid DMARC record or a policy of p=none. Hover or tap a bar for the underlying numbers.
DMARC policy across 1,307 UK law firms
Share of firms at each DMARC setting, from no protection to full protection
- No valid DMARC record31.3%
- Monitor only (p=none)28.3%
- Quarantine20.3%
- Reject20.1%
View the data as a table
| DMARC setting | Firms | Share |
|---|---|---|
| No valid DMARC record | 409 | 31.3% |
| Monitor only (p=none) | 370 | 28.3% |
| Quarantine | 265 | 20.3% |
| Reject | 263 | 20.1% |
“No valid DMARC record” includes 5 firms whose record is present but broken. 18 firms that enforce DMARC apply it to only part of their mail (a pct value below 100).
Unprotected firms by firm size
Share of firms that do not enforce DMARC, by number of staff
View the data as a table
| Firm size | Firms checked | Not enforcing | Share |
|---|---|---|---|
| 1 to 10 staff | 267 | 214 | 80.1% |
| 11 to 50 staff | 464 | 288 | 62.1% |
| 51 to 200 staff | 251 | 116 | 46.2% |
| 201+ staff | 150 | 29 | 19.3% |
Staff numbers are estimates from the business database. 175 firms had no size listed; 75.4% of them do not enforce DMARC.
Unprotected firms by region
Share of firms that do not enforce DMARC, by where the firm is based
View the data as a table
| Region | Firms checked | Not enforcing | Share |
|---|---|---|---|
| Sussex | 125 | 68 | 54.4% |
| London | 97 | 29 | 29.9% |
| Rest of England | 938 | 596 | 63.5% |
| Scotland | 92 | 59 | 64.1% |
| Wales | 22 | 9 | 40.9% |
| Northern Ireland | 33 | 18 | 54.5% |
84 of the 97 London firms in our sample have more than 50 staff, so the London figure mainly reflects larger firms. Wales and Northern Ireland samples are small, so treat those figures as indicative.
Unprotected firms by how their email is delivered
Share of firms that do not enforce DMARC, grouped by the mail servers listed in their MX records
View the data as a table
| Email setup | Firms checked | Not enforcing | Share |
|---|---|---|---|
| Google Workspace | 41 | 35 | 85.4% |
| Other or web hosting provider | 113 | 84 | 74.3% |
| Microsoft 365, direct | 685 | 443 | 64.7% |
| Behind an email security gateway | 468 | 217 | 46.4% |
Security gateways include Mimecast, Proofpoint, Barracuda and similar filtering services. Neither a gateway nor Microsoft 365 switches DMARC on for you: the record has to be added in your own DNS.
SPF results
SPF is mostly in place, but often set to soft fail.
SPF lists the servers allowed to send email for your domain. Almost every firm has one, but 30.4% end it with soft fail (~all), which flags mail from unlisted servers as suspicious rather than failed. Without an enforced DMARC policy, that leaves the decision to the receiving server.
| SPF result | Firms | Share | What it means |
|---|---|---|---|
| Hard fail (-all) | 841 | 64.3% | Mail from unlisted servers should fail |
| Soft fail (~all) | 397 | 30.4% | Mail from unlisted servers is suspicious, not failed |
| No SPF record | 34 | 2.6% | Nothing says which servers may send for the domain |
| Redirect to another record | 20 | 1.5% | Policy inherited from a provider record |
| Two or more SPF records | 6 | 0.5% | Invalid, so SPF returns an error for every message |
| Neutral (?all) | 4 | 0.3% | Makes no statement about unlisted servers |
| Pass all (+all) | 3 | 0.2% | Authorises any server on the internet |
| No “all” term | 2 | 0.2% | No instruction for unlisted servers |
DMARC policies explained, and how many firms use each
| Policy | What happens to spoofed email | Share of firms |
|---|---|---|
| No record | No instruction. Receivers decide for themselves and the firm gets no reports. | 31.3% |
| p=none | Monitor only. Spoofed mail is still delivered, but the firm can receive reports if it adds a reporting address. | 28.3% |
| p=quarantine | Mail that fails is sent to junk or held for review. | 20.3% |
| p=reject | Mail that fails is refused outright. This is the NCSC recommendation. | 20.1% |
Want to see which row your firm is in? Run your domain through our free DMARC and SPF checker.
What law firms should do
Four steps from no record to p=reject
Getting to reject is not a big project, but it does need care, because a rushed policy can block a firm’s own invoices or completion statements. This is the order we follow with law firms.
01
Check where you stand
Run your domain through a DMARC checker to see your current DMARC, SPF and mail setup. It takes seconds and needs no login.
02
Publish p=none with reporting
Add a DMARC record with a reporting address so you receive daily reports of every server sending email as your firm.
03
Fix every genuine sender
Make sure Microsoft 365, your case management system, e-billing, marketing and scanning tools all pass SPF or DKIM, so nothing legitimate gets blocked.
04
Move to quarantine, then reject
Tighten the policy in stages and watch the reports. The NCSC notes that many organisations move from quarantine to reject in about three months.
Methodology
How we did the research
We looked only at public DNS records, the same information any mail server checks when it receives an email. We did not access any firm’s systems, and we do not name any firm.
Using this research. You are welcome to quote or chart these figures. Please credit ATS Connection and link to this page.
ATS Connection (2026), UK Law Firm Email Security Report 2026: DMARC adoption across 1,307 UK law firms. Published 15 October 2026. https://atsconnection.co.uk/research/law-firm-email-security-report/
Sample
We started with 1,471 UK web domains listed as law practices in the Hunter company database, drawn from a national search and searches covering more than 100 UK towns and cities, with extra coverage of Sussex. We removed 160 domains that were not UK law firms: barristers’ chambers, regulators and law societies, legal software and publishing companies, recruiters, marketing agencies, insurers and overseas offices. Four of the remaining 1,311 had no mail servers, leaving 1,307 law firms that receive email on their domain.
What we checked
On 15 October 2026 we queried Google Public DNS for each firm’s DMARC record (_dmarc), its SPF record and its MX (mail server) records.
- A firm counts as enforcing DMARC if it publishes a single valid record with a policy of quarantine or reject.
- A firm counts as not enforcing DMARC if it has no record, a broken record or a policy of none.
- Email platform is taken from the MX records: Microsoft 365, Google Workspace, an email security gateway, or another provider.
- Firm size comes from the database’s staff estimate. Region comes from the firm’s listed head office; Sussex means East and West Sussex, including Brighton and Hove.
Limitations
- This is not a random sample. It covers firms with a web presence in a commercial database, and it includes more large firms than the profession as a whole. Smaller firms did worst, so the true share across all UK firms is likely to be higher than our headline figure.
- The overall figure has a margin of error of about 2.7 percentage points at 95% confidence. The Sussex figure is about 8.7 points either way.
- We checked each firm’s main domain only. Some firms send email from other domains too.
- We did not test DKIM, which cannot be checked reliably from outside without knowing each firm’s key names, and we did not look for lookalike domains.
- DNS records change. A firm’s record may have changed since 15 October 2026.
Free Confidential Senior engineer 30 minutes
Get your firm’s email
locked down
A no-obligation review of your firm’s email security with one of our senior engineers. We check your DMARC, SPF and DKIM setup, find every service that sends email as you and give you a safe plan to reach p=reject.
Email security for law firms
- Your current DMARC, SPF and DKIM setup, in plain English
- Every system that sends email as your firm, identified
- A staged plan to quarantine and reject without blocking genuine mail
- Wider Microsoft 365 checks: MFA, mailbox rules and impersonation protection
Cyber Essentials Certified
Microsoft Partner
If it is urgent, call us on 01903 255 159.
FAQ
Law firm email security: common questions
Straight answers about DMARC, spoofing and what this research means for your firm.
What is DMARC and why does it matter for law firms?
DMARC is a free DNS record that tells other mail servers what to do with email that claims to come from your domain but fails authentication. Set to quarantine or reject, it stops criminals sending email that shows your firm’s exact address. Because law firms handle client money and confidential documents by email, a spoofed message from the firm’s own address is one of the most convincing frauds there is.
What does "not enforcing DMARC" mean?
It means the firm either has no DMARC record or has one set to p=none. A p=none policy only monitors: spoofed email is still delivered, and the firm learns about it only if it has added a reporting address. In our research, 59.6% of UK law firms were in one of these two positions.
Does DMARC stop all email fraud?
No. DMARC stops exact-domain spoofing, but it does not stop lookalike domains, for example a domain with one letter changed, or emails sent from a genuine mailbox that has been compromised. Firms still need multi-factor authentication, impersonation protection, staff awareness and a call-back procedure for any change of bank details.
Does the SRA require law firms to use DMARC?
The SRA does not mandate DMARC. Its cybersecurity advice for firms notes that DMARC is recommended by the National Cyber Security Centre, and its checklist asks firms whether they are aware of DMARC and have explored monitoring their email. The NCSC recommends a policy of reject on all of your domains.
How long does it take to get to p=reject?
Usually a few months, depending on how many systems send email for the firm. You publish p=none with reporting, fix every legitimate sender so it passes SPF or DKIM, then move to quarantine and finally reject. The NCSC notes that many organisations can move from quarantine to reject after about three months.
How can I check my firm's DMARC record?
Use our free DMARC and SPF checker. Enter your firm’s domain and it shows your DMARC policy, your SPF record and whether the domain could be spoofed, with a plain-English explanation of what to fix.
How was this research carried out?
On 15 October 2026 we checked the public DNS records of 1,307 UK law firms, taken from a commercial business database and cleaned to remove anything that was not a UK law firm. We recorded each firm’s DMARC policy, SPF record and mail servers. The full method and its limitations are set out on this page.
Can I use these figures?
Yes. Journalists, law societies and firms are welcome to quote or chart the findings. Please credit ATS Connection and link to this page.
Do you name the firms in the study?
No. We publish only totals and percentages. If you work at a law firm and want to know your own result, our free DMARC checker will show it in seconds.
Next steps
Tools and guides for law firms
Free DMARC and SPF checker
Test your firm’s domain in seconds and see whether it can be spoofed, with a plain-English fix list.
Check your domain: Free DMARC and SPF checkerIT support for solicitors
Managed IT and cyber security for law firms, from named engineers who know your case management system.
See the service: IT support for solicitorsSRA IT requirements for solicitors
A compliance checklist covering what the SRA expects from your technology, information security and data handling.
Read the guide: SRA IT requirements for solicitorsFriday afternoon fraud in conveyancing
How payment diversion fraud catches conveyancing firms between exchange and completion, and the controls that stop it.
Read the guide: Friday afternoon fraud in conveyancingInvoice fraud and business email compromise
How criminals redirect genuine payments, and the process and IT controls that stop them.
Read the guide: Invoice fraud and business email compromiseDoes the SRA require Cyber Essentials?
Where Cyber Essentials fits for law firms, and why firms fail their first assessment.
Read the guide: Does the SRA require Cyber Essentials?
