We checked the public email set-up of 3,325 dental practice websites registered with the CQC in England, covering every region. These are the results. No practice is named.
When someone sends an email pretending to be a dental practice, the receiving mail server looks for a DMARC record to decide what to do with it. Only 10% of the practices we checked tell receivers to quarantine or reject those fakes. Another 29% have DMARC set to monitor only, which reports fakes but still delivers them, and 61% have no DMARC record at all.
That leaves 90% where a convincing fake email, sent to patients, staff or suppliers in the practice's own name, has a good chance of landing in the inbox. The gap was widest in North East (92%) and narrowest in South West (86%), but no region came close to being well protected.
Share of dental practice websites whose DMARC policy is missing, invalid or set to monitor only.
| Region | Websites checked | Could be impersonated | No DMARC | DMARC monitor only | DMARC enforced | All three protections |
|---|---|---|---|---|---|---|
| East Midlands | 254 | 90% | 67% | 23% | 10% | 8% |
| East of England | 335 | 91% | 63% | 28% | 9% | 5% |
| London | 746 | 91% | 58% | 32% | 9% | 6% |
| North East | 92 | 92% | 60% | 33% | 8% | 3% |
| North West | 345 | 89% | 59% | 30% | 11% | 5% |
| South East | 682 | 92% | 63% | 29% | 8% | 5% |
| South West | 352 | 86% | 57% | 29% | 14% | 10% |
| West Midlands | 280 | 91% | 59% | 32% | 9% | 7% |
| Yorkshire and the Humber | 238 | 92% | 70% | 21% | 8% | 5% |
| England | 3,325 | 90% | 61% | 29% | 10% | 6% |
Percentages are of practice websites checked in each region, rounded to the nearest whole number. One practice website with no region recorded in the CQC directory is included in the England total only. SPF was missing or broken for 6% of practices. Of the practices that receive email at their website domain, 41% use Microsoft 365. Our Yorkshire benchmark covers care homes, home care and GP practices too.
This is not a theoretical risk. Phishing is by far the most common cyber attack on UK businesses: 38% experienced it in the last year, and 12% had someone impersonate them in emails or online. An unprotected domain makes impersonation easy, because the fake arrives from your real address, with your name on it.
Here is what that can lead to for a practice or care provider, and for the people who trust it.
A fake "balance outstanding" or "deposit due" email with a payment link. It looks genuine because it comes from your address. The money is gone, and the complaint lands with you.
"We have changed our bank details." Invoice redirection is one of the most common frauds against small organisations, and the money is rarely recovered.
An email from "the practice manager" asking staff to sign in to check a document. One password can open email, files and patient records.
If personal data is exposed, you may need to report it to the ICO within 72 hours, tell the people affected, and record it in your DSPT. The CQC can ask what happened and what you have changed.
Cyber insurers increasingly ask about email security. Commissioners and the DSPT expect evidence of basic controls. A gap that was known and left open is hard to explain after an incident.
Gmail, Yahoo and Microsoft now expect senders to authenticate their email. Mail that fails these checks is more likely to be filtered as spam, including appointment reminders and results letters.
We are not saying this to alarm anyone. For most organisations it is under an hour of work for whoever manages your email, and it costs nothing.
Figures: UK Government (DSIT) Cyber Security Breaches Survey 2025/26, published April 2026. The National Cyber Security Centre recommends every organisation publishes SPF, DKIM and DMARC and moves DMARC to quarantine or reject.
Type in your website and we read the same public records used in this benchmark, then explain what we find in plain English. No email address needed, and nothing touches your systems.
Contains public sector information licensed under the Open Government Licence v3.0. Source: Care Quality Commission.
You are welcome to quote these figures with credit to Unavoidably Secure and a link to this page. For more detail, a regional breakdown or a comment from Andrew Heppinstall, email support@unavoidablysecure.com or call 07749 941111.
Unavoidably Secure (2026). England dental practice email security benchmark, October 2026. Unavoidable Studio Ltd. https://unavoidablysecure.com/benchmark/dental-england/
Download the data: regional totals as a CSV file (counts and percentages for each region, no practice names). Free to reuse with credit and a link.
Published 16 October 2026 by Andrew Heppinstall, founder of Unavoidably Secure.