Domain name security: the 2026 guide for UK businesses

TL;DR:Proper domain name security involves configuring SPF, DKIM, and DMARC to prevent email spoofing and protect organizational identity.The UK’s government mandates and phased deployment strategies have shaped best practices, stressing ongoing monitoring and enforcement.Many organizations remain vulnerable due to incomplete implementation and reliance on retired reporting services, risking undetected threats.

Domain name security is defined as the set of technical and procedural controls that prevent unauthorised use of your organisation’s domain in email, DNS, and online communications. Without it, criminals can send emails that appear to come from your domain, deceiving clients, partners, and staff. The NCSC’s Active Cyber Defence programme demonstrated the scale of this threat: strict DMARC enforcement blocked over 80 million spoofed emails from UK government domains in a single 30-day window. That figure represents an 18x increase in blocked attempts compared to the programme’s early years. For law firms, accountants, financial services organisations, and charities, the stakes are equally high. Your domain is your identity. Protecting it is not optional.

What technical controls form the foundation of domain name security?

Three email authentication protocols work together to protect your domain: SPF, DKIM, and DMARC. Each plays a distinct role, and all three must be correctly configured to provide meaningful protection.

Sender Policy Framework (SPF) is a DNS record that lists every mail server authorised to send email on behalf of your domain. When a receiving server gets a message claiming to be from you, it checks your SPF record. If the sending server is not on the list, the message fails SPF. Misconfigurations cause legitimate emails to fail, so accuracy matters as much as coverage.

DomainKeys Identified Mail (DKIM) adds a cryptographic signature to every outgoing message. The receiving server verifies that signature against a public key published in your DNS. A valid signature proves the message was not altered in transit and genuinely originated from an authorised source. DKIM monitoring is worth maintaining separately, because signature failures are often the first sign that a third-party sender is misconfigured.

DMARC ties SPF and DKIM together by specifying what receiving servers should do when a message fails both checks. A DMARC policy of p=none monitors without action, p=quarantine sends failing messages to spam, and p=reject blocks them outright. DMARC also generates aggregate reports (RUA) that show you exactly which servers are sending mail on your behalf.

The three protocols must align. A message passes DMARC only when the domain in the From header matches the domain used in either the SPF check or the DKIM signature. Alignment failures are the most common cause of legitimate mail being blocked after organisations tighten their policies.

• SPF authorises sending servers by IP address or hostname
• DKIM signs message content with a cryptographic key
• DMARC enforces policy and delivers reporting
• Alignment connects all three to the visible From address
• Aggregate reports reveal unauthorised senders before you block them

Pro Tip: Set up your DMARC RUA reporting address before you publish any DMARC record. Without reports flowing in, you are flying blind when you move to enforcement.

How have government mandates shaped domain security best practices?

The UK government’s NCSC has been the most influential force in shaping domain security standards for British organisations. Its Active Cyber Defence programme mandated DMARC adoption across central government, and the results proved the case for enforcement at scale.

UK security guidance recommends a phased DMARC approach: start at p=none to collect data, move to p=quarantine once you understand your mail flows, and finally reach p=reject to block all unauthenticated mail. This progression protects you from accidentally blocking legitimate email during rollout. Skipping phases is the single most common cause of mail delivery failures during DMARC projects.

The government also operates a Protective DNS (PDNS) service that blocks connections to known malicious domains. However, commercial PDNS services are recommended for private sector organisations because the government service is not available outside central government. Commercial providers offer equivalent threat intelligence and blocking capabilities.

Internationally, the United States, Australia, and the European Union have each issued guidance or mandates requiring DMARC adoption for public sector bodies. The direction of travel is consistent: enforcement, not just monitoring. UK businesses that align with NCSC guidance now are better positioned as regulatory expectations extend further into the private sector.

What are the common pitfalls in domain name security?

The most dangerous pitfall in 2026 is the loss of DMARC aggregate reporting. NCSC Mail Check was retired on 31 March 2026. Organisations that relied on it for their RUA reports now have no visibility into who is sending mail on their behalf. Without that data, moving to p=reject risks blocking legitimate mail from senders you had not yet identified. The fix is straightforward: replace Mail Check with a commercial DMARC reporting service before attempting any policy tightening.

Vendor DKIM signing is another persistent problem. Vendors frequently sign outgoing email using their own domain in the DKIM d= parameter rather than your organisation’s domain. This breaks DMARC alignment, because the signed domain does not match your From address. The result is delivery failures or, worse, silent quarantining that you only discover when clients report missing emails.

Parked and unused domains are a frequently overlooked attack surface. Attackers target unprotected parked domains for phishing campaigns precisely because organisations assume inactive domains carry no risk. Every domain you own, whether active or not, needs a null SPF record and a p=reject DMARC policy.

Common pitfalls to address immediately:

• No commercial DMARC reporting in place after Mail Check retirement
• Vendors signing with their own domain instead of yours
• Parked domains with no SPF or DMARC records
• SPF records exceeding the 10 DNS lookup limit, causing PermError
• Assuming DMARC alone is sufficient without Multi-Factor Authentication on email accounts

DMARC combined with MFA stops both spoofing and account compromise. DMARC prevents criminals from impersonating your domain externally. MFA prevents them from logging into your actual email accounts and sending from inside. Both are necessary.

Pro Tip: Audit every domain your organisation owns, including old trading names and legacy product domains. Run a DNS check on each one. Any domain missing SPF and DMARC records is an open door for attackers.

How can organisations implement and maintain domain name security?

Practical implementation follows a clear sequence. Rushing any stage creates risk.

1. Publish an SPF record listing every authorised sending service. Use -all at the end to reject mail from unlisted servers. If your SPF record includes many third-party services, flatten it to stay within the 10 DNS lookup limit.
2. Enable DKIM signing on your primary mail platform and on every third-party service that sends on your behalf. Confirm that each vendor signs with your domain in the d= parameter, not their own. Check DKIM configuration if you are unsure whether your current setup passes alignment.
3. Publish a DMARC record at p=none with a valid RUA reporting address. This collects data without affecting delivery.
4. Analyse aggregate reports for a minimum of four weeks. Identify every legitimate sender. Resolve alignment failures with vendors before moving forward.
5. Move to p=quarantine, then monitor for two to four weeks. Watch for any legitimate mail landing in spam.
6. Advance to p=reject once all legitimate senders pass authentication. This is the only policy that fully prevents spoofing.
7. Apply strict policies to parked domains. Publish a null SPF record (v=spf1 -all) and a p=reject DMARC record on every domain that does not send email.
8. Procure a commercial Protective DNS service to block connections to malicious domains at the network level.
9. Schedule quarterly DNS health checks to catch configuration drift, expired DKIM keys, and new senders that have not been authorised.

Ongoing DMARC monitoring is not a one-time task. Mail environments change constantly as organisations adopt new SaaS tools, change email providers, or onboard new marketing platforms. Each change is a potential alignment failure waiting to happen.

Many organisations incorrectly assume their IT provider or email host manages domain security on their behalf. Configuring SPF, DKIM, and DMARC is the organisation’s responsibility. Delegating it without confirming it has been done correctly is one of the most common reasons organisations remain exposed.

Key takeaways

Domain name security requires SPF, DKIM, and DMARC working in alignment, supported by ongoing monitoring and strict policies on every domain your organisation owns.

Why I think most organisations are still one step behind on this

After working in email security for years, the pattern I see most often is organisations that have started their DMARC deployment but never finished it. They published a p=none record, collected reports for a few weeks, and then moved on to the next project. The record sits there, doing nothing, while the organisation believes it is protected.

The retirement of NCSC Mail Check has made this worse. Organisations that relied on it for free reporting now have a gap they may not even be aware of. Without aggregate reports, there is no way to know whether your current configuration is working or whether a new SaaS tool your marketing team onboarded last month is failing DMARC alignment.

The other misconception I encounter regularly is the belief that DMARC is a set-and-forget control. It is not. DNS environments change. Vendors update their infrastructure. DKIM keys expire. A configuration that passed every check in january may be failing silently by june. Regular audits are not bureaucratic overhead. They are the only way to know your protection is still working.

The organisations that get this right treat domain security as a continuous operational responsibility, not a one-time project. They have someone reviewing reports, checking for new senders, and confirming that enforcement policies remain intact. That discipline is what separates organisations that genuinely protect their domains from those that merely believe they do.

— Shaun

How Sealedmail supports your domain security monitoring

Sealedmail provides DMARC, SPF, and DKIM monitoring for businesses across England, with weekly reports written in plain English by a single expert who personally reviews your data. For organisations that lost visibility when NCSC Mail Check retired, Sealedmail fills that gap directly.

Every domain Sealedmail monitors receives checks across DMARC enforcement, SPF configuration, DKIM alignment, and blacklist status. The service is designed for law firms, accountants, financial services organisations, healthcare providers, and charities: sectors where email trust is a regulatory and reputational necessity. At £39 per domain per month, it replaces the complexity of managing DMARC reporting in-house with a clear, expert-reviewed summary of exactly who is sending email on your behalf.

FAQ

What is domain name security?

Domain name security is the practice of using technical controls such as SPF, DKIM, DMARC, and Protective DNS to prevent unauthorised use of your domain in email and online communications. These controls stop criminals from impersonating your organisation.

What does DMARC p=reject actually do?

A DMARC policy of p=reject instructs receiving mail servers to block any email that fails both SPF and DKIM alignment checks. It is the only DMARC policy that fully prevents spoofing of your domain.

Do parked domains need DMARC and SPF records?

Yes. Unused or parked domains are actively targeted by attackers for phishing campaigns. Every domain you own should have a null SPF record and a p=reject DMARC policy, even if it never sends email.

Is DMARC enough to secure my email domain?

DMARC alone is not sufficient. Combining DMARC enforcement at p=reject with Multi-Factor Authentication on all email accounts stops both external spoofing and internal account compromise, providing complete protection.

What replaced NCSC Mail Check for DMARC reporting?

NCSC Mail Check was retired on 31 March 2026. Organisations now need a commercial DMARC reporting service to receive aggregate reports and safely progress their enforcement policies without risking delivery failures.

Article generated by BabyLoveGrowth