Quick answer: in our October 2026 Yorkshire email security benchmark, 91% of the 243 dental practices we checked could be impersonated by email. Only 9% had a DMARC policy that tells receiving mail servers to block fakes, and just 5% had all three standard email protections in place. The fix usually takes under an hour and costs nothing.
Dental practices send a lot of email that patients trust: appointment confirmations, treatment plans, payment requests and recall reminders. That trust is exactly what makes an unprotected email domain valuable to a fraudster. This article explains what we found, what it could mean for a practice, and what to ask whoever manages your email.
What did we check, and what did we find?
We took every dental practice in Yorkshire and the Humber listed in the CQC’s public directory with a website, and read the public email records for each domain. Nothing was intrusive: these are the same records any mail server reads when it receives an email. Across the 243 dental practice websites:
- 69% had no DMARC record at all.
- 22% had DMARC set to monitor only, which reports fake emails but still delivers them.
- 9% had DMARC set to quarantine or reject, the settings that actually stop fakes.
- 5% had SPF, DKIM and an enforced DMARC policy all in place.
Dental practices came out worst of the four sectors we checked. Across all 1,337 healthcare and care providers the figure was 83%, and care homes did best at 73%.
What does “can be impersonated” actually mean?
Email was designed without any built-in check that the sender is who they say they are. Three DNS records fix that. SPF lists the servers allowed to send for your domain. DKIM adds a digital signature to each message. DMARC tells receiving servers what to do when a message fails those checks, and sends you reports.
Without an enforced DMARC policy, a criminal can send an email that shows your practice’s real address in the “From” line, and there is a good chance it reaches the inbox. Our plain-English guide to DMARC explains the three records in more detail.
What could a fake email from your practice lead to?
- Patients paying a criminal. A “balance outstanding” or “deposit for your treatment” email with a payment link looks completely genuine when it comes from your address.
- Staff handing over logins. An email that appears to come from the practice manager, asking a receptionist to sign in to view a document, can capture the password to your email or clinical systems.
- Supplier payments redirected. A message to your lab or supplier, or one apparently from them, saying bank details have changed. Our article on invoice redirection fraud covers this in detail.
- A reportable data breach. If patient data is exposed, you may need to report it to the ICO within 72 hours and record it in your DSPT.
- Your own emails going to spam. Gmail, Yahoo and Microsoft increasingly filter mail that fails these checks. See why appointment reminders end up in spam.
Phishing is by far the most common cyber attack on UK businesses. The government’s Cyber Security Breaches Survey 2025/26 found 38% of businesses experienced it in the last year, and 12% had someone impersonate them in emails or online.
How does this connect to the DSPT and Cyber Essentials?
The NHS Data Security and Protection Toolkit asks practices to show that the controls in their policies actually work, not just that the policies exist. Email security is part of protecting patient data and part of the evidence an assessor or commissioner may look for. The National Cyber Security Centre recommends every organisation publishes SPF, DKIM and DMARC and moves DMARC to quarantine or reject. If you are working towards Cyber Essentials, our guide to Cyber Essentials for dental practices covers the wider picture.
What to ask your IT provider this week
- Is DKIM switched on for our domain in Microsoft 365 or Google Workspace?
- Do we publish a DMARC record, and where do the reports go?
- When can we move DMARC from monitor to quarantine, and then to reject?
For most practices this is under an hour of work. If your website and email are run by different people, make sure both know before anything changes, so genuine mail from booking systems or newsletter tools is included in SPF first.
FAQs
Is my practice named in the benchmark?
No. We publish totals only and will never publish a named organisation’s results.
We use NHSmail. Does this still apply?
Yes, if your practice has its own website domain. Anyone can still send email pretending to be from that domain unless it has an enforced DMARC record, even if your staff use NHSmail day to day.
Will turning on DMARC stop our own emails?
Not if it is done in stages. Start at monitor, read the reports for two to four weeks, add any genuine senders you have missed, then move to quarantine and reject.
How can I check my own practice?
Use our free email security check. It reads the same public records and explains the result in plain English in a few seconds.
How we can help
Unavoidably Secure offers independent audits for dental practices, care providers and regulated small organisations. We check your website, cookies, email security and governance paperwork, and tell you plainly what to fix and who should fix it. We do not certify or guarantee compliance, and nothing in this article is legal advice. Read the full Yorkshire email security benchmark, or head back to the blog.
Is your practice in the 91%?
Run the free email check in seconds, or book a free external audit and we will look at your website, cookies and email security together.
Run the free email checkNeed help with this?
If you need support putting any of this right, contact us today. Tell us briefly what you need and Andrew will reply within one working day. Prefer to talk? Call 07749 941111.