What happens now that NCSC Mail Check is retiring?

NCSC Mail Check retired on 31 March 2026. The reporting service has stopped, so DMARC aggregate (RUA) reports that still point at a Mail Check address are now being dropped and you have no visibility into who is sending email as your domain. Your DMARC DNS policy (p=none, p=quarantine or p=reject) keeps working because receiving servers enforce it independently. To restore reporting you move your RUA address to a commercial replacement, which NCSC recommended doing before retirement.

How do I migrate from NCSC Mail Check?

Migration is one DNS change. Create a ShieldMarc account and add your domain to get a unique RUA reporting address, then edit your DMARC TXT record to replace the Mail Check RUA address with the ShieldMarc one (you can keep both for a handover period since DMARC allows comma-separated RUA addresses). Aggregate reports from receiving servers start appearing in your dashboard within 24 to 48 hours. The whole process takes under 5 minutes.

What should UK councils do about DMARC after Mail Check retirement in March 2026?

UK councils, NHS trusts and other public sector bodies that relied on Mail Check should move their DMARC aggregate reporting to a commercial External Attack Surface Management or DMARC monitoring product, which is exactly what NCSC advised when it announced retirement on 31 March 2026. Keep your existing DMARC policy in DNS unchanged so enforcement is uninterrupted, repoint the RUA address to your new provider, and continue the report-driven progression from p=none to p=quarantine to p=reject as the evidence supports it. ShieldMarc is UK based with EU-hosted infrastructure by default and dedicated UK-hosted environments available on request, plus subdomain policy detection that matters for the large estates councils typically run.

Why did NCSC retire Mail Check?

NCSC's published rationale is that there is now a wide commercial market for External Attack Surface Management products that cover what Mail Check and Web Check provided, plus additional features. The NCSC announcement recommends transitioning to a commercial EASM product before retirement and points to its EASM buyer's guide. NCSC has refocused its own work on areas where commercial alternatives are not yet available.

Is my DMARC policy still working?

Yes. Your DMARC policy (p=reject, p=quarantine, etc.) is a DNS record that receiving servers enforce independently. It continues working. What stopped on 31 March 2026 is the reporting; you no longer receive aggregate reports telling you what is happening with your email authentication.

How long does migration take?

Under 5 minutes. You create an account, add your domain, and update the RUA address in your DMARC DNS record. Reports typically start arriving within 24 to 48 hours.

Yes, the Starter plan is free and includes 1 domain with 10,000 messages per month and threat-model analysis (deep AI review is reserved for paid plans). For organisations managing multiple domains, Professional (25 domains) and MSP (100+ domains) plans are available.

Where is ShieldMarc hosted?

ShieldMarc is UK based. Core infrastructure, databases and monitoring pipelines are hosted in the EU under GDPR and UK data protection law. Optional AI-assisted features, when you invoke them, route to third-party LLM providers in the US under no-training API terms. For enterprise and public sector customers with strict residency requirements we offer dedicated UK-hosted environments and EU AI routing on request as part of a custom plan. See our Trust page for the full list.

Can I keep my existing RUA address alongside ShieldMarc?

Yes. DMARC supports multiple RUA addresses separated by commas. You can add ShieldMarc alongside any other reporting address. Since Mail Check has retired you can safely remove its RUA address at the same time.

What happens if our message volume spikes and we go over the plan limit?

Nothing breaks. Reports keep parsing, dashboards stay live, alerts keep firing. We do not charge overage fees and we never silently drop data. The MSP plan already includes 5 million authenticated messages per month, so most organisations never come close. If you are consistently over for three months in a row, a sales contact reaches out to discuss an expansion bucket (an extra 50 domain slots and 5 million extra messages for £40 per month). Your invoice never changes without a conversation first.

NCSC Mail Check retired 31 March 2026

Migrate from NCSC Mail Check

NCSC Mail Check retired on 31 March 2026, so any DMARC aggregate reports still pointing at it are now being dropped. To keep your visibility, move your DMARC RUA address to a commercial replacement: create a ShieldMarc account, point your DMARC record at the new reporting address, and reports resume within 24 to 48 hours. ShieldMarc is a UK-built domain security platform designed as a direct replacement: DMARC monitoring plus the SSL, DNS, uptime and lookalike coverage Mail Check never offered. Migration takes under 5 minutes.

NCSC retired Mail Check (and Web Check) because a wide commercial market for External Attack Surface Management now covers what the services provided. See the official NCSC announcement for the published rationale.

You are currently flying blind

With Mail Check retired, any RUA reports still pointing at it are being dropped on the floor. You have no visibility into who is sending email as your domain, whether your authentication is working, or whether spoofing campaigns are targeting you. Your DMARC policy is still live, but you can no longer see what it is enforcing against.

ShieldMarc vs NCSC Mail Check

Everything Mail Check did, plus the features NCSC said commercial tools do better.

Feature	NCSC Mail Check	ShieldMarc
DMARC aggregate report parsing
Human-readable dashboards
SPF & DKIM validation
Subdomain policy (sp=) detection
AI-powered threat classification
SSL/TLS certificate monitoring
DNS, DNSSEC & CAA monitoring
MTA-STS & TLS-RPT monitoring
Domain expiry & WHOIS monitoring
Uptime monitoring
Lookalike domain detection
Remediation tasks you can act on
Scheduled email reports
Security Grade score
UK based, EU-hosted infrastructure
Free tier available

Migrate in 3 steps

Create your free account

Update your DMARC record

Replace the NCSC Mail Check RUA address in your DNS with the ShieldMarc address. One DNS TXT record change.

Reports start flowing

Within 24 to 48 hours, DMARC aggregate reports from receiving servers appear in your ShieldMarc dashboard.

NHS, public sector, and local authorities

ShieldMarc is UK based, with EU-hosted infrastructure. For public sector and enterprise customers requiring UK data residency, we offer dedicated UK-hosted environments on request. We understand the specific challenges facing organisations that were on Mail Check, including managing hundreds of subdomains, compliance requirements, and limited IT resource. We offer dedicated onboarding support and volume pricing for public sector customers. NCSC advised public sector bodies to transition to a commercial product before retirement; its retirement announcement sets out the reasoning, and DMARC itself was defined in RFC 7489, the original DMARC specification, obsoleted in May 2026 by DMARCbis (RFC 9989).

Don't spend another week without DMARC visibility

Start your free account today and restore your DMARC monitoring in an afternoon.

Get started free Check your DMARC record

Free tier includes 1 domain and 10,000 messages/month. No credit card required.

Frequently asked questions

What happens now that NCSC Mail Check is retiring?: NCSC Mail Check retired on 31 March 2026. The reporting service has stopped, so DMARC aggregate (RUA) reports that still point at a Mail Check address are now being dropped and you have no visibility into who is sending email as your domain. Your DMARC DNS policy (p=none, p=quarantine or p=reject) keeps working because receiving servers enforce it independently. To restore reporting you move your RUA address to a commercial replacement, which NCSC recommended doing before retirement.
How do I migrate from NCSC Mail Check?: Migration is one DNS change. Create a ShieldMarc account and add your domain to get a unique RUA reporting address, then edit your DMARC TXT record to replace the Mail Check RUA address with the ShieldMarc one (you can keep both for a handover period since DMARC allows comma-separated RUA addresses). Aggregate reports from receiving servers start appearing in your dashboard within 24 to 48 hours. The whole process takes under 5 minutes.
What should UK councils do about DMARC after Mail Check retirement in March 2026?: UK councils, NHS trusts and other public sector bodies that relied on Mail Check should move their DMARC aggregate reporting to a commercial External Attack Surface Management or DMARC monitoring product, which is exactly what NCSC advised when it announced retirement on 31 March 2026. Keep your existing DMARC policy in DNS unchanged so enforcement is uninterrupted, repoint the RUA address to your new provider, and continue the report-driven progression from p=none to p=quarantine to p=reject as the evidence supports it. ShieldMarc is UK based with EU-hosted infrastructure by default and dedicated UK-hosted environments available on request, plus subdomain policy detection that matters for the large estates councils typically run.
Why did NCSC retire Mail Check?: NCSC's published rationale is that there is now a wide commercial market for External Attack Surface Management products that cover what Mail Check and Web Check provided, plus additional features. The NCSC announcement recommends transitioning to a commercial EASM product before retirement and points to its EASM buyer's guide. NCSC has refocused its own work on areas where commercial alternatives are not yet available.
Is my DMARC policy still working?: Yes. Your DMARC policy (p=reject, p=quarantine, etc.) is a DNS record that receiving servers enforce independently. It continues working. What stopped on 31 March 2026 is the reporting; you no longer receive aggregate reports telling you what is happening with your email authentication.
How long does migration take?: Under 5 minutes. You create an account, add your domain, and update the RUA address in your DMARC DNS record. Reports typically start arriving within 24 to 48 hours.
Is ShieldMarc free?: Yes, the Starter plan is free and includes 1 domain with 10,000 messages per month and threat-model analysis (deep AI review is reserved for paid plans). For organisations managing multiple domains, Professional (25 domains) and MSP (100+ domains) plans are available.
Where is ShieldMarc hosted?: ShieldMarc is UK based. Core infrastructure, databases and monitoring pipelines are hosted in the EU under GDPR and UK data protection law. Optional AI-assisted features, when you invoke them, route to third-party LLM providers in the US under no-training API terms. For enterprise and public sector customers with strict residency requirements we offer dedicated UK-hosted environments and EU AI routing on request as part of a custom plan. See our Trust page for the full list.
Can I keep my existing RUA address alongside ShieldMarc?: Yes. DMARC supports multiple RUA addresses separated by commas. You can add ShieldMarc alongside any other reporting address. Since Mail Check has retired you can safely remove its RUA address at the same time.
What happens if our message volume spikes and we go over the plan limit?: Nothing breaks. Reports keep parsing, dashboards stay live, alerts keep firing. We do not charge overage fees and we never silently drop data. The MSP plan already includes 5 million authenticated messages per month, so most organisations never come close. If you are consistently over for three months in a row, a sales contact reaches out to discuss an expansion bucket (an extra 50 domain slots and 5 million extra messages for £40 per month). Your invoice never changes without a conversation first.