147 of 257 UK hospital websites do not enforce a policy against email being forged in their name

A message that appears to come from a hospital, about an appointment, a result or a payment, is likely to be acted on. 123 websites publish no record we could find and 24 only ask receiving systems to monitor. The policy covers the exact domain only, not lookalike domains. Do it carefully: list every legitimate sender first, then watch, then send to spam, then refuse.

The estate’s problem is that the middle sits low, not a tail of bad websites. The average full score is 65.1; 193 of 257 websites sit in the needs-improvement band and 31 reach the top.

The two lists differ in opposite directions. The private list enforces a policy more often (23 of 37, against 87 of 220 on the public list) but 33 of 37 rest on a single company for their domain records. The public list is spread across many suppliers but weaker on the control that stops impersonation.

Only 1 of 257 websites publishes signed answers about where its domain lives, and none of the 220 on the public list do. Most public-list websites sit under a shared NHS domain, where this protection depends on the parent domain being signed first, so this is largely a matter for the registry rather than for each organisation.