Why did NCSC retire Mail Check?

NCSC's published rationale is that there is now a wide commercial market for External Attack Surface Management products that cover what Mail Check and Web Check provided, plus additional features. The NCSC announcement recommends transitioning to a commercial EASM product before retirement and points to its EASM buyer's guide. NCSC has refocused its own work on areas where commercial alternatives are not yet available.

Is my DMARC policy still working?

Yes. Your DMARC policy (p=reject, p=quarantine, etc.) is a DNS record that receiving servers enforce independently. It continues working. What stopped on 31 March 2026 is the reporting; you no longer receive aggregate reports telling you what is happening with your email authentication.

How long does migration take?

Under 5 minutes. You create an account, add your domain, and update the RUA address in your DMARC DNS record. Reports typically start arriving within 24 to 48 hours.

Yes, the Starter plan is free and includes 1 domain with 10,000 messages per month and AI threat analysis. For organisations managing multiple domains, Professional (25 domains) and MSP (100+ domains) plans are available.

Where is ShieldMarc hosted?

ShieldMarc is UK based. Core infrastructure, databases and monitoring pipelines are hosted in the EU under GDPR and UK data protection law. Optional AI-assisted features, when you invoke them, route to third-party LLM providers in the US under no-training API terms. For enterprise and public sector customers with strict residency requirements we offer dedicated UK-hosted environments and EU AI routing on request as part of a custom plan. See our Trust page for the full list.

Can I keep my existing RUA address alongside ShieldMarc?

Yes. DMARC supports multiple RUA addresses separated by commas. You can add ShieldMarc alongside any other reporting address. Since Mail Check has retired you can safely remove its RUA address at the same time.

What happens if our message volume spikes and we go over the plan limit?

Nothing breaks. Reports keep parsing, dashboards stay live, alerts keep firing. We do not charge overage fees and we never silently drop data. The MSP plan already includes 20 million authenticated messages per month, which is industry-leading volume, so most organisations never come close. If you are consistently over for three months in a row, a sales contact reaches out to discuss an expansion bucket (an extra 50 domain slots and 5 million extra messages for £39.99 per month). Your invoice never changes without a conversation first.

NCSC Mail Check retired 31 March 2026

Migrate from NCSC Mail Check

NCSC retired Mail Check on 31 March 2026, citing the breadth of commercial External Attack Surface Management products now available (verified against the NCSC announcement, May 2026). ShieldMarc is a UK-built DMARC monitoring platform designed as a direct replacement. If you have not moved yet, your aggregate reports are already going nowhere. Migrate in under 5 minutes.

You are currently flying blind

With Mail Check retired, any RUA reports still pointing at it are being dropped on the floor. You have no visibility into who is sending email as your domain, whether your authentication is working, or whether spoofing campaigns are targeting you. Your DMARC policy is still live, but you can no longer see what it is enforcing against.

ShieldMarc vs NCSC Mail Check

Everything Mail Check did, plus the features NCSC said commercial tools do better.

Feature	NCSC Mail Check	ShieldMarc
DMARC aggregate report parsing
Human-readable dashboards
SPF & DKIM validation
Subdomain policy (sp=) detection
AI-powered threat classification
SSL/TLS certificate monitoring
DNS, DNSSEC & CAA monitoring
MTA-STS & TLS-RPT monitoring
Domain expiry & WHOIS monitoring
Uptime monitoring
Lookalike domain detection
Actionable remediation tasks
Scheduled email reports
Security Grade score
UK based, EU-hosted infrastructure
Free tier available

Migrate in 3 steps

Create your free account

Update your DMARC record

Replace the NCSC Mail Check RUA address in your DNS with the ShieldMarc address. One DNS TXT record change.

Reports start flowing

Within 24 to 48 hours, DMARC aggregate reports from receiving servers appear in your ShieldMarc dashboard.

NHS, public sector, and local authorities

ShieldMarc is UK based, with EU-hosted infrastructure. For public sector and enterprise customers requiring UK data residency, we offer dedicated UK-hosted environments on request. We understand the specific challenges facing organisations that were on Mail Check, including managing hundreds of subdomains, compliance requirements, and limited IT resource. We offer dedicated onboarding support and volume pricing for public sector customers.

Don't spend another week without DMARC visibility

Start your free account today and restore your DMARC monitoring in an afternoon.

Get started free Check your DMARC record

Free tier includes 1 domain and 10,000 messages/month. No credit card required.

Frequently asked questions

Why did NCSC retire Mail Check?: NCSC's published rationale is that there is now a wide commercial market for External Attack Surface Management products that cover what Mail Check and Web Check provided, plus additional features. The NCSC announcement recommends transitioning to a commercial EASM product before retirement and points to its EASM buyer's guide. NCSC has refocused its own work on areas where commercial alternatives are not yet available.
Is my DMARC policy still working?: Yes. Your DMARC policy (p=reject, p=quarantine, etc.) is a DNS record that receiving servers enforce independently. It continues working. What stopped on 31 March 2026 is the reporting; you no longer receive aggregate reports telling you what is happening with your email authentication.
How long does migration take?: Under 5 minutes. You create an account, add your domain, and update the RUA address in your DMARC DNS record. Reports typically start arriving within 24 to 48 hours.
Is ShieldMarc free?: Yes, the Starter plan is free and includes 1 domain with 10,000 messages per month and AI threat analysis. For organisations managing multiple domains, Professional (25 domains) and MSP (100+ domains) plans are available.
Where is ShieldMarc hosted?: ShieldMarc is UK based. Core infrastructure, databases and monitoring pipelines are hosted in the EU under GDPR and UK data protection law. Optional AI-assisted features, when you invoke them, route to third-party LLM providers in the US under no-training API terms. For enterprise and public sector customers with strict residency requirements we offer dedicated UK-hosted environments and EU AI routing on request as part of a custom plan. See our Trust page for the full list.
Can I keep my existing RUA address alongside ShieldMarc?: Yes. DMARC supports multiple RUA addresses separated by commas. You can add ShieldMarc alongside any other reporting address. Since Mail Check has retired you can safely remove its RUA address at the same time.
What happens if our message volume spikes and we go over the plan limit?: Nothing breaks. Reports keep parsing, dashboards stay live, alerts keep firing. We do not charge overage fees and we never silently drop data. The MSP plan already includes 20 million authenticated messages per month, which is industry-leading volume, so most organisations never come close. If you are consistently over for three months in a row, a sales contact reaches out to discuss an expansion bucket (an extra 50 domain slots and 5 million extra messages for £39.99 per month). Your invoice never changes without a conversation first.