NHS
Understanding the Security Status
quarantine or reject, effectively blocking or flagging unauthorized emails as mandated in the Payment Card Industry Data Security Standard (PCI DSS).none (monitoring mode only), which does not stop spoofing attempts.DMARC records are cached and refreshed periodically. The logic has been updated in line with RFC 9989, published in May 2026, and now uses DNS Tree Walk.
Background
Email migrated from @nhs.net to @nhs.scot in 2021 for £2.5M as per FOI.
The question then needs to be asked: why don’t ALL other NHS domain names have DMARC records defined to effectively prohibit their use and thereby minimise their potential for fraud/misuse?
Is there any concept of IT Governance within the NHS? Because there doesn’t appear to be. Remember, most data breaches start with an email; therefore, DMARC should be seen as the first line of defence.
Old email domain for NHS Scotland
nhs.net →
v=DMARC1; p=reject;pct=100;rua=mailto:8376428f@mxtoolbox.dmarc-report.com;ruf=mailto:postmaster@nhs.net,mailto:8376428f@forensics.dmarc-report.comNew email domain for NHS Scotland
nhs.scot →
v=DMARC1; p=reject; fo=1; rua=mailto:rua+nhs.scot@dmarc.barracudanetworks.com; ruf=mailto:ruf+nhs.scot@dmarc.barracudanetworks.com; sp=none; pct=100
Corporate Governance
There are two domains I’m aware of relating to cybersecurity and governance for NHS Scotland.
This domain is described as Cyber Security and Technical Assurance.
One of their key responsibilities is described as:
- ‘Providing expertise on information governance, assurance and cyber security.’
informationgovernance.scot.nhs.uk →
v=DMARC1; p=reject; sp=none;adkim=s;aspf=s;fo=1; rua=mailto:A-NE.postmaster@nhs.net,mailto:dmarc-rua@dmarc.service.gov.ukThis domain appears to be the overarching corporate governance framework for managing all risks related to the confidentiality, integrity, and availability of all types of written, spoken, and computer information.
It’s good that the email domain has been standardised across the Scottish NHS. This strong identity isn’t just for branding; it also enhances security by helping people identify which domains to trust. The domain names for the 14 NHS Boards are inconsistent. One being xx.net, one xx.co.uk, some xx.scot.nhs.uk, some xx.com, some xx.scot and even a couple xx.org
Not only have the individual boards failed to maintain consistent naming standards, but they have also failed to implement adequate DMARC protection for those domain names.
NHS Scotland has 14 regional NHS Boards
Ayrshire & Arran
Borders
nhsborders.scot.nhs.uk →
v=DMARC1; p=reject; sp=none;adkim=s;aspf=s;fo=1; rua=mailto:A-NE.postmaster@nhs.net,mailto:dmarc-rua@dmarc.service.gov.ukDumfries & Galloway
Fife
nhsfife.org →
v=DMARC1; p=quarantine; rua=mailto:dmarc@nhsfife.org; ruf=mailto:dmarc@nhsfife.org; fo=1; pct=50; adkim=s; aspf=sForth Valley
Grampian
nhsgrampian.org →
v=DMARC1; p=reject; rua=mailto:gram.web@nhs.scot; ruf=mailto:gram.web@nhs.scot; fo=1Greater Glasgow & Clyde
nhsggc.scot →
v=DMARC1;p=reject;pct=100;rua=mailto:ggc.webteam@nhs.scot;ruf=mailto:ggc.webteam@nhs.scotHighland
nhshighland.scot.nhs.uk →
v=DMARC1; p=reject; sp=none;adkim=s;aspf=s;fo=1; rua=mailto:A-NE.postmaster@nhs.net,mailto:dmarc-rua@dmarc.service.gov.ukLanarkshire
nhslanarkshire.scot.nhs.uk →
v=DMARC1; p=reject; sp=none;adkim=s;aspf=s;fo=1; rua=mailto:A-NE.postmaster@nhs.net,mailto:dmarc-rua@dmarc.service.gov.ukLothian
Orkney
ohb.scot.nhs.uk →
v=DMARC1; p=reject; pct=100; rua=mailto:dmarc-reports@ohb.scot.nhs.uk; ruf=mailto:dmarc-forensics@ohb.scot.nhs.uk; fo=1; adkim=s; aspf=s; sp=rejectShetland
nhsshetland.scot →
v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s;Tayside
nhstayside.scot.nhs.uk →
v=DMARC1; p=reject; sp=none;adkim=s;aspf=s;fo=1; rua=mailto:A-NE.postmaster@nhs.net,mailto:dmarc-rua@dmarc.service.gov.ukWestern Isles
wihb.scot.nhs.uk →
v=DMARC1; p=reject; pct=100; rua=mailto:wi.dmarcreports@nhs.scot; ruf=mailto:wi.dmarcreports@nhs.scot; fo=1; adkim=s; aspf=s; sp=reject
NHS Scotland also has some Special NHS Boards
Public Health Scotland
publichealthscotland.scot →
v=DMARC1; p=quarantine; rua=mailto:postmaster@publichealthscotland.scot; adkim=s; aspf=sphs.scot →
v=DMARC1;p=reject;rua=mailto:Q9mW81Ps5zu@dmarc-rua.mailcheck.service.ncsc.gov.uk;Healthcare Improvement Scotland
healthcareimprovementscotland.scot →
v=DMARC1; p=none;NHS Education for Scotland
nes.scot.nhs.uk →
v=DMARC1; p=quarantine; rua=mailto:dmarc-rua@dmarc.service.gov.ukNHS National Waiting Times Centre
NHS 24
nhs24.scot →
v=DMARC1; p=quarantine; pct=100; fo=1; ri=3600; rua=mailto:a1adc113@inbox.ondmarc.com,mailto:JSJNXDoBqYu@dmarc-rua.mailcheck.service.ncsc.gov.uk; ruf=mailto:a1adc113@inbox.ondmarc.comScottish Ambulance Service
scottishambulance.com →
v=DMARC1; p=reject; aspf=s;The State Hospitals Board for Scotland
tsh.scot.nhs.uk →
v=DMARC1; p=reject; sp=none;adkim=s;aspf=s;fo=1; rua=mailto:A-NE.postmaster@nhs.net,mailto:dmarc-rua@dmarc.service.gov.ukNHS National Services Scotland
nss.nhs.scot →
v=DMARC1; p=reject; fo=1; rua=mailto:rua+nhs.scot@dmarc.barracudanetworks.com; ruf=mailto:ruf+nhs.scot@dmarc.barracudanetworks.com; sp=none; pct=100
Other domains significant to NHS Scotland
High profile NHS website
nhsinform.scot →
v=DMARC1; p=reject; pct=100; fo=1; ri=3600; rua=mailto:a1adc113@inbox.ondmarc.com,mailto:JSJNXDoBqYu@dmarc-rua.mailcheck.service.ncsc.gov.uk; ruf=mailto:a1adc113@inbox.ondmarc.comGolden Jubilee National Hospital
gjnh.scot.nhs.uk →
v=DMARC1; p=reject; sp=none;adkim=s;aspf=s;fo=1; rua=mailto:A-NE.postmaster@nhs.net,mailto:dmarc-rua@dmarc.service.gov.ukNHS Research Scotland
nhsresearchscotland.org.uk →
v=DMARC1; p=rejectHealth Scotland – now superseded by Public Health Scotland website
Scottish National Blood Transfusion Service (SNBTS)
Some NHS Lanarkshire examples
Used on official headed paper printed letters from NHS Lanarkshire
Re-directs to the primary website address
Used for email addresses such as info@lanarkshire.scot.nhs.uk in printed leaflets
lanarkshire.scot.nhs.uk →
v=DMARC1; p=reject; sp=none;adkim=s;aspf=s;fo=1; rua=mailto:A-NE.postmaster@nhs.net,mailto:dmarc-rua@dmarc.service.gov.ukAppears to be the primary website address
nhslanarkshire.scot.nhs.uk →
v=DMARC1; p=reject; sp=none;adkim=s;aspf=s;fo=1; rua=mailto:A-NE.postmaster@nhs.net,mailto:dmarc-rua@dmarc.service.gov.uk
Other Government domains for comparison
Domain used for MP’s email addresses
parliament.uk →
v=DMARC1; p=quarantine; rua=mailto:e734592d5cde933@rep.dmarcanalyzer.com; ruf=mailto:e734592d5cde933@for.dmarcanalyzer.com; pct=100; sp=quarantine; fo=1;Domain used for MSP’s email addresses
parliament.scot →
v=DMARC1; p=reject; rua=mailto:aArJj2d6PP7@dmarc-rua.mailcheck.service.ncsc.gov.uk,mailto:dmarc@parliament.scot; ruf=mailto:ITSrvNetSupp@parliament.scot; fo=0:1:d:s; pct=100Domain used for Government email addresses such as the Cabinet Secretary for Health and Social Care
gov.scot →
v=DMARC1; p=reject; pct=100; sp=none; rua=mailto:0a819833@inbox.ondmarc.com,mailto:dmarc-rua@dmarc.service.gov.uk; ruf=mailto:0a819833@inbox.ondmarc.com,mailto:dmarc@gov.scot; adkim=r; aspf=r; fo=1; rf=afrf; ri=3600National Cyber Security Centre – yes, they do follow their own advice!
ncsc.gov.uk →
v=DMARC1;p=reject;adkim=s;aspf=s;rua=mailto:dmarc-rua@dmarc.service.gov.uk;
Hospice Care
Palliative Care Scotland
palliativecarescotland.org.uk →
Accord Hospice
accord.org.uk →
v=DMARC1; p=quarantine; rua=mailto:authreports@mcts.co.uk; ruf=mailto:authreports@mcts.co.uk; rf=afrf; fo=1; pct=100; adkim=r; aspf=rArdgowan Hospice
ardgowanhospice.org →
v=DMARC1; p=none;Ayrshire Hospice
ayrshirehospice.org →
v=DMARC1; p=none;Bethesda Hospice
Highland Hospice
highlandhospice.org.uk →
v=DMARC1; p=quarantine; rua=mailto:dmarc@highlandhospice.org.uk; ruf=mailto:dmarc@highlandhospice.org.uk; fo=1;Kilbryde Hospice
kilbrydehospice.org.uk →
v=DMARC1; p=quarantine; pct=100; fo=1; rua=mailto:security@kilbrydehospice.org.ukMarie Curie Hospice
mariecurie.org.uk →
v=DMARC1; p=reject; pct=100; rua=mailto:dmarc_agg@vali.email,mailto:itsecurityreports@mariecurie.org.uk; ruf=mailto:itsecurityreports@mariecurie.org.uk; fo=1St Andrew’s Hospice
st-andrews-hospice.com →
v=DMARC1; p=none; rua=mailto:998757dbd4a54adfa7995a83457d8b51@dmarc-reports.cloudflare.netSt Columba’s Hospice
stcolumbashospice.org.uk →
v=DMARC1; p=none;St Margaret of Scotland Hospice
smh.org.uk →
v=DMARC1; p=none; rua=mailto:dmarc-rua@dmarc.service.gov.uk;St Vincent’s Hospice
Strathcarron Hospice
strathcarronhospice.net →
Little wonder the NHS has been subjected to numerous data breaches given the obvious failings in IT governance.