Perimetry Research · November 2026 edition
How well do the UK councils protect their websites and e-mail?
We measured the websites and e-mail of the 366 domains of the United Kingdom’s principal councils: the county, district, metropolitan borough, unitary and London borough councils of England, and the councils of Wales, Scotland and Northern Ireland. 359 have a site of their own and are graded, with the same passive checks as our studies of the French and UK States and as Perimetry Cloud.
Download the full report (PDF) Findings, charts, every table, the comparison with our other studies, recommendations and the methodology.
- 359
- domains with a site of their own, graded
- 69
- average score out of 100
- 95.5%
- enforce DMARC (quarantine or reject)
- 35.9%
- get an A or a B
What stands out
99.4% of the graded domains publish a DMARC policy and 95.5% enforce it (French local authorities: 32.8%; German local authorities: 41.1%). Where it is not enforced, an e-mail forged in the authority’s name, to residents for example, is generally delivered.
Websites: 98.1% have a valid certificate and 85.5% send visitors from HTTP to HTTPS; 57% use HSTS for six months or more and 74.3% send the basic protective headers.
1.9% of the graded domains are signed with DNSSEC; 11.4% publish a CAA record.
On the same nine checks, the councils average 69 out of 100, the UK State 54.
7 active domains have no site of their own (0 send visitors to another site, 7 are used for mail only); they are judged on DNS and mail only and left out of the grades.
Grades
Each domain with a site of its own gets a score: the share of the nine checks below that it passes, among those that apply to it. 359 domains are graded; the average is 69 out of 100, the median 67.
A: 90 or more · B: 75 · C: 60 · D: 40 · E: 20 · F: under 20
When a site answers our robot with an error page (often a filter that turns away data-centre networks), its certificate and its HTTP redirect are still graded, but not its headers, which would be the filter’s.
Check by check
Share of the graded domains that pass each check, among those it applies to.
Website
- Valid HTTPS certificate98.1%
The site answers over HTTPS with a certificate that is in date, issued for its name, and trusted by browsers. 352 of 359.
- HTTP sends visitors to HTTPS85.5%
Someone who types the address lands on the encrypted site, not on a page anyone on the network can read or alter. 307 of 359.
- HSTS for six months or more57%
Browsers remember to use HTTPS only, so the first unencrypted request cannot be hijacked. 171 of 300.
- Basic protective headers74.3%
X-Content-Type-Options: nosniff, and protection against being framed by another site (X-Frame-Options or CSP frame-ancestors). 223 of 300.
DNS
- DNSSEC1.9%
Answers about the domain are signed, so a resolver cannot be fed false addresses for the administration’s site or mail. 7 of 359.
- CAA record11.4%
The domain names the certificate authorities allowed to issue certificates for it. 41 of 359.
- Strict SPF100%
The domain lists the servers allowed to send its mail and asks receivers to reject or flag the others (-all or ~all). 359 of 359.
- DMARC record99.4%
The domain publishes a DMARC policy, the standard that ties SPF and DKIM to the visible sender. 357 of 359.
- DMARC enforced95.5%
The policy is quarantine or reject: messages forged in the administration’s name, to citizens for example, go to spam or are refused, not delivered. 343 of 359.
By category
Categories with fewer than ten graded domains show no figures, so that none can be singled out.
| Group | Graded | Average | A or B | DMARC enforced | Median |
|---|---|---|---|---|---|
| County councils (England) | 21 | 71 | 38.1% | 95.2% | – |
| District councils (England) | 154 | 69 | 33.8% | 94.8% | 67 |
| Metropolitan borough councils | 35 | 69 | 28.6% | 97.1% | 67 |
| Unitary authorities (England) | 53 | 69 | 39.6% | 96.2% | 67 |
| London borough councils and the City of London | 33 | 73 | 51.5% | 100% | 78 |
| Welsh councils | 21 | 66 | 23.8% | 95.2% | – |
| Scottish councils | 31 | 69 | 32.3% | 96.8% | 67 |
| Northern Ireland councils | 11 | 75 | 54.5% | 81.8% | – |
Compared with our other studies
The same checks in our other studies (latest editions): share of the graded domains that pass each one. The French local authorities count ten checks, the others nine.
| UK councils (9 checks) | German local authorities (9 checks) | French local authorities (10 checks) | UK State (9 checks) | |
|---|---|---|---|---|
| Average score | 69 | 62 | 60 | 54 |
| Valid HTTPS certificate | 98.1% | 96.4% | 98.7% | 67.4% |
| HTTP sends visitors to HTTPS | 85.5% | 92% | 90.9% | 75% |
| HSTS for six months or more | 57% | 74.3% | 38.8% | 42.1% |
| Basic protective headers | 74.3% | 68.6% | 40.7% | 47.8% |
| DNSSEC | 1.9% | 15% | 25.9% | 3.8% |
| CAA record | 11.4% | 12.4% | 2.6% | 4.7% |
| Strict SPF | 100% | 88.6% | 97.1% | 85.6% |
| DMARC record | 99.4% | 73.6% | 77.8% | 84.3% |
| DMARC enforced | 95.5% | 41.1% | 32.8% | 74.6% |
Honour roll
1 councils pass every one of the nine checks and have no serious issue.
- Newry, Mourne and Down District Council (Northern Ireland councils)
Is your organisation in this study?
Ask for its private page: its score, the checks of the study and where it stands among comparable organisations. The link is sent only to an address on your organisation’s domain; nothing else follows.
Serious issues were reported privately
2 domains have a serious issue. They are not named here: we told the authorities privately before publishing.
- Expired certificates: 2
How we measured
Passive checks only: the home page of each site over HTTP and HTTPS and nothing else on it, public DNS records, a robot that says who it is. Sources: mySociety’s UK local authority names and codes (CC BY 4.0) for the list, GOV.UK’s local authority records (Open Government Licence v3.0) for each council’s website.
Read the methodology Download the figures (JSON) Download the full report (PDF)
You may reuse these figures with a link to this page. Contains data from mySociety (CC BY 4.0) and public sector information licensed under the Open Government Licence v3.0.