NCSC Mail Check Is Ending: What UK Organizations Must Do
Vysiro Team · December 5, 2025 · Updated March 2026 · 7 min read
What Happened
The UK's National Cyber Security Centre (NCSC) has announced the end of its Mail Check service, which has been providing free DMARC monitoring and TLS reporting to UK public sector organizations and some private organizations since 2017. The service is winding down its DMARC aggregate reporting and TLS reporting features in March 2026.
Mail Check was part of NCSC's Active Cyber Defence (ACD) programme, which aimed to reduce the cyber harm to the UK by providing scalable, automated protection tools. At its peak, Mail Check monitored thousands of .gov.uk domains and played a key role in driving DMARC adoption across the UK public sector.
Key Timeline
- 2017: NCSC launches Mail Check as part of Active Cyber Defence
- 2017-2025: Service monitors thousands of UK domains for DMARC, SPF, and TLS compliance
- Late 2025: NCSC announces Mail Check DMARC and TLS reporting services will end
- March 2026: DMARC aggregate and TLS reporting features shut down
What NCSC Mail Check Did
Mail Check provided several critical services to UK organizations:
DMARC Aggregate Report Processing
Mail Check received and parsed DMARC aggregate reports (RUA) on behalf of organizations, presenting the data in a readable dashboard. This showed which IP addresses were sending email using the organization's domain and whether those messages passed authentication.
TLS Reporting (TLS-RPT)
Mail Check monitored TLS certificate deployment and reported on encryption-in-transit for email connections. This helped organizations ensure their email was being transmitted securely.
Email Security Configuration Checks
The service checked SPF, DKIM, DMARC, and MTA-STS records for configuration errors and provided guidance on best practices. Vysiro offers free equivalents for each of these: DMARC Checker, SPF Validator, and DKIM Verifier. Many organizations relied on this as their primary email security monitoring tool.
The service was free to use and required minimal technical expertise to set up, which made it accessible to small government bodies and local councils that lacked dedicated security teams.
Why It's Ending
NCSC has indicated that the decision to end Mail Check's reporting services reflects a shift in priorities. The commercial market for DMARC monitoring has matured significantly since Mail Check launched in 2017, with numerous private-sector tools now available at various price points.
NCSC's view is that the market can now serve the needs that Mail Check was originally created to fill, and that NCSC resources are better directed toward emerging threats and areas where commercial solutions do not yet exist.
While this reasoning is sound from a resource allocation perspective, it leaves thousands of organizations — particularly small public sector bodies — needing to find and fund replacement monitoring tools. Many of these organizations adopted DMARC specifically because Mail Check made it easy and free.
Impact on UK Organizations
The impact of Mail Check's retirement will vary depending on how organizations used the service:
Organizations using NCSC as their sole rua destination
If your DMARC record's rua tag points exclusively to NCSC's reporting address, you will lose all DMARC visibility when the service shuts down. This is the most urgent situation — you need to update your rua tag to point to a new monitoring service before March 2026.
Organizations using NCSC alongside other tools
If you already have a commercial DMARC tool and were using NCSC as a secondary reporting destination, the impact is minimal. You can simply remove the NCSC rua address from your DMARC record and continue with your existing tool.
Organizations without DMARC monitoring
Some organizations had DMARC records but never actively monitored reports. This is actually an opportunity to start proper monitoring with a modern tool that provides better visibility and remediation than Mail Check offered.
3 Best Alternatives to NCSC Mail Check
Here are three alternatives that can replace Mail Check's functionality, each suited to different needs and budgets.
1. Vysiro
Vysiro goes significantly beyond what Mail Check offered. While Mail Check focused on DMARC, SPF, and TLS, Vysiro scans 29 security categories including SSL certificate health, DNSSEC, CAA records, MTA-STS, BIMI, and even post-quantum cryptography readiness. Every domain gets a unified TrustScore from 0 to 1000.
Crucially for organizations that lack DNS expertise, Vysiro's guided fix engine can detect and repair misconfigured DNS records automatically. This addresses one of the biggest pain points Mail Check users reported — knowing something was wrong but not knowing how to fix it.
Pricing: Free (1 domain) / Starter $29/mo (3 domains) / Pro $99/mo (10 domains) / Enterprise custom for larger deployments
Best for: Organizations wanting broader security coverage with remediation, not just monitoring
2. EasyDMARC
EasyDMARC is the most direct replacement for Mail Check's DMARC reporting functionality. It parses DMARC aggregate reports into a clean, visual dashboard that shows sending sources, pass/fail rates, and alignment issues. The free tier covers one domain with limited report processing.
EasyDMARC also offers managed services where their team handles DMARC deployment on your behalf, which could be valuable for small public sector bodies without dedicated IT security staff.
Pricing: Free (limited) / Plus from $39.99/mo / Premium from $74.99/mo
Best for:Organizations that want a close replacement for Mail Check's DMARC-specific reporting
3. DMARC Digests by Postmark
For organizations with minimal budgets (especially small councils and local government bodies), DMARC Digests is a completely free service that sends weekly email summaries of your DMARC aggregate reports. It lacks the dashboard and remediation features of paid tools, but it is better than losing all DMARC visibility when Mail Check shuts down.
Pricing: Free
Best for: Budget-constrained organizations that need basic DMARC visibility at zero cost
Migration Guide: Moving from NCSC Mail Check
Migrating from Mail Check is straightforward. Follow these three steps:
Choose your replacement tool
Evaluate the alternatives above based on your budget, technical capability, and number of domains. If you want the broadest coverage, try Vysiro's free scan to see what it covers. If you need the closest Mail Check replacement, EasyDMARC is a strong choice. If budget is the primary constraint, DMARC Digests is free.
Update your DMARC rua tag
Your DMARC record's rua tag currently points to NCSC's reporting address. Update it to your new tool's reporting address. You can include multiple rua destinations separated by commas:
Verify reports are flowing
After updating your DNS record, allow 24-48 hours for propagation. Then check your new tool's dashboard to confirm that aggregate reports are being received and parsed. DMARC reports are typically sent daily by receiving mail servers, so you should see data within 1-2 days.
Frequently Asked Questions
When exactly is NCSC Mail Check ending?+
Will NCSC Web Check also be affected?+
Is there a free alternative to NCSC Mail Check?+
Do I need to update my DMARC record when switching from NCSC Mail Check?+
Secure Your Domain Today
Scan your domain for free. Get a TrustScore across 30 security categories in under 60 seconds.