FTSE 250 email security

How the UK's mid-cap listed companies protect their email: can others spoof mail in their name (SPF, DKIM, DMARC), and is mail to them encrypted in transit (TLS). 162 operating companies; investment trusts excluded because their mail runs through a few dominant fund managers. Data gathered 18 October 2026.

This is not end-to-end encryption. The TLS measure covers encryption only on the hop between mail servers. A message is still readable on each company's own servers. True end-to-end encryption (S/MIME or PGP, on people's devices) is a separate thing and cannot be measured from outside. Everything here uses only information each company publishes for senders to read — public DNS records and, for TLS enforcement, a published policy file. No company's systems were accessed or scanned.

The two questions

76%

enforce DMARC — block or quarantine email spoofed in their name (123 of 162)

enforce TLS in transit — insist inbound mail is encrypted (10 of 162); 7 more are testing it

24%

could be impersonated today — no enforced DMARC policy

90%

rely on their mail provider's default for TLS, with no enforcement signalled

Spoofing protection by sector (DMARC enforced)

DMARC "enforced" = a published policy of quarantine or reject, so mail forged in the company's name is stopped. "Monitor only" (p=none) reports but blocks nothing.

Sector	Companies	DMARC enforced	%	TLS enforced
Aerospace & Defence	3	3	100%	0
Banks & Lending	7	7	100%	0
Chemicals & Materials	6	6	100%	0
Investment Trusts & Funds	1	1	100%	0
Support Services & Outsourcing	8	8	100%	2
Telecoms & Media	7	7	100%	0
Asset Management & Brokers	15	14	93%	1
Technology & Software	12	10	83%	0
Industrials & Engineering	14	11	79%	3
Travel, Leisure & Hospitality	11	8	73%	1
Retail	18	13	72%	1
Consumer Goods, Food & Drink	10	7	70%	0
Construction & Housebuilding	12	8	67%	0
Healthcare & Pharma	6	4	67%	1
Transport & Logistics	5	3	60%	0
Insurance	2	1	50%	0
Real Estate	14	7	50%	1
Energy, Utilities & Mining	11	5	45%	0

TLS enforcement in transit

Almost every company's mail server accepts TLS, but only a handful insist on it. Of the 162 operating companies, 10 enforce TLS in transit (a published MTA-STS enforce policy, DANE, or both) and 7 more are testing enforcement. The other 145 rely on their mail provider's opportunistic default, which a network attacker can strip — so the encryption is not guaranteed. The 10 enforcers span asset management, engineering, healthcare, outsourcing, consumer goods and hospitality: enforcement is a choice each company makes, not a sector trait.

How the 162 operating companies grade out

We are not publishing a company-by-company table. Each firm's own result — its grade, DMARC policy and TLS posture — is held privately in our master workbook so that any company named at release has been given a right of reply first. This is the aggregate distribution.

Protection against impersonation (DMARC)

Published policy	Companies	Share	What it means
Enforced — reject	94	58%	Forged mail is rejected outright.
Enforced — quarantine	29	18%	Forged mail is sent to spam.
Monitor only (p=none)	32	20%	Reports failures but blocks nothing.
No DMARC policy	7	4%	Anyone can be impersonated; receivers have no instruction.
Could be impersonated today	39	24%	No enforced policy (monitor-only + none).

Encryption in transit (TLS enforcement)

Posture	Companies	Share
Enforced — insists inbound mail is encrypted	10	6%
Testing enforcement	7	4%
Opportunistic — provider default, can be stripped	145	90%

Cyber risk by sector: attacked vs defended

Email defence is one lens. Set it beside a second: how often each sector actually shows up in our global incident log. The gap between the two is where the attention should go.

Two lenses on the same question, side by side. Attacked: each sector's share of the 90 headline incidents in our three-year global log. Defended: how well the UK-listed companies in that sector protect their email (DMARC against impersonation, TLS enforcement in transit). The point is the gap between the two.

Read this carefully — the two columns are different measures. The attack count is a curated global sample, and it reflects what becomes visible (through disclosure rules and press coverage), not where risk is truly highest. The email-defence columns cover only UK-listed FTSE 250 operating companies, and only email — not a sector's overall security. Sectors from the two datasets are mapped to one shared set; some appear in only one lens (government and education have no FTSE 250 members; real estate and transport barely feature in the global log). Nothing here is a score of any one company.

Share of logged attacksEmail defence (DMARC enforced)

Sector	Attacks	Share	FTSE firms	·	DMARC enf.	TLS enf.	Read
Government & public	15	17%	–	–	no listed firms	–	Attacked, but no FTSE 250 members — mostly public sector.
Technology & software	14	16%	12		83%	–
Financial services	10	11%	24		92%	1	Attacked and well defended.
Healthcare & pharma	8	9%	6		67%	1	Gap: heavily attacked, email defence lagging.
Retail & consumer	7	8%	28		71%	1
Telecoms & media	7	8%	7		100%	–	Well defended.
Travel, leisure & hospitality	7	8%	11		73%	1
Energy, utilities & infrastructure	4	4%	11		45%	–	Weak email defence.
Education	5	6%	–	–	no listed firms	–	Attacked, but no FTSE 250 members — mostly public sector.
Manufacturing & industrials	3	3%	23		87%	3
Professional & support services	2	2%	8		100%	2	Well defended.
Transport & logistics	0	0%	5		60%	–	In the index, but not visible in the global incident log.
Real estate & construction	0	0%	26		58%	1	In the index, but not visible in the global incident log.
Other	8	9%	–	–	no listed firms	–	Attacked, but no FTSE 250 members — mostly public sector.

What stands out

Finance is attacked and ready. Financial services take 11% of logged attacks and are the best-defended group in the index (92% enforce DMARC) — regulation (the FCA) shows.
Healthcare and energy are the worrying gaps. Both are attacked and, when hit, the most disruptive — yet listed healthcare/pharma enforces DMARC on only 67%, and energy, utilities and mining on just 45%, the weakest of all.
Technology is the most-attacked private sector (16% of incidents) and defends reasonably (83%), but not as tightly as finance.
The most-attacked sector of all isn't a listed one. Government and public bodies take 17% of logged attacks and education another 6% — neither has FTSE 250 members, so the index can't see them. Worth saying plainly.
Well-defended, rarely in the headlines: manufacturing and industrials (87% DMARC, the most TLS enforcers) and telecoms and media (100%) defend well and appear less often in the log.
In the index but off the incident radar: real estate and construction (26 listed firms, only 58% enforce DMARC) and transport barely feature in the global log — a blind spot, not a clean bill of health.