In short
DMARC compliance in the UK means following gov.uk's Securing government email: public sector bodies must have DMARC, DKIM and SPF in place, enforce DMARC on inbound mail and review DMARC reports regularly. The NCSC retired Mail Check on 31 March 2026, so organisations that relied on it now need another way to process their reports.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
Who must have DMARC
For the UK public sector the requirement is written down. gov.uk's Securing government email (opens in a new tab) "applies to all email domains that public sector organisations run on the internet", and says that to meet the Government Cyber Security Policy you must:
| Requirement | What it means in practice |
|---|---|
| Have DMARC, DKIM (opens in a new tab) and SPF records in place | Every domain, including those that send no email |
| Enforce DMARC on inbound email | Your own mail system acts on other domains' DMARC policies |
| Set up DMARC and TLS reporting (TLS-RPT) and review the data regularly | A rua address on every DMARC record, and someone reading the results |
| Support TLS 1.2 or later and publish an MTA-STS policy for all domains that receive email | Encrypted, authenticated delivery into your domains |
| Ensure all sending services have valid PTR records | Reverse DNS for every server and service that sends for you |
Its companion page, Set up government email services securely (opens in a new tab), adds the route: publish "a DMARC record starting at p=none rising to p=quarantine or reject during implementation", use SPF with at least a soft fail (~all), and consider a separate subdomain for third-party email services.
For private businesses, charities and other organisations, these standards set a widely recognised benchmark. Combined with the mailbox providers' rules for bulk senders and DMARC's own protection against spoofed invoices and payment fraud, they make DMARC good practice for any organisation that sends email in its own name.
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
The NCSC's phased plan
The NCSC's Email security and anti-spoofing (opens in a new tab) guidance, written for IT managers and system administrators, sets out the steps. It says to "protect all of your organisation's domains", and that parked domains need DMARC records too, whether or not they are used for email.
| NCSC step | What you do |
|---|---|
| 1. Choose an anti-spoofing management tool | Pick a tool to make sense of the report data |
| 2. Protect email in transit | TLS, and MTA-STS for domains that receive mail |
| 3. Configure anti-spoofing controls | SPF, DKIM and a DMARC policy of none (opens in a new tab) |
| 4. Mark spoof emails as spam | Move to quarantine (opens in a new tab) |
| 5. Reject spoof emails | Move to reject (opens in a new tab) |
| 6. Continuous improvement | Use your report processing tool (opens in a new tab) to find new systems without SPF or DKIM |
The NCSC also gives typical timings for each step; how to set up DMARC covers the timeline.
The NCSC calls reject on all domains "the best way to prevent spoofing of your email". RFC 9989 (opens in a new tab), the DMARC standard published in May 2026, adds a note of care for domains whose users post to mailing lists, so reports are what tell you which end state suits each domain. See DMARC policy.
After NCSC Mail Check
Many UK public sector bodies used the NCSC's Mail Check service to receive and read their DMARC reports. The NCSC retired Mail Check (opens in a new tab) on 31 March 2026, and from that date users "no longer receive findings" from it. The NCSC recommends that organisations use a commercial external attack surface management product, and points to its free Check your cyber security service, which checks an email domain's anti-spoofing and privacy settings.
For DMARC specifically, the practical change is that reports need a new destination. If your records still send reports to an address that was processed by Mail Check, you need a DMARC platform or another tool to receive and read them; choosing such a tool is step 1 of the NCSC's plan. The gov.uk pages above were last updated in March 2024, before the retirement, so treat their Mail Check references as out of date. The Set up page's example record sends rua reports to dmarc-rua@dmarc.service.gov.uk, an address used with Mail Check, so check whether your records still include it. gov.uk's older Email security standards DMARC guide (opens in a new tab) still shows pct=100, which RFC 9989 has since made historic.
Moving reporting is usually a single change to the rua tag in each DMARC record. Our DMARC checker shows where each of your domains currently sends its reports.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
Mailbox provider rules for bulk senders
Separately from UK guidance, the largest mailbox providers set their own rules. Gmail and Outlook.com require DMARC from senders of 5,000 or more messages a day to their consumer users, and Yahoo from any sender of "significant volume". All three accept p=none as the minimum, require DMARC to pass with SPF or DKIM aligned, and can reject or filter mail that misses the rules.
| Provider | DMARC minimum | Applies to |
|---|---|---|
| Gmail | p=none, aligned with SPF or DKIM | Close to 5,000+ messages a day to personal Gmail accounts |
| Yahoo | p=none, DMARC must pass | Bulk senders; Yahoo sets no threshold |
| Outlook.com | p=none, aligned with SPF or DKIM | 5,000+ messages a day to Outlook.com, Hotmail and Live.com |
The details, error codes and dates are in Gmail, Yahoo and Outlook.com DMARC requirements.
DMARC platforms and compliance evidence
Auditors and governance teams usually want to see three things: that every domain has a policy, that reports are reviewed, and a record of what changed and when. DMARC platforms are built to produce that evidence, and some automate the record-keeping:
| Evidence | EasyDMARC | Valimail | Check Point DMARC Management (opens in a new tab) |
|---|---|---|---|
| Change history | Managed DMARC (opens in a new tab): versioned change history with attribution, approvals and role-based access on policy changes | Advanced alerting and policy change detection in Valimail DMARC Pro (MSP editions (opens in a new tab); see Valimail Core and Pro) | DNS Change-Log (opens in a new tab) of SPF and DMARC policy changes, stored for 7 years |
| Policy status across domains | Policy state and monitoring per domain | Domains passing and failing DMARC, with overall disposition | DMARC policy and % success per domain |
| Security and data | Annual SOC 2 Type 2 audit (Trust Center (opens in a new tab)); reports sent to its .eu addresses are processed in the AWS Ireland region (data hosting (opens in a new tab)) | Valimail states Enforce is "SOC 2, PCI, and GDPR compliant" (Enforce (opens in a new tab)) | Check Point's Email Security (Harmony Email & Collaboration) can run in Infinity Portal tenants whose data storage is "fully restricted to the UK" (UK data storage (opens in a new tab)); RUA and RUF reports stored for 60 days (DMARC Management (opens in a new tab)) |
EasyDMARC describes its role, in its MSP FAQ (opens in a new tab), as supporting governance and compliance programmes with "monitoring, policy state, change history, audit trails, reporting, and incident evidence".
Schools, councils and charities
Councils, NHS bodies and other public sector organisations fall within gov.uk's Securing government email (opens in a new tab), which covers every email domain they run on the internet. Where a school or college is part of the public sector, the same baseline applies to its domains; trusts and independent schools can use it as a benchmark.
Charities and membership organisations are a frequent target for spoofed donation and payment requests, and often send through several platforms at once: a fundraising system, a newsletter tool and Microsoft 365 or Google Workspace. The NCSC's phased plan works for them in the same way: start at p=none with reporting, authenticate each platform, then move up. Our guides for Microsoft 365, Google Workspace and email marketing platforms cover the common set-ups.
How we help with DMARC compliance
We work with businesses, schools, charities and public sector organisations. We can:
- Assess your domains against the gov.uk and NCSC baseline, including parked domains and subdomains
- Set up reporting on a DMARC platform, including replacing report addresses that used to go to Mail Check
- Help you choose and supply EasyDMARC, Valimail or the Check Point DMARC Management add-on, with the change history and reporting your auditors ask for
- Plan the move to enforcement for each domain, at a pace that suits you
EasyDMARC and Valimail licences can be billed monthly, with terms confirmed at quote. Ask us for a quote, or contact us for free advice. See DMARC management for the platforms side by side.
DMARC requirements in detail
Frequently asked questions
Is DMARC a legal requirement in the UK?
For the public sector, DMARC is a mandatory standard: gov.uk's Securing government email (opens in a new tab) says organisations must have DMARC, DKIM and SPF in place to meet the Government Cyber Security Policy. For other organisations it is a recognised good-practice benchmark set by the NCSC, and a practical requirement from Gmail, Yahoo and Outlook.com for high-volume senders.
What replaced NCSC Mail Check?
Nothing directly. The NCSC retired Mail Check (opens in a new tab) on 31 March 2026 and recommends commercial external attack surface management products, plus its free Check your cyber security service. To keep receiving and reading DMARC reports, organisations point their rua addresses at a DMARC platform or another report processing tool.
Does Cyber Essentials require DMARC?
The current Cyber Essentials requirements (opens in a new tab) (v3.3, April 2026) are organised under five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. DMARC is not one of them, so it sits alongside Cyber Essentials as part of your wider email security. Our sister site cyber-essentials-uk.net (opens in a new tab) covers the scheme itself.
Does DMARC compliance mean p=reject?
Not necessarily. gov.uk asks for a record starting at p=none and rising to quarantine or reject, the mailbox providers accept p=none from bulk senders, and the NCSC calls reject the best protection against spoofing. Reject often suits non-sending and transactional domains, while each mailbox domain is decided from its reports.
Which reports do public sector bodies need to review?
gov.uk's Securing government email asks for both DMARC reporting and TLS reporting (TLS-RPT) to be set up and the data reviewed regularly. DMARC aggregate reports show who sends as your domains; TLS reports show whether mail into your domains is delivered over encrypted connections. See DMARC reports.
Still have a question about DMARC compliance?
Ask us and a member of our team will get back to you.