83% of small businesses can be impersonated by email. We checked the public email records of 9,338 local businesses across 10 UK cities, 10 US cities and 12 trades in October 2026. Only 16.7% had their domain set to stop fake emails sent in their name. The other 83.3% had no protection, a setting that only watches, or a broken record.
That matters because the most common attack on a small firm is a fake email. In the UK, 38% of businesses identified a phishing attack in the past year, according to the government's Cyber Security Breaches Survey 2025/2026. In the US, the FBI's 2025 IC3 report records $3.05 billion lost to business email compromise in a single year. A domain without DMARC enforcement makes those scams easier, because a fake invoice can arrive from the real business's own address.
This is original Pipefire research. You are free to use any figure or chart on this page. Please link to this page as the source.
Key statistics
- 83.3% of small businesses can be impersonated by email: no DMARC enforcement (UK 83.9%, US 82.6%).
- 50.9% have no working DMARC record at all (50.5% none, 0.4% broken).
- 32.4% have DMARC set to "monitor only" (p=none), which reports fake emails but delivers them anyway.
- 7.2% block fake emails outright (p=reject). A further 9.5% send them to spam (p=quarantine).
- 12.5% have no SPF record, the basic list of servers allowed to send their email.
- 1.1% have two SPF records. That is an error: receiving servers treat both as invalid, which can push the business's own genuine emails into spam.
- 92.1% of hair salons can be impersonated, the most exposed trade. Law firms are the least exposed, at 68.8%.
- Cardiff (89.9%) is the most exposed UK city in the sample. Edinburgh (77.6%) is the least.
- US businesses are more likely to have nothing in place: 55.0% have no DMARC record, against 46.1% in the UK.
- Only 23.2% of businesses receive DMARC reports, so most would not know if their domain were being used in a scam.
How well protected are small businesses?
DMARC is a short public record that tells receiving mail servers what to do with an email that claims to come from a domain but fails its checks. There are three settings, plus having no record at all:
| DMARC setting | What happens to a fake email | All | UK | US |
|---|---|---|---|---|
| No record, or a broken one | Delivered as normal | 50.9% | 46.5% | 55.5% |
| p=none (monitor only) | Delivered as normal, reported to the owner | 32.4% | 37.5% | 27.2% |
| p=quarantine | Sent to the spam folder | 9.5% | 8.9% | 10.1% |
| p=reject | Blocked | 7.2% | 7.2% | 7.3% |
A record with p=none is a useful first step, because it shows the owner who is sending email as them. But it does not stop anything. So for impersonation, "monitor only" and "no record" end the same way: the fake email lands in the inbox.
Which trades are most at risk?
| Trade | Businesses checked | Can be impersonated | No DMARC record | Blocks fakes (p=reject) |
|---|---|---|---|---|
| Hair salon | 482 | 92.1% | 60.4% | 3.7% |
| Plumber | 817 | 89.1% | 52.4% | 4.3% |
| Roofing contractor | 864 | 87.8% | 51.7% | 3.1% |
| Dentist | 819 | 86.6% | 52.1% | 7.1% |
| Electrician | 758 | 86.5% | 57.5% | 5.8% |
| Builder / contractor | 819 | 84.5% | 51.6% | 6.6% |
| Car repair | 699 | 84.5% | 54.2% | 7.0% |
| Vet | 634 | 82.5% | 42.1% | 7.6% |
| Estate agent / realtor | 823 | 81.8% | 45.7% | 9.2% |
| Restaurant | 668 | 81.7% | 46.4% | 7.9% |
| Accountant | 954 | 80.3% | 50.6% | 7.9% |
| Law firm | 1,001 | 68.8% | 44.8% | 13.7% |
Trades that send invoices or take deposits by email are the ones a fake email can cost most: builders, roofers, plumbers and electricians. In the UK, roofing contractors (90.5%), plumbers (90.4%) and builders (89.3%) are all close to nine in ten.
Law firms come out best, likely because conveyancing fraud has made email security a regulated concern for solicitors. Even so, 68.8% of the law firms we checked could still be impersonated.
Which cities are most at risk?
| UK city | Can be impersonated | US city | Can be impersonated | |
|---|---|---|---|---|
| Cardiff | 89.9% | Los Angeles | 86.4% | |
| London | 86.5% | New York | 85.6% | |
| Glasgow | 85.7% | Philadelphia | 84.8% | |
| Belfast | 84.2% | Chicago | 83.7% | |
| Manchester | 84.0% | Seattle | 82.7% | |
| Leeds | 83.8% | Houston | 82.0% | |
| Bristol | 83.6% | Atlanta | 81.7% | |
| Liverpool | 82.2% | Phoenix | 81.1% | |
| Birmingham | 81.8% | Miami | 79.7% | |
| Edinburgh | 77.6% | Denver | 78.8% |
Each city figure is based on 427 to 525 businesses, so differences of two or three points between cities are within normal variation. The gap between Cardiff and Edinburgh, 12 points, is not.
Does the email provider make a difference?
| Email provider | Businesses | No DMARC record | Can be impersonated |
|---|---|---|---|
| Google Workspace | 1,926 | 62.0% | 90.6% |
| Microsoft 365 | 2,850 | 48.5% | 75.8% |
| Other or web host email | 4,562 | 47.7% | 84.9% |
Neither Google nor Microsoft adds a DMARC record to a customer's domain automatically. Microsoft 365 users are the most likely to have enforcement in place, perhaps because Microsoft's setup screens prompt for it more directly.
Are marketing agencies any better?
We also checked 14,201 marketing, advertising and web design agencies in the US, the businesses that often set up email for local firms. They do better, but not by much: 76.9% can be impersonated, 37.0% have no DMARC record, and 8.9% block fake emails. They are more likely to receive DMARC reports (37.0% against 23.2%), which suggests more agencies have started down the path but stopped at "monitor only".
What should a small business do?
Three changes close most of the gap, and none costs money:
- Check your domain. Our free DMARC checker and SPF checker show what your domain publishes today, in plain English.
- Publish a DMARC record with reporting turned on. Start at p=none with a reporting address, so you can see who sends email as you. Our DMARC record generator builds one, and our guide on how to read DMARC reports explains what comes back.
- Move to p=quarantine, then p=reject. Once the reports show only your own services sending as you, tighten the policy. That is the step that actually stops fake emails, and only 16.7% of the businesses we checked have taken it.
If you only have one SPF record and it ends in ~all or -all, you are in better shape than most. If you have two, merge them into one: that single fix can also help your genuine emails reach the inbox.
Methodology
The sample. We took local business listings with a website for 12 trades in 10 UK cities (London, Birmingham, Manchester, Leeds, Glasgow, Bristol, Liverpool, Edinburgh, Cardiff, Belfast) and 10 US cities (New York, Los Angeles, Chicago, Houston, Phoenix, Philadelphia, Atlanta, Seattle, Miami, Denver), up to 50 per trade per city. That gave 11,848 unique business domains. We removed chains sharing one domain, booking-platform and website-builder subdomains, and government and education sites.
The checks. In October 2026 we looked up each domain's public MX, SPF and DMARC records through public DNS resolvers. We excluded domains whose lookups failed and domains with no MX record, because they do not receive email under that name. That left 9,338 businesses (4,706 UK, 4,632 US).
The definitions. "Can be impersonated" means the domain has no DMARC record, a broken DMARC record, a policy of p=none, or no valid policy. "Protected" means p=quarantine or p=reject; a p=reject record that applies to less than 100% of mail is counted as quarantine. DMARC protects the exact address in the From line, the most common form of email impersonation. It does not stop lookalike domains, which need separate defences.
The agency sample is 14,201 US marketing, advertising and web agency domains from Pipefire's own prospect research, checked the same way. It is reported separately because it is not a random sample of agencies.
Limits. A listing with a website is not every small business: firms without a website are not in the sample, and they may be less protected still. Figures are rounded to one decimal place. We will rerun the study each quarter and update this page.
Small business email security FAQ
What percentage of small businesses have DMARC?
49.1% of the small businesses we checked have a working DMARC record (UK 53.5%, US 44.5%). But most of those are set to p=none, which monitors and does not block. Only 16.7% have DMARC set to quarantine or reject fake emails.
Can someone send an email pretending to be my business?
Yes, if your domain has no DMARC enforcement, which was true for 83.3% of businesses in our study. Without p=quarantine or p=reject, a receiving mail server has no instruction to stop an email that falsely uses your address in the From line.
What is the difference between SPF and DMARC?
SPF lists the servers allowed to send email for your domain. DMARC tells receiving servers what to do when an email fails that check, or fails DKIM, and where to send reports. SPF on its own does not protect the address people see in the From line; DMARC does.
Which small businesses are most at risk of email impersonation?
In our data, hair salons (92.1%), plumbers (89.1%) and roofing contractors (87.8%) are the most likely to be impersonated. Law firms (68.8%) are the least likely, but still more than two in three.
Can I use these statistics?
Yes. Every figure and chart on this page is free to use in articles, reports and presentations. Please credit Pipefire and link to this page.