DMARC for the NHS and UK Public Sector: A Post Mail Check Guide

Why this matters now

NCSC retired Mail Check on 31 March 2026, so UK public sector bodies now have to arrange their own DMARC monitoring. From 2017 they relied on NCSC Mail Check, which was free and part of the NCSC Active Cyber Defence programme. NCSC recommended commercial replacements, and that has left a gap most organisations have not yet filled.

The risk is not theoretical. NHS trusts are one of the most phished organisations in the UK, and council email is regularly spoofed for benefit fraud, invoice scams, and impersonation of elected officials. Without active DMARC monitoring, an organisation has no visibility into who is sending mail in their name. A policy of p=none or no DMARC record at all is an open door to spoofing.

Public DNS lookups against major NHS-facing and council domains regularly find p=none, no DMARC record at all, or sub-domains uncovered by any enforcement policy. We documented examples in a private responsible-disclosure report shared with the relevant teams and do not republish individual domains here. The pattern is visible to anyone running their own DNS audit and should be treated as the assumed baseline rather than the exception.

For .gov.uk domains, the picture is published rather than described. Our UK public sector DMARC tracker re-measures every domain in the official .gov.uk register every hour and publishes, for each one, the DMARC policy in force and whether the aggregate reports go anywhere. It covers the .gov.uk register only, not nhs.uk, so it does not measure NHS trusts' own domains.

The tracker is free to cite. Read it with the register's make-up in mind: about three in four entries are parish, town and community councils, so a headline percentage is not a statement about central government. As of 24 October 2026, ShieldMarc's UK public sector DMARC tracker found 49.1% of parish and town councils and 67.1% of all other bodies in the register at enforcement (p=quarantine or p=reject).

What a public sector DMARC platform needs to do

The core technical capability required is identical to any other DMARC service: receive aggregate reports, parse them, identify legitimate and illegitimate senders, and guide the organisation from p=none to enforcement. What distinguishes a public sector suitable tool is everything around the edge:

• EU or UK data residency for the core data plane, not US. Aggregate reports contain sending IP addresses, message counts, and authentication results, and an IP address can be personal data under UK GDPR when it identifies a person, so where a supplier holds the reports matters to a DPIA. Default EU hosting (with a dedicated UK hosted environment available on request on an enterprise plan) is a far simpler DPIA than a US platform operating under the CLOUD Act. Optional AI-assisted analysis goes to US model providers, and only when someone asks for it; EU-only AI routing is available on request on an enterprise plan.
• Minimised US subpoena exposure. Post Schrems II, UK public sector buyers are increasingly sensitive to whether a supplier is subject to the US CLOUD Act. A UK owned supplier with European infrastructure reduces that concern, but check its sub-processors too: ShieldMarc receives reports through a Microsoft 365 mailbox and keeps the archive copy of each DMARC report email in Cloudflare R2 object storage, which is not restricted to the EU. Microsoft and Cloudflare are both US companies. Optional AI features route to third-party large-language-model providers in the US under no-training API terms; these can be disabled, and EU-only routing is available on request on an enterprise plan for customers who need the narrowest possible US footprint.
• Transparent pricing. Public sector procurement under thresholds like the Digital Marketplace (G Cloud) or direct contract award requires clear, published pricing. Sales led quote on request pricing is a real barrier.
• Multi domain support at realistic prices. A typical NHS trust holds 20 to 50 domain names across legacy acquisitions, service sub brands, and parked variants. Pricing models that charge per domain punish exactly the organisations that need the most protection.
• Parked and alias domain handling. Most domains in a public sector portfolio do not send mail. They need a p=reject policy from day one, not a twelve week ramp. Tools that treat every domain identically waste effort.

The minimum compliant baseline

Before picking a tool, it helps to know what good looks like. The minimum baseline we recommend for any public sector body is:

1. Every owned domain has a DMARC record. Including parked and alias domains. No exceptions.
2. Active sending domains are at quarantine or reject. p=none is a starting point, not an endpoint. See our guide on choosing between quarantine and reject for the decision.
3. Parked and alias domains are at p=reject from day one. With strict alignment and sp=reject.
4. SPF records resolve within the 10 lookup limit. Broken SPF is one of the most common reasons legitimate mail fails DMARC alignment.
5. DKIM is signed with 2048 bit keys and rotated annually. Weaker keys are still accepted by most receivers but no longer considered best practice.
6. Aggregate reports are monitored weekly. Either by staff or automatically by the chosen platform. DMARC is only useful if someone is reading the reports.
7. MTA-STS and TLS-RPT are deployed. Particularly for health and central government where messages may carry sensitive attachments. See how MTA-STS and TLS-RPT work, on the MTA-STS Checker.

Mapping to NHS DCB1596 (Secure Email Standard)

NHS England's Secure Email Standard, catalogued as DCB1596, sets out the minimum technical controls expected of any email service handling NHS correspondence. The standard is the document NHS Digital procurement teams check first when evaluating a DMARC platform. The table below maps the authentication-related clauses of DCB1596 to the controls our recommended baseline already enforces. Buyers should always check the live DCB1596 specification on digital.nhs.uk for the version current at the time of procurement, and request a mapping document for any specific clause that is critical to your DPIA or accreditation.

DCB1596 is the technical floor, not the ceiling. The baseline above meets or exceeds the authentication-related clauses, but broader DCB1596 areas (mailbox-level access controls, attachment handling, end-user training) sit outside any DMARC platform's scope and must be covered by the surrounding mail service and security programme.

A realistic rollout plan for a typical trust or council

Large deployments fail when they are planned as a single twelve month project. The approach that actually works is short cycles on a prioritised domain list:

Twelve weeks is a realistic target for an organisation that has never run DMARC before, but the schedule is indicative. The actual gate at every step is report cleanliness, not the calendar. Trusts and councils with existing Mail Check experience often move faster because the discovery work is already done. Estates with many third party senders move slower because each newly surfaced sender needs SPF or DKIM fixed before progression. Do not advance a policy on a fixed week if the reports still show unresolved unauthorised sources.

Procurement considerations

Public sector buying is different from private sector buying, and the things that matter for a DMARC tool reflect that. Key questions to answer before selecting a supplier:

• Where is data stored? Ask for a specific data centre location, not a region. UK or EU only is the minimum bar.
• Is the supplier subject to the US CLOUD Act? If yes, a data protection impact assessment (DPIA) becomes significantly more complex.
• Does the platform support Cyber Essentials and Cyber Essentials Plus audits? Look for suppliers that publish their own posture openly. ShieldMarc publishes its full security posture on its Trust page; formal certification (starting with Cyber Essentials, then SOC 2 or ISO 27001 depending on customer demand) is a first-order goal as the business scales, and the engineering posture is already built with those frameworks in mind. The live controls, tenant isolation, minimal personal-data handling and vendor assessment documentation are all described on our Trust page.
• What is the total cost of ownership across 20 to 50 domains? Per domain pricing can make DMARC prohibitively expensive at public sector scale.
• Is there a free tier or trial? Proving value before raising a purchase order shortens the buying cycle dramatically.
• Can the platform onboard the organisation without consulting fees? Many legacy providers bundle mandatory professional services that double the year one cost.

Why we built ShieldMarc for this

ShieldMarc is a modern DMARC platform built from scratch in 2026. We are UK based, with EU hosted infrastructure, and dedicated UK hosted environments are available on request on an enterprise plan for organisations that require strict UK data residency. Flat rate pricing, no per domain fees. We take DMARC reports for every owned domain, parse and classify every sender, and guide organisations from p=none to enforcement on a realistic timeline.

The platform covers DMARC, SPF, DKIM, MTA-STS, TLS-RPT, DNSSEC, CAA, and certificate monitoring in a single subscription. A deterministic threat model scores every report row, and optional AI explains a sender when you ask, so the reports you read every week are signal, not noise.

Public sector specific details we care about:

• UK owned and operated. Not a reseller of a US platform.
• Customer monitoring data is EU hosted by default, except the archive copy of each DMARC report email, which is kept in Cloudflare R2 object storage and is not restricted to the EU. Our core databases and ingest pipelines run inside the European Union under UK GDPR and EU GDPR.
• Dedicated UK hosted environment available on request on an enterprise plan, for organisations with strict UK residency requirements.
• Optional AI features (for example Explain with AI and AI review) route to third-party large-language-model providers in the US under API-only, no-training terms, and only when an operator explicitly invokes them. EU-only AI routing is available on request on an enterprise plan. See our Trust page and Privacy Policy for the full sub-processor list.
• Flat rate pricing that does not punish multi domain portfolios.
• Free tier and free tools for public interest responsible disclosure work.

Next steps

• Run a baseline scan of your primary domain with our free Security Grade check. It evaluates DMARC, SPF, MTA-STS, TLS-RPT, DNSSEC, and more in a single scan.
• Check your existing DMARC record with the DMARC Checker. Particularly useful to confirm whether sp is set.
• Read our NCSC Mail Check retirement guide for a longer view of the policy context.
• Check your plan against the NCSC email security and anti-spoofing guidance.
• Inventory every owned domain before starting rollout. This is the step most organisations skip and regret.

Frequently asked questions