NCSC Mail Check Retired: What UK Businesses Must Do on DMARC

The UK's National Cyber Security Centre (NCSC) retired its free Mail Check and Web Check services on 31 March 2026, ending the findings that public-sector and other eligible organisations relied on to monitor email authentication. The change, announced on 6 November 2025, leaves organisations to monitor their own DMARC, SPF and TLS settings, at a time when the government's Cyber Security Breaches Survey 2025/2026 still ranks phishing as by far the most common attack on UK businesses.

What happened

In a blog post published on 6 November 2025, the NCSC said it would retire Web Check and Mail Check because the market for external attack surface management (EASM) products had matured. It said "the NCSC will only deliver solutions where the cyber security market is unable to", and that commercial products now offer what the two services did, and more.

From 31 March 2026, Mail Check and Web Check users no longer receive findings from those services. Organisations subscribed to the NCSC's Early Warning and DNS Check services continue to receive findings through their MyNCSC accounts.

The NCSC "strongly recommend[s] that organisations implement a commercial EASM product" to replace the retired services, and has published an EASM buyer's guide. For email anti-spoofing and email privacy, it points organisations to its free Check your cyber security service, which includes an email security check of DMARC and TLS settings using publicly available DNS information.

The threat has not gone away

The government's Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, found that:

• 43% of UK businesses and 28% of charities reported a cyber security breach or attack in the previous 12 months;
• phishing "remained the most prevalent type of breach or attack by far", affecting 38% of all businesses and 25% of all charities;
• 69% of organisations that had a breach or attack said phishing was the most disruptive type;
• impersonation attacks on businesses fell to 12%, down from 17% in 2023.

DMARC cannot stop every phishing email, but it is the main technical control that stops criminals sending email that appears to come from your own domain. Published, verified figures on UK-wide DMARC adoption are scarce: the survey does not measure it, and we have not found an authoritative 2025-2026 UK figure, so we have not quoted one here.

What the NCSC still recommends

The NCSC's email security and anti-spoofing guidance remains in place. It recommends a phased approach ending in a DMARC policy of reject:

• start with p=none to collect reports;
• move to p=quarantine once SPF and DKIM are working;
• move to p=reject, starting with a percentage of mail using the pct tag and increasing gradually, while closely monitoring reports for at least two weeks after each change.

The NCSC says "having a DMARC policy of 'reject' on all of your domains" is the best way to prevent spoofing, and that many organisations move from quarantine to reject after about three months.

For parked domains that never send email, its guidance is to publish v=spf1 -all, a DMARC reject policy with a reporting address, a null MX record and, optionally, a wildcard null DKIM key.

What this means for UK businesses

Most UK small businesses never used Mail Check, which was aimed largely at the public sector. But the retirement matters in two ways.

First, councils, schools, NHS bodies, housing associations and charities that relied on Mail Check alerts now need their own monitoring. Some older GOV.UK guidance still refers to Mail Check reporting addresses, so it is worth checking where your DMARC and TLS-RPT reports actually go.

Second, the NCSC has said plainly that this kind of monitoring is now a job for the market. Combined with Google, Yahoo and Microsoft filtering or rejecting unauthenticated bulk mail (see our Outlook and Gmail sender rules update), email authentication is both a security control and a condition of email deliverability in the UK.

What to do now

1. Check your domain today. Run the MakeItFlow DMARC checker, SPF checker and DKIM checker, or the NCSC's free Check your cyber security service.
2. Review your reporting addresses. If your DMARC rua or TLS-RPT _smtp._tls record points to an NCSC Mail Check address, confirm with your supplier or the NCSC whether reports are still being processed, and add an address you or a DMARC reporting tool can read. Our guide to reading DMARC reports explains the format.
3. Move towards p=reject. Use the DMARC record generator to build each stage, and follow the NCSC's percentage-based rollout.
4. Protect parked domains. Apply the NCSC's four-step pattern to domains you own but do not use for email. The SPF record generator can produce v=spf1 -all.
5. Add MTA-STS and TLS-RPT. These protect mail in transit and report delivery problems. See our MTA-STS and TLS-RPT guide.
6. Schedule regular checks. A free website audit on MakeItFlow checks SPF, DKIM, DMARC, MTA-STS and BIMI, plus DNSSEC, TLS and security headers. Paid plans add scheduled re-scans and history, so you are alerted if a DNS change weakens your setup; agencies can use bulk scans and white-label PDFs for client estates.

Frequently asked questions

Does the Mail Check retirement change the law or any requirement?

No. It ends a free NCSC monitoring service. The NCSC's guidance on email security, including its recommendation of DMARC reject, still stands, and public-sector bodies should continue to follow GOV.UK's email security guidance.

Is there still a free NCSC tool for checking email security?

Yes. The NCSC's Check your cyber security service includes an email security check that looks at anti-spoofing (such as DMARC) and whether TLS is in place, using public DNS information.

We are a small business. Do we really need DMARC?

Yes. Without DMARC, anyone can send email that claims to come from your domain, and major mailbox providers increasingly expect it. Starting with p=none costs nothing and gives you visibility within days. Our DMARC explainer walks through the setup.

Sources

• NCSC: NCSC to retire Web Check and Mail Check (6 November 2025)
• GOV.UK: Cyber security breaches survey 2025/2026 (30 April 2026)
• NCSC: Email security and anti-spoofing, reject spoof emails
• NCSC: Protecting parked domains for the UK public sector
• NCSC: New email security tool launched to help organisations check their defences
• GOV.UK: Set up government email services securely