Perimetry Research · Comparison · November 2026

Two States, two approaches: how France and the UK protect their domains

Our studies of the French State (1,440 domains) and of the UK’s central government (497 domains) use the same nine checks and the same rules. Here they are side by side, with what each State requires of its administrations, and what it gives them to get there.

54 / 46: average score, UK / France
74.6% / 43.3%: enforce DMARC, UK / France
6.8% / 25.8%: of the listed domains are inactive, UK / France
3.8%: sign their domains with DNSSEC, in both

What the figures say

E-mail is the clearest gap: 74.6% of the UK’s graded domains enforce DMARC, against 43.3% in France, and the gap is wider still among the domains without a site, where e-mail forged in the State’s name is delivered for 33.9% of the UK’s and 63.3% of France’s.

France keeps far more dormant domains: 25.8% of the domains in its lists are inactive, against 6.8% in the UK, and 78 French domains had a serious issue (5.4%), against 5 in the UK (1%).

On the websites themselves, the two are close: valid certificates (67.4% / 63.8%), HTTP sent to HTTPS (75% / 77.3%), HSTS (42.1% / 33.3%). France publishes CAA records more often (18.5% / 4.7%).

DNSSEC is rare on both sides: 3.8% of the graded domains in each.

Side by side

The domains with a site of their own, graded on the same nine checks, and the domains without one shown apart.

	United Kingdom	France
Domains in the lists	497	1,440
Active	463	1,069
Inactive (no DNS, or neither site nor mail)	6.8%	25.8%
With a site of their own (graded)	236	660
Average score	54	46
Median score	56	44
A or B	30.1%	13%
Active domains without a site of their own	227	409
…of which do not enforce DMARC	33.9%	63.3%
Active domains outside the State’s extension (.gouv.fr / .gov.uk)	25.5%	18.5%
Domains with a serious issue (reported privately)	5 (1%)	78 (5.4%)

Check by check

Check	United Kingdom	France	±
Valid HTTPS certificate	67.4%	63.8%	+3.6
HTTP sends visitors to HTTPS	75%	77.3%	-2.3
HSTS for six months or more	42.1%	33.3%	+8.8
Basic protective headers	47.8%	51.9%	-4.1
DNSSEC	3.8%	3.8%	0
CAA record	4.7%	18.5%	-13.8
Strict SPF	85.6%	56.2%	+29.4
DMARC record	84.3%	56.7%	+27.6
DMARC enforced	74.6%	43.3%	+31.3

What each State asks, and what it offers

From the texts each government publishes. Where we found no published rule, we say so; a rule may exist that is not public.

United Kingdom

France

Where the State lives online

United KingdomOne site: GOV.UK. Public-facing services must use a GOV.UK domain, or another public sector domain where GDS grants an exemption, and the GOV.UK Design System. ¹

FranceOne extension: .gouv.fr. The circular of 7 July 2023 made the extension and the State’s design system mandatory for new sites and set deadlines for existing ones (1 July 2025 for communication sites, 1 January 2026 for online procedures); some State operators are not bound by it. ^{2, 3}

E-mail

United KingdomWritten requirements: SPF, DKIM and DMARC on every domain, TLS 1.2 or later and an MTA-STS policy for every domain that receives mail, a central DMARC reporting address, and a ready-made reject policy for domains that send no mail. GOV.UK and service.gov.uk have published a reject policy since 2016. ^{4, 5, 6, 7}

FranceGuidance rather than a published rule: the ANSSI’s guide on connecting an information system to the internet has a chapter on securing e-mail. The State’s 2026–2027 security roadmap asks ministries to strengthen the security of their e-mail before 31 December 2026, noting that attacks on the State favour weaknesses in domain names and e-mail. We found no published text requiring DMARC on the State’s domains. ^{8, 9}

Websites

United KingdomServices on service.gov.uk must be HTTPS only with HSTS; the domain has been on the browsers’ HSTS preload list since 2016, and a CAA record is required. ^{7, 10}

FranceThe ANSSI recommends HTTPS, HSTS and the protective headers in its guide to websites; new State sites need the SIG’s approval and the State’s design system. ^{11, 2}

DNS

United KingdomNo published requirement for DNSSEC on .gov.uk domains that we found; a CAA record is required on service.gov.uk. ¹⁰

FranceThe ANSSI recommends DNSSEC in its guides on domain names and DNS architectures. ¹²

Tools offered to administrations

United KingdomThe NCSC’s Mail Check and Web Check, free since 2017, were retired on 31 March 2026: organisations are told to buy a commercial attack surface management product; Early Warning and DNS Check continue. ¹³

FranceThe ANSSI offers SILENE, a mapping of an organisation’s exposure on the internet, and runs campaigns to warn the owners of vulnerable systems. ¹⁴

Reporting a vulnerability

United KingdomA single government vulnerability reporting service, for any UK government online service. ¹⁵

FranceThe ANSSI receives vulnerability reports and protects the identity of a reporter acting in good faith (article L.2321-4 of the code de la défense). ¹⁶

What each could take from the other

France: a written e-mail baseline for every State domain (SPF, DKIM, DMARC at reject for domains that send no mail, MTA-STS), with a central reporting address, as the UK has had since 2016; and a cleanup of the hundreds of dormant domains still listed.

The UK: keeping a free, central view of the State’s domains now that Mail Check and Web Check are gone, and both: DNSSEC, almost absent on either side.

Limits of the comparison

The two populations come from different lists. France’s includes many former campaign and body domains; the UK’s can only include the .gov.uk domains registered for central government by March 2023, plus the bodies’ own websites.
The UK concentrates its ministries on one site, GOV.UK, where France spreads them over many domains: the UK’s graded domains are fewer and, on average, more often those of public bodies.
Nine simple checks, pass or fail, on the domain and its home page only. The texts quoted are those we found published; a rule may exist that is not public.

Sources

The UK State study The French State study Methodology