The UK's biggest listed companies are 2.4 times as likely as America's to be open to email impersonation. We checked the public email records of 758 companies in the FTSE 100, FTSE 250 and S&P 500 in October 2026. 23.2% of the FTSE 350 have no DMARC enforcement, so a fake email can go out in their name and still reach the inbox. In the S&P 500 the figure is 9.6%.
That gap is the same in both halves of the FTSE. 23.2% of the FTSE 100 and 23.2% of the FTSE 250 can be impersonated. Most of the exposed UK companies do have a DMARC record. They have left it on "monitor only", which reports fake emails and delivers them anyway.
This is original Pipefire research. You are free to use any figure or chart on this page. Please link to this page as the source.
Key statistics
- 23.2% of FTSE 350 companies can be impersonated by email (60 of 259), against 9.6% of the S&P 500 (48 of 499).
- 23.2% of the FTSE 100 can be impersonated: 22 of the 95 companies we checked.
- 55.6% of the FTSE 350 block fake emails outright (p=reject), against 70.9% of the S&P 500.
- 18.1% of the FTSE 350 have DMARC on "monitor only" (p=none), twice the S&P 500 rate of 8.8%.
- 5.0% of the FTSE 350 have no DMARC record at all, against 0.8% of the S&P 500.
- All 11 banks in the FTSE 350 have DMARC enforcement in place.
- Real estate is the most exposed sector on both sides of the Atlantic: 47.4% of FTSE 350 property companies can be impersonated, and 23.3% in the S&P 500.
- Retail and consumer companies show the widest gap: 36.5% of the FTSE 350 can be impersonated, against 11.1% in the S&P 500.
- Big companies are far better protected than small ones. In our small business email security study, 83.3% of 9,338 local businesses could be impersonated.
How well do the biggest companies block fake email?
DMARC is a short public record that tells receiving mail servers what to do with an email that claims to come from a company's domain but fails its checks. It can reject the email, send it to spam, or let it through and report it.
| DMARC setting | What happens to a fake email | FTSE 100 | FTSE 250 | S&P 500 |
|---|---|---|---|---|
| p=reject | Blocked | 54.7% | 56.1% | 70.9% |
| p=quarantine | Sent to the spam folder | 17.9% | 18.3% | 18.6% |
| Enforced on part of mail only | Blocked or spam for some fakes | 4.2% | 2.4% | 0.8% |
| p=none (monitor only) | Delivered as normal, reported to the owner | 20.0% | 17.1% | 8.8% |
| No DMARC record | Delivered as normal | 3.2% | 6.1% | 0.8% |
| Can be impersonated | 23.2% | 23.2% | 9.6% | |
| Companies checked | 95 | 164 | 499 |
Almost every large company has started. 96.8% of the FTSE 100 and 99.2% of the S&P 500 publish a DMARC record. The difference is in finishing the job. A record on p=none is a sensible first step, because the reports show who is sending email in the company's name. But it stops nothing. One in five FTSE 100 companies has stayed at that step.
Which sectors are most exposed?
| Sector | FTSE 350 checked | FTSE 350 can be impersonated | S&P 500 checked | S&P 500 can be impersonated |
|---|---|---|---|---|
| Real estate | 19 | 47.4% | 30 | 23.3% |
| Retail and consumer | 52 | 36.5% | 81 | 11.1% |
| Health care | 12 | 33.3% | 60 | 10.0% |
| Energy, mining and utilities | 32 | 28.1% | 76 | 11.8% |
| Industrials | 58 | 15.5% | 82 | 7.3% |
| Financial services | 26 | 11.5% | 76 | 3.9% |
| Technology and telecoms | 26 | 7.7% | 94 | 8.5% |
| Banks (UK only) | 11 | 0.0% | ||
| Insurance (UK only) | 8 | 25.0% | ||
| Travel and leisure (UK only) | 15 | 20.0% |
The S&P 500 uses a different sector system that puts banks, insurers and travel companies inside wider groups, so those three rows are UK only. Several UK sectors have fewer than 20 companies, so one company changes the figure by five points or more. Read the small rows as a direction, not a precise rate.
Two patterns hold on both sides. Companies that move money by email, banks and financial services, are the best protected. Property and consumer companies, which deal with tenants and shoppers who often receive email from them, are the most exposed. Technology and telecoms is the one sector where the UK is level with the US.
Are the banks in the FTSE 350 protected?
Yes. All 11 banks in the FTSE 350 enforce DMARC: Barclays, HSBC, Investec, Lion Finance Group, Lloyds Banking Group, Metro Bank, NatWest Group, OSB Group, Shawbrook Bank, Standard Chartered and TBC Bank. Two of them, Lion Finance Group (Bank of Georgia) and TBC Bank, are London-listed banks that operate mainly in Georgia.
Eight of the 11 block fake emails outright with p=reject on the domain they send email from. The other three use p=quarantine. Shawbrook Bank also owns shawbrook.com, which is set to p=reject, but its published press and investor addresses are on shawbrook.co.uk, which is set to p=quarantine, so we count it there.
That matters because banks are the most copied senders in phishing. A scammer can still register a lookalike domain, but they cannot send an email that passes as coming from the bank's own address.
How do big companies compare with small businesses?
The gap is wide. In our study of 9,338 small businesses across 10 UK and 10 US cities, 83.3% could be impersonated and only 7.2% blocked fake emails outright. Among the biggest listed companies, 9.6% (S&P 500) to 23.2% (FTSE 350) can be impersonated, and most block fakes.
So the scammer's easiest target is rarely a FTSE 100 brand. It is the builder, accountant or dental practice that sends invoices by email from a domain with no protection. In the UK, phishing was the most common breach or attack, experienced by 38% of businesses in the past year, according to the government's Cyber Security Breaches Survey 2025/2026. In the US, the FBI's 2025 IC3 report records $3.05 billion lost to business email compromise in a single year.
What should a company do?
The fix is the same at any size, and it costs nothing:
- Check your domain. Our free DMARC checker and SPF checker show what your domain publishes today, in plain English.
- Read the reports. If you are on p=none, the reports already tell you which services send as you. Our guide on how to read DMARC reports explains what comes back.
- Move to p=quarantine, then p=reject. Once only your own services appear in the reports, tighten the policy. Our DMARC record generator builds the record. That step is what actually stops fake emails, and 23.2% of the FTSE 350 have not taken it.
Methodology
The companies. We took the constituents of the FTSE 100, FTSE 250 and S&P 500 as listed on Wikipedia in October 2026: 853 listings. We removed 91 FTSE investment trusts and funds, because most have no staff and no mailboxes of their own, and 4 duplicate share classes (one company listed twice). That left 758 companies: 95 in the FTSE 100, 164 in the FTSE 250 and 499 in the S&P 500.
The domains. We took each company's website from Wikidata or its Wikipedia page and followed redirects to its current domain. Where that domain had no mail server, we used the domain the company actually sends email from, found from its own website, press pages or published contacts. That applied to 46 companies, for example barclays.com in place of home.barclays.
The checks. On 31 October 2026 we looked up each domain's public MX, SPF and DMARC records through public DNS resolvers. Every lookup succeeded.
Related domains. We checked one domain per company: the one it sends email from. Some companies also send from a related domain that is protected while the domain we checked is not. We looked for these among the exposed companies and counted a related domain only where public records link the two: a shared DMARC report mailbox, the same mail server account, a redirect, an SPF include, or a link from the company's own website. Counting those, the FTSE 100 figure falls from 23.2% to 13.7% (13 of 95), the FTSE 350 from 23.2% to 18.5%, and the S&P 500 from 9.6% to 8.4%. The UK is still 2.2 times as exposed as the US. We rejected candidates that belong to a different company, such as aberdeen.com, which is not Aberdeen Group. The per-company file below lists every related domain we accepted.
The definitions. "Can be impersonated" means the domain has no DMARC record or a policy of p=none. "Protected" means p=quarantine or p=reject, including the few records that apply the policy to only part of the mail (pct below 100), which we show as their own row. This matches the rule in our small business study. DMARC protects the exact address in the From line. It does not stop lookalike domains, which need separate defences.
Limits. We checked each company's main domain. Large companies own many domains, and a subsidiary or brand domain can be set up differently. Sector groups merge two classification systems (FTSE's ICB and the S&P's GICS) into plain groups, so they are close but not identical. Index membership changes each quarter. We will rerun the study each year.
Data, downloads and citation
Every figure and chart on this page is free to use in articles, reports and presentations. Please credit Pipefire and link to this page.
Downloads (CSV)
- Results by index: counts and percentages for the FTSE 100, FTSE 250, FTSE 350 and S&P 500.
- Results by sector: each sector group, UK and US.
- Every company checked: all 758 companies, the domain checked, its DMARC policy as published on 31 October 2026, and any related protected domain. These are public DNS records that anyone can look up.
How to cite
Lovatt, M. (2026). Big company email security statistics 2026: UK firms 2.4x as exposed as US. Pipefire. https://pipefire.ai/cold-email/big-company-email-security-statistics
Research record and DOI. The paper and data are also published on Zenodo, the open research repository run by CERN: doi:10.5281/zenodo.23838211. To cite the paper:
Lovatt, M. (2026). DMARC enforcement among FTSE 350 and S&P 500 companies: a 2026 study of 758 listed companies (Version 1.0). Zenodo. https://doi.org/10.5281/zenodo.23838211
Charts carry their own source line, so they can be used as they are.
Press and data questions: Mike Lovatt, founder, [email protected]. We can rerun a sector or an index on request.
Big company email security FAQ
What percentage of FTSE 100 companies have DMARC?
96.8% of the FTSE 100 companies we checked publish a DMARC record. But 20.0% have it on p=none, which monitors and does not block. 76.8% enforce it, with p=quarantine or p=reject.
Are UK companies worse at email security than US companies?
On DMARC, yes. 23.2% of the FTSE 350 can be impersonated by email, against 9.6% of the S&P 500. The gap comes mostly from UK companies leaving DMARC on "monitor only": 18.1% of the FTSE 350 do, against 8.8% of the S&P 500. Counting related domains that some companies also use, the UK is still 2.2 times as exposed.
Which sector is most at risk of email impersonation?
Real estate, in both countries: 47.4% of FTSE 350 property companies and 23.3% of S&P 500 property companies can be impersonated. Banks are the best protected: all 11 banks in the FTSE 350 enforce DMARC.
Can I use these statistics?
Yes. Every figure and chart on this page is free to use in articles, reports and presentations. Please credit Pipefire and link to this page. The data behind every figure can be downloaded as CSV from the data section above.