Mail Check update

• The NCSC has made the decision to stop providing DMARC Aggregate Reporting on 24th March 2025.  
• Mail Check users requiring DMARC Aggregate Reporting will need to switch to an alternative tool.  
• This decision gives NCSC the opportunity to expand the Mail Check service to any UK organisation whilst significantly reducing cost and complexity. It also creates space to develop new services in the future.

Mail Check was one of the first Active Cyber Defence services to be built, with development starting back in 2017. Over the last 7 years, there has been fantastic progress in the adoption of DMARC across government, the public sector and wider industry enabled by Mail Check. We have also seen the commercial sector significantly mature and there are now many tools which offer similar functionality.  

In August, The NCSC Chief Technology Officer Ollie Whitehouse, and Director of National Resilience Jonathon Ellison blogged about the future of the Active Cyber Defence services. The NCSC will focus its efforts on where we can make a unique contribution, due to a gap in the commercial market, or where being part of GCHQ presents a unique opportunity to drive up resilience at scale. 

Mail Check will continue to automatically scan your email domains and alert for the following:  

• DMARC policy, policy strength and errors 
• SPF policy, and effectiveness and errors 
• MTA-STS policy, and policy strength and errors  
• Inbound TLS (e.g. certificate validity, encryption cyphers)   

Mail Check will no longer provide:  

• DMARC aggregate reporting, DMARC Insights and related DKIM Checks 
• TLS Reporting (TLS-RPT) 

See our help guide if you are unfamiliar with DMARC aggregate reporting.  

DMARC aggregate reporting remains a crucial step to understanding your email estate and preventing attackers from abusing your email domains. The following guidance will help you transition to an alternative provider:  

NCSC guidance on how to implement DMARC correctly, and how to choose an alternative tool: 

• NCSC guidance on how to implement DMARC correctly, and how to choose an alternative tool
• Email service provider guidance (Microsoft etc.). There may be free or subsidised solutions they can offer as part of an existing license. 
• GOV.UK Digital Marketplace listing alternative DMARC tools (for public sector users). 

Most alternative providers will offer a free trial, and this can run in parallel with your existing use of Mail Check. 

We will keep you updated and provide further guidance, but if you have any questions, please contact us at [email protected]