FTSE 100 email security: who's actually blocking spoofed mail
DMARC is the DNS record that tells other mail servers what to do with an email claiming
to be from your domain but that fails authentication — the exact mechanism behind most
"CEO fraud" and invoice-redirection phishing, where an attacker sends mail that looks like
it came from yourcompany.com because nothing was stopping them from claiming
it did. Publishing a DMARC record with a real enforcement policy is one of the cheapest,
highest-leverage anti-phishing controls a company can deploy. Publishing one that only
monitors, or publishing nothing at all, isn't.
We looked up the DMARC record for every FTSE 100 primary domain we have DNS data for — 100 domains — via a standard DNS query, the same lookup any mail server performs before delivering a message.
p=none —
monitoring only, with no instruction to reject or quarantine anything.DMARC policy distribution
| Policy | What it does | Companies |
|---|---|---|
p=reject | Fails authentication → message rejected | 54 |
p=quarantine | Fails authentication → sent to spam/junk | 19 |
p=none | Fails authentication → delivered anyway, just logged | 17 |
| No record | No DMARC mechanism at all | 10 |
Put differently: 27 of the FTSE 100 — more than a quarter — currently have either no
DMARC enforcement or a policy that doesn't enforce anything. For a company that size, that's
not usually an oversight so much as an unfinished rollout: p=none is the
standard first step of a DMARC deployment, run for weeks or months to catch legitimate mail
streams that would otherwise break, before moving to quarantine and then reject. The
question worth asking about any specific one of these 27 is which state that is — a rollout
in progress, or one that stalled.
Who actually routes the mail
The MX records point to a much shorter vendor list than you might expect. Classifying each domain's mail exchanger hostnames by provider:
| Provider | Companies |
|---|---|
| Microsoft 365 | 35 |
| Proofpoint | 23 |
| Mimecast | 18 |
| Self-hosted | 3 |
Three vendors account for roughly three-quarters of FTSE 100 corporate email routing. Proofpoint and Mimecast are both specifically email-security gateways — sitting in front of whatever actually stores the mail — which suggests a fair number of the Microsoft 365 tenants are also running one of them for inbound filtering rather than relying on Microsoft's native protection alone, though MX records alone can't confirm that without seeing the full mail-routing chain.
Full mail and DNS provider rankings: infrastructure analysis.