What happens now that NCSC Mail Check has retired?

NCSC stopped DMARC aggregate reporting in Mail Check on 24 March 2025 and retired the service on 31 March 2026, naming no direct replacement. If your DMARC record still points at a Mail Check reporting address, nothing is being reported back to you about who is sending email as your domain. Your DMARC DNS policy (p=none, p=quarantine or p=reject) keeps working, because receiving servers enforce it independently of any reporting service. To restore visibility you move your RUA address to a commercial replacement, which NCSC recommended doing before retirement.

How do I migrate from NCSC Mail Check?

Migration is one DNS change. Create a ShieldMarc account and add your domain to get a unique RUA reporting address, then edit your DMARC TXT record to replace the Mail Check RUA address with the ShieldMarc one (you can keep both for a handover period since DMARC allows comma-separated RUA addresses). Aggregate reports from receiving servers start appearing in your dashboard within 24 to 48 hours. The whole process takes under 5 minutes.

What should UK councils do about DMARC after Mail Check retirement in March 2026?

UK councils, NHS trusts and other public sector bodies that relied on Mail Check should move their DMARC aggregate reporting to a commercial External Attack Surface Management or DMARC monitoring product, which is exactly what NCSC advised when it announced the retirement, ahead of Mail Check closing on 31 March 2026. Keep your existing DMARC policy in DNS unchanged so enforcement is uninterrupted, repoint the RUA address to your new provider, and continue the report-driven progression from p=none to p=quarantine to p=reject as the evidence supports it. ShieldMarc is UK based with EU-hosted infrastructure by default and dedicated UK-hosted environments available on request, plus subdomain policy detection that matters for the large estates councils typically run.

Why did NCSC retire Mail Check?

NCSC's published rationale is that there is now a wide commercial market for External Attack Surface Management products that cover what Mail Check and Web Check provided, plus additional features. The NCSC announcement recommends transitioning to a commercial EASM product before retirement and points to its EASM buyer's guide. NCSC has refocused its own work on areas where commercial alternatives are not yet available.

Is my DMARC policy still working?

Yes. Your DMARC policy (p=reject, p=quarantine, etc.) is a DNS record that receiving servers enforce independently. It continues working. What stopped is the reporting: NCSC stopped DMARC aggregate reporting on 24 March 2025, before Mail Check retired on 31 March 2026. You no longer receive aggregate reports telling you what is happening with your email authentication.

How long does migration take?

Under 5 minutes. You create an account, add your domain, and update the RUA address in your DMARC DNS record. Reports typically start arriving within 24 to 48 hours.

Yes, the Starter plan is free and includes 1 domain with 10,000 messages per month and threat-model analysis (deep AI review is reserved for paid plans). For organisations managing multiple domains, Professional (25 domains) and MSP (100+ domains) plans are available.

Where is ShieldMarc hosted?

ShieldMarc is UK based. Core infrastructure, databases and monitoring pipelines are hosted in the EU under GDPR and UK data protection law. Optional AI-assisted features, when you invoke them, route to third-party LLM providers in the US under no-training API terms. For enterprise and public sector customers with strict residency requirements we offer dedicated UK-hosted environments on request as part of a custom plan; EU-only AI routing is not offered today. See our Trust page for the full list.

Can I keep my existing RUA address alongside ShieldMarc?

Yes. DMARC supports multiple RUA addresses separated by commas. You can add ShieldMarc alongside any other reporting address. Since Mail Check has retired you can safely remove its RUA address at the same time.

What happens if our message volume spikes and we go over the plan limit?

Nothing breaks. Reports keep parsing, dashboards stay live, alerts keep firing. We do not charge overage fees and we never silently drop data. The MSP plan already includes 5 million DMARC messages per month, so most organisations never come close. If you are consistently over for three months in a row, a sales contact reaches out to discuss an expansion bucket (an extra 50 domain slots and 5 million extra messages for £40 per month). Your invoice never changes without a conversation first.

NCSC Mail Check retired 31 March 2026

Migrate from NCSC Mail Check

NCSC stopped DMARC aggregate reporting in Mail Check on 24 March 2025 and retired the service on 31 March 2026. Reports still sent to its address are accepted, but nothing reports back to you. To keep your visibility, move your DMARC RUA address to a commercial replacement: create a ShieldMarc account, point your DMARC record at the new reporting address, and reports resume within 24 to 48 hours. ShieldMarc is a UK-built domain security platform designed as a direct replacement: DMARC monitoring plus the SSL, DNS, uptime and lookalike coverage Mail Check never offered. Migration takes under 5 minutes.

NCSC retired Mail Check (and Web Check) because a wide commercial market for External Attack Surface Management now covers what the services provided. See the official NCSC announcement for the published rationale.

Mail Check no longer reports back to you

Mail Check closed on 31 March 2026. Its address still accepts your DMARC reports, but nothing reports back to you. Your DMARC policy still works; what you have lost is the view of who sends email as your domain and whether your authentication passes. Pointing your reports at a monitoring service gives you that view back.

ShieldMarc vs NCSC Mail Check

Everything Mail Check did, plus the features NCSC said commercial tools do better.

Feature	NCSC Mail Check	ShieldMarc
DMARC aggregate report parsing
Human-readable dashboards
SPF & DKIM validation
Subdomain policy (sp=) detection
Threat scoring, with AI review on paid plans
SSL/TLS certificate monitoring
DNS, DNSSEC & CAA monitoring
MTA-STS & TLS-RPT monitoring
Domain expiry & WHOIS monitoring
Uptime monitoring
Lookalike domain detection
Remediation tasks you can act on
Scheduled email reports
Security Grade score
UK based, EU-hosted infrastructure
Free tier available

Migrate in 3 steps

Create your free account

Update your DMARC record

Replace the NCSC Mail Check RUA address in your DNS with the ShieldMarc address. One DNS TXT record change.

Reports start flowing

Within 24 to 48 hours, DMARC aggregate reports from receiving servers appear in your ShieldMarc dashboard.

What changed when Mail Check retired, and what to do now

Mail Check closed in two stages, a year apart. NCSC ended its DMARC aggregate reporting on 24 March 2025, then retired Mail Check and Web Check on 31 March 2026. Your DMARC policy kept working throughout, because receiving servers apply it. What stopped is the reporting.

Date	What changed
14 November 2024	NCSC announced in its MyNCSC help centre that Mail Check would stop DMARC aggregate reporting.
24 March 2025	DMARC aggregate reporting in Mail Check stopped. The reporting address still accepts reports, but nothing reports back to you.
31 March 2026	Mail Check and Web Check retired. NCSC users no longer receive findings from either service.

What NCSC still offers

Early Warning and DNS Check continue through your MyNCSC account, but neither replaces DMARC aggregate reporting. NCSC's free Check your cyber security service includes an Email Security Check for one domain at a time. It tells you whether a domain is configured correctly today, not who sent mail as it this week.

Find the records that still name Mail Check

Mail Check addresses turn up in two records: DMARC, and TLS-RPT, the record that asks sending servers to report when they could not deliver to you over an encrypted connection. Look for any address at dmarc.service.gov.uk or ending in mailcheck.service.ncsc.gov.uk.

DMARC, at _dmarc.example.com: usually dmarc-rua@dmarc.service.gov.uk, sometimes an address of your own at dmarc-rua.mailcheck.service.ncsc.gov.uk, and dmarc-ruf@dmarc.service.gov.uk in ruf=. These addresses still accept reports, but nothing reports back to you.
TLS-RPT, at _smtp._tls.example.com: tls-rua@mailcheck.service.ncsc.gov.uk. That domain had no MX record when we checked on 9 October 2026, so these reports are probably not being delivered at all. Our TLS-RPT Checker flags this address.

A migration checklist for each domain

List every domain. Include parked, alias and legacy domains as well as the ones you registered in Mail Check.
Record where each one stands. Run it through the DMARC Checker and note the DMARC policy, where rua= sends reports, the SPF lookup count and which DKIM keys it finds.
Choose a monitoring provider that processes aggregate reports, tracks SPF and DKIM alignment, alerts you when a record changes, and covers all of your domains.
Replace the Mail Check address. Replace only the Mail Check addresses, in ruf= too if it names one, and keep your policy as it is, for example:
```
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com
```
DMARC accepts several addresses separated by commas, so you can list the old and new addresses together during a handover.
Fix TLS reporting too. If your TLS-RPT record names the Mail Check address, point its rua= at a mailbox you monitor.
Check the change. Run the DMARC Checker again to confirm the new address is live. The first reports typically arrive within 24 to 48 hours, and the DMARC Report Viewer reads them in your browser without uploading them.
Lock down domains that send no mail. Publish v=spf1 -all as the SPF record and v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com as the DMARC record. The DMARC Generator builds the record for you.
Set a monthly reminder to review your DMARC reports.

If you look after domains for clients

Clients who relied on Mail Check may still assume someone is watching their domain. Nothing reports back to them now, so contact any client whose DMARC or TLS-RPT record still names a Mail Check address. Our guide to running DMARC as a managed service covers how to operate it across a client base.

NHS, public sector, and local authorities

ShieldMarc is UK based, with EU-hosted infrastructure. For public sector and enterprise customers requiring UK data residency, we offer dedicated UK-hosted environments on request. We understand the specific challenges facing organisations that were on Mail Check, including managing hundreds of subdomains, compliance requirements, and limited IT resource. We offer dedicated onboarding support and volume pricing for public sector customers. NCSC advised public sector bodies to transition to a commercial product before retirement; its retirement announcement sets out the reasoning, and DMARC itself was defined in RFC 7489, the original DMARC specification, obsoleted in May 2026 by DMARCbis (RFC 9989).

How far the rest of the sector has actually got since then is public: our UK public sector DMARC tracker re-measures every domain in the official .gov.uk register every hour, so you can look up where your own domain stands before you talk to us.

Selling into the public sector rather than working in it? The Cyber Essentials certificate your tenders ask for does not cover email authentication at all: its requirements document never mentions DMARC, SPF or DKIM. Our guide to the NCSC and Cyber Essentials email security requirements for suppliers sets out which NCSC guidance the email questions really come from and what PPN 014 obliges buyers to ask for. Organisations outside the public sector can start from the DMARC services for UK organisations page instead, which covers the same service without the procurement framing.

Start seeing your DMARC reports again

Start your free account today: the change takes minutes, and reports arrive within 24 to 48 hours.

Get started free Check your DMARC record

Free tier includes 1 domain and 10,000 messages/month. No credit card required.

Frequently asked questions

What happens now that NCSC Mail Check has retired?: NCSC stopped DMARC aggregate reporting in Mail Check on 24 March 2025 and retired the service on 31 March 2026, naming no direct replacement. If your DMARC record still points at a Mail Check reporting address, nothing is being reported back to you about who is sending email as your domain. Your DMARC DNS policy (p=none, p=quarantine or p=reject) keeps working, because receiving servers enforce it independently of any reporting service. To restore visibility you move your RUA address to a commercial replacement, which NCSC recommended doing before retirement.
How do I migrate from NCSC Mail Check?: Migration is one DNS change. Create a ShieldMarc account and add your domain to get a unique RUA reporting address, then edit your DMARC TXT record to replace the Mail Check RUA address with the ShieldMarc one (you can keep both for a handover period since DMARC allows comma-separated RUA addresses). Aggregate reports from receiving servers start appearing in your dashboard within 24 to 48 hours. The whole process takes under 5 minutes.
What should UK councils do about DMARC after Mail Check retirement in March 2026?: UK councils, NHS trusts and other public sector bodies that relied on Mail Check should move their DMARC aggregate reporting to a commercial External Attack Surface Management or DMARC monitoring product, which is exactly what NCSC advised when it announced the retirement, ahead of Mail Check closing on 31 March 2026. Keep your existing DMARC policy in DNS unchanged so enforcement is uninterrupted, repoint the RUA address to your new provider, and continue the report-driven progression from p=none to p=quarantine to p=reject as the evidence supports it. ShieldMarc is UK based with EU-hosted infrastructure by default and dedicated UK-hosted environments available on request, plus subdomain policy detection that matters for the large estates councils typically run.
Why did NCSC retire Mail Check?: NCSC's published rationale is that there is now a wide commercial market for External Attack Surface Management products that cover what Mail Check and Web Check provided, plus additional features. The NCSC announcement recommends transitioning to a commercial EASM product before retirement and points to its EASM buyer's guide. NCSC has refocused its own work on areas where commercial alternatives are not yet available.
Is my DMARC policy still working?: Yes. Your DMARC policy (p=reject, p=quarantine, etc.) is a DNS record that receiving servers enforce independently. It continues working. What stopped is the reporting: NCSC stopped DMARC aggregate reporting on 24 March 2025, before Mail Check retired on 31 March 2026. You no longer receive aggregate reports telling you what is happening with your email authentication.
How long does migration take?: Under 5 minutes. You create an account, add your domain, and update the RUA address in your DMARC DNS record. Reports typically start arriving within 24 to 48 hours.
Is ShieldMarc free?: Yes, the Starter plan is free and includes 1 domain with 10,000 messages per month and threat-model analysis (deep AI review is reserved for paid plans). For organisations managing multiple domains, Professional (25 domains) and MSP (100+ domains) plans are available.
Where is ShieldMarc hosted?: ShieldMarc is UK based. Core infrastructure, databases and monitoring pipelines are hosted in the EU under GDPR and UK data protection law. Optional AI-assisted features, when you invoke them, route to third-party LLM providers in the US under no-training API terms. For enterprise and public sector customers with strict residency requirements we offer dedicated UK-hosted environments on request as part of a custom plan; EU-only AI routing is not offered today. See our Trust page for the full list.
Can I keep my existing RUA address alongside ShieldMarc?: Yes. DMARC supports multiple RUA addresses separated by commas. You can add ShieldMarc alongside any other reporting address. Since Mail Check has retired you can safely remove its RUA address at the same time.
What happens if our message volume spikes and we go over the plan limit?: Nothing breaks. Reports keep parsing, dashboards stay live, alerts keep firing. We do not charge overage fees and we never silently drop data. The MSP plan already includes 5 million DMARC messages per month, so most organisations never come close. If you are consistently over for three months in a row, a sales contact reaches out to discuss an expansion bucket (an extra 50 domain slots and 5 million extra messages for £40 per month). Your invoice never changes without a conversation first.