DMARC monitoring for UK organisations, billed in pounds.

What the NCSC tells UK organisations about DMARC

The National Cyber Security Centre's Email security and anti-spoofing guidance tells organisations to implement SPF, DKIM, and DMARC on all of their domains, including domains hosted on common cloud email providers. It recommends starting with a DMARC policy of p=none — explicitly described as a monitoring phase — and applying DMARC gradually, iterating the configuration over time. Within 24 hours of publishing your records, reports from major recipient domains start arriving.

For government itself the bar is firmer: the GOV.UK guidance on setting up government email services securely states that DMARC policies must be in place, published at p=none and rising to p=quarantine or p=reject during implementation.

Mail Check is retired — bring your own monitoring

The NCSC retired Mail Check (and Web Check) on 31 March 2026, after removing its key reporting features in March 2025. Its stated reason: the commercial market now covers and extends what the services did, and the NCSC only delivers solutions where the market cannot. Its lighter replacement, the Check your cyber security service, runs point-in-time checks — it does not collect or analyse your DMARC aggregate reports.

That continuous-monitoring role is exactly what DMARCTrust does: a dedicated reporting address for your rua= tag, automatic parsing of every report, per-source alignment breakdowns, and alerts when your DNS records change or failures spike.

Frequently asked questions

Is DMARC a legal requirement in the UK?

No UK law requires private-sector organisations to publish a DMARC record. UK government email services must implement DMARC under the GOV.UK secure email guidance, starting at p=none and rising to quarantine or reject. For everyone else the pressure is commercial: Google and Microsoft now require DMARC from bulk senders, and the NCSC recommends it for every organisation.

Is DMARC required for Cyber Essentials?

No. The Cyber Essentials v3.2 (Willow) requirements cover five technical controls: firewalls, secure configuration, security update management, user access control, and malware protection. DMARC is not one of them. The NCSC recommends SPF, DKIM, and DMARC in its separate email security and anti-spoofing guidance, so DMARC complements a Cyber Essentials certification rather than being part of it.

What happened to NCSC Mail Check?

The NCSC retired Mail Check (and Web Check) on 31 March 2026, saying the commercial market now covers and extends what the services did. Key reporting features had already been removed in March 2025. The NCSC now points organisations to commercial tooling and to its lighter-weight Check your cyber security service, which runs one-off checks rather than continuous DMARC report monitoring.

Does DMARCTrust bill in pounds?

Yes. UK customers are billed in GBP: Starter is £13.90 per month for 2 domains, Pro is £35.90 per month for 5 domains, and extra domains are £9 per month each. Annual billing gives you 2 months free.

Where is my data stored?

You choose a preferred data region, European Union or United States, when you register, and you can change it later in your account settings. That choice covers the storage of your account data and supports GDPR and UK GDPR data-residency requirements.

Is DMARC monitoring free?

Yes, for 1 domain. The free plan includes your dedicated reporting address, automatic XML parsing, the dashboard, and basic DNS status checks, with 7 days of detail retention plus a 2-day grace period. Paid plans add more domains, longer retention, failure reports, and DNS change alerts.

Do I need to give DMARCTrust access to my mailbox?

No. You publish our reporting address as your DMARC rua tag. Mail providers send reports to us directly. We never touch your existing mailbox.