Perimetry Research · November 2026 edition
How well does the UK State protect its websites and e-mail?
We measured the 497 domains of the UK’s central government in open lists: GOV.UK itself, the .gov.uk domains registered for departments, agencies, public bodies and the devolved governments, and the websites of the bodies that keep one of their own. 463 are active; the 236 with a site of their own are graded, with the same passive checks as our study of the French State and as Perimetry Cloud, and the 227 without one are shown apart.
Download the full report (PDF) Findings, charts, every table, the comparison with the French State, recommendations and the methodology.
- 236
- domains with a site of their own, graded
- 54
- average score out of 100
- 74.6%
- enforce DMARC (quarantine or reject)
- 30.1%
- get an A or a B
What stands out
84.3% of the graded domains publish a DMARC policy and 74.6% enforce it (the French State: 43.3%). For the others, an e-mail forged in the government’s name is generally delivered.
Websites: 67.4% have a valid certificate and 75% send visitors from HTTP to HTTPS; 42.1% use HSTS for six months or more and 47.8% send the basic protective headers.
3.8% of the graded domains are signed with DNSSEC (the French State: 3.8%); 4.7% publish a CAA record.
On the same nine checks, the UK State averages 54 out of 100, the French State 46.
227 active domains have no site of their own: 129 send visitors to another site, 98 are used for mail only. 33.9% of them do not enforce DMARC: e-mail forged in their name is delivered.
25.5% of the active domains are outside .gov.uk, mostly the websites of public bodies (.org.uk, .co.uk…).
Grades
Each domain with a site of its own gets a score: the share of the nine checks below that it passes, among those that apply to it (the score of our other studies, without the check on the contact address, which the lists do not give). 236 domains are graded; the average is 54 out of 100, the median 56.
A: 90 or more · B: 75 · C: 60 · D: 40 · E: 20 · F: under 20
34 of the 497 listed domains are inactive (1 no longer in DNS, 33 with neither a site in use nor a mail server) and left out.
Check by check
Share of the graded domains that pass each check, among those it applies to.
Website
- Valid HTTPS certificate67.4%
The site answers over HTTPS with a certificate that is in date, issued for its name, and trusted by browsers. 159 of 236.
- HTTP sends visitors to HTTPS75%
Someone who types the address lands on the encrypted site, not on a page anyone on the network can read or alter. 177 of 236.
- HSTS for six months or more42.1%
Browsers remember to use HTTPS only, so the first unencrypted request cannot be hijacked. 96 of 228.
- Basic protective headers47.8%
X-Content-Type-Options: nosniff, and protection against being framed by another site (X-Frame-Options or CSP frame-ancestors). 109 of 228.
DNS
- DNSSEC3.8%
Answers about the domain are signed, so a resolver cannot be fed false addresses for the administration’s site or mail. 9 of 236.
- CAA record4.7%
The domain names the certificate authorities allowed to issue certificates for it. 11 of 236.
- Strict SPF85.6%
The domain lists the servers allowed to send its mail and asks receivers to reject or flag the others (-all or ~all). 202 of 236.
- DMARC record84.3%
The domain publishes a DMARC policy, the standard that ties SPF and DKIM to the visible sender. 199 of 236.
- DMARC enforced74.6%
The policy is quarantine or reject: messages forged in the administration’s name, to citizens for example, go to spam or are refused, not delivered. 176 of 236.
By category
The GOV.UK organisations’ own classification. Categories with fewer than ten graded domains show no figures, so that none of them can be singled out.
| Group | Graded | Average | A or B | DMARC enforced | Median |
|---|---|---|---|---|---|
| GOV.UK | 1 | – | |||
| Ministerial departments | 61 | 36 | 6.6% | 70.5% | 33 |
| Non-ministerial departments | 15 | 54 | 46.7% | 73.3% | – |
| Executive agencies | 22 | 52 | 27.3% | 77.3% | – |
| Public bodies (non-departmental) | 116 | 65 | 42.2% | 83.6% | 67 |
| Courts and tribunals | 2 | – | |||
| Devolved governments | 12 | 40 | 25% | 33.3% | – |
| Other central bodies | 7 | – | |||
Domains without a site of their own
A domain that only sends visitors elsewhere (to GOV.UK, often), or that is only used for mail, can still be used to forge e-mail in the government’s name. These 227 domains are judged on DNS and mail only.
- 227
- domains (129 send visitors to another site, 98 mail only)
- 33.9%
- do not enforce DMARC
- 84.1%
- DMARC record
- 47
- average score (DNS and mail only)
The State’s own indicators
- 25.5%
- of the active domains outside .gov.uk
- 0.2%
- of the listed domains no longer in DNS
Compared with the French State and our other studies
The same checks in our studies of the French State, communes, local authorities, higher education and .fr domains (latest editions): share of the graded domains that pass each one. The communes and local authorities count ten checks, the others nine. A study comparing the two States’ approaches will follow.
You used Mail Check or Web Check? What Perimetry Cloud does in their place
| UK State (9 checks) | French State (9 checks) | Communes (10 checks) | Local authorities (10 checks) | Higher education (9 checks) | .fr domains (9 checks) | |
|---|---|---|---|---|---|---|
| Average score | 54 | 46 | 47 | 60 | 64 | 32 |
| Valid HTTPS certificate | 67.4% | 63.8% | 93.4% | 98.7% | 100% | 59.1% |
| HTTP sends visitors to HTTPS | 75% | 77.3% | 86.4% | 90.9% | 95.2% | 53.4% |
| HSTS for six months or more | 42.1% | 33.3% | 28.3% | 38.8% | 46.1% | 17.3% |
| Basic protective headers | 47.8% | 51.9% | 26.1% | 40.7% | 57.5% | 14.1% |
| DNSSEC | 3.8% | 3.8% | 22.1% | 25.9% | 12.7% | 25.9% |
| CAA record | 4.7% | 18.5% | 2.8% | 2.6% | 41% | 1.2% |
| Strict SPF | 85.6% | 56.2% | 85.9% | 97.1% | 93% | 71.6% |
| DMARC record | 84.3% | 56.7% | 45.2% | 77.8% | 86.9% | 38.6% |
| DMARC enforced | 74.6% | 43.3% | 19.2% | 32.8% | 45.4% | 11.7% |
Honour roll
2 domains pass every one of the nine checks and have no serious issue.
- officeforstudents.org.uk (Public bodies (non-departmental))
- thenational.academy (Public bodies (non-departmental))
Serious issues were reported privately
5 domains have a serious issue. They are not named here: we report them to the NCSC before publishing.
- Domains whose DNS answers fail: 1
- SPF records that let anyone send mail in the domain’s name: 1
- Expired certificates: 3
How we measured
Passive checks only: the home page of each site over HTTP and HTTPS and nothing else on it, public DNS records, a robot that says who it is. Sources: the Cabinet Office’s list of .gov.uk domain names and the GOV.UK organisations, both under the Open Government Licence v3.0.
Read the methodology Download the figures (JSON) Download the full report (PDF)
You may reuse these figures with a link to this page. Contains public sector information licensed under the Open Government Licence v3.0.