NCSC Mail Check has closed: what small businesses and charities can use instead

What happened, and when

Mail Check was the National Cyber Security Centre's free service for checking an organisation's email security: SPF, DKIM, DMARC and TLS. Web Check did the same for websites. Both were part of the NCSC's Active Cyber Defence programme, and the NCSC's own guidance described Mail Check as available to any UK organisation with a domain name, so plenty of small businesses and charities signed up.

Both were wound down in two steps:

The NCSC's reason is that the market has caught up: there are now commercial products for organisations of every size, and it aims to deliver services only where the market can't. It points organisations to its buyer's guide for external attack surface management tools and to its free Check your email security tool.

What it means for your domain

Nothing broke on 31 March. Mail Check never hosted your records; it read them from public DNS and told you when something was wrong. So your email keeps flowing exactly as before.

What you lost is the watching:

• Nobody tells you if someone changes or deletes your SPF or DMARC record, or if a new service pushes SPF over its 10-lookup limit.
• If your DMARC reports went to Mail Check, they have been going nowhere useful since March 2025. That matters most if you were still at p=none: the reports are how you find out which services send as you before tightening the policy.
• From Web Check, nobody warns you about an expiring or misconfigured certificate on your website.

First job: check where your DMARC reports go

Look up your domain's DMARC record with the free DMARC checker, or ask whoever manages your DNS. The part to look at is rua=, the address aggregate reports are sent to:

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.org.uk

If the rua still contains the address Mail Check gave you, replace it. You can point it at a mailbox you own (and read the XML yourself), or at a reporting service, which will give you its own address. A record can list more than one address, separated by commas, so you can run a new service alongside an old one while you switch. If there's no rua at all, add one: see how to fix missing DMARC reporting.

A reporting address on a different domain from yours needs that domain to publish a small authorisation record, or receivers won't send to it. Any reporting service handles that for you. If you're curious what the reports contain, our guide on how to read a DMARC report goes through one line by line.

What Mail Check and Web Check covered

To replace them properly, it helps to list what they did for you. Between them, they covered roughly this:

Our free domain health check runs all of these at once and adds the domain's own expiry date: a lapsed registration takes the website and email down together.

Your options, from free to paid

The NCSC's Check your email security. Still running, free, and no sign-up: type in a domain and it checks anti-spoofing (SPF, DKIM, DMARC) and email privacy (encryption in transit). It's a one-off check, so it won't tell you when something changes next month, but it's a good second opinion. Check your email security.

Free one-off tools. Ours, and many others', check a domain on demand. Fine if you remember to run them. Most people don't, which is why Mail Check was useful in the first place.

Reading the reports yourself. Point rua at a mailbox you own and open the attachments. It costs nothing but time, and the files are compressed XML. Our DMARC report analyser turns one into a readable table without storing it, which is fine for an occasional look.

A monitoring service. Checks every day, reads the DMARC reports for you and alerts you when something changes. The dmarc.org products and services list, which the NCSC's own guidance on choosing a tool links to, is a good place to compare. Domain Health Hub is one of these: it covers the email records, DMARC and TLS reports, certificates and the domain's expiry, from £15 a month for up to 25 domains.

The NCSC's Early Warning service also carries on, and any UK organisation with a domain name or static IP address can sign up (NCSC services). It alerts you to suspicious activity linked to your network, such as a compromised machine. It doesn't check your email records, so it complements the options above rather than replacing Mail Check.

Choosing a tool

For a small business or charity, the questions that matter:

1. Does it check daily and tell you when something changes? That's the gap Mail Check left.
2. Does it read DMARC reports and explain them in plain English? Raw counts by IP address won't help a trustee or an office manager.
3. Does it cover the website and domain too? Web Check has gone as well; one tool for both is simpler.
4. Where is the data held? DMARC reports are about your mail flow. UK or EU hosting keeps things simple under UK GDPR.
5. Is the price fixed? Some services charge by email volume, which is hard to predict. A fixed price per domain is easier to budget.

If an IT company or web agency looks after your domain, ask them first: they may already monitor it, or be glad to add it to what they do for you.

A one-afternoon plan

1. List every domain you own, including old names and the .org.uk beside the .org. Unused domains can be spoofed too, and need p=reject.
2. Run a free check on each, and note anything marked as failing.
3. Change any rua still pointing at Mail Check, as above.
4. Fix the urgent items: a missing DMARC record, two SPF records, a certificate close to expiry. Each failure links to a step-by-step fix.
5. Decide how it will be watched from now on: a reminder to re-run free checks monthly, or a service that does it daily.
6. If you're still at p=none, plan the move to reject using the reports. The DMARC guide explains the steps.

Doing this for clients? Domain Health Hub checks every client domain each day and puts the results in a monthly report card with your logo. Start a free trial; no card needed.