NCSC Mail Check is retired: move your DMARC reports
Last updated 2026-09-21
The NCSC stopped Mail Check's DMARC aggregate reporting on 24 March 2025 and retired the whole service on 31 March 2026. If your DMARC record still sends reports to dmarc.service.gov.uk, you haven't seen who is sending mail as your domain since.
Do I need to change my DMARC record? Yes, if its rua= tag has an address at dmarc.service.gov.uk. Your policy still works, and you've lost the reports.
- Look up your record. Run
dig +short TXT _dmarc.yourdomain.example, or use our DMARC checker. Find therua=tag. - Get a new reporting address. Create a free DomainCanary account, add your domain, and copy the address we give you.
- Swap the Mail Check address for the new one. Leave
p=,sp=and every other tag exactly as they are. - Wait a day or two. Receivers send aggregate reports once a day, so the first ones arrive after that.
What Mail Check did, and what replaces it
| Mail Check feature | Ended | What replaces it |
|---|---|---|
| DMARC aggregate reports, DMARC Insights, DKIM checks | 24 March 2025 | A DMARC report reader |
| TLS reporting (TLS-RPT) | 24 March 2025 | A TLS-RPT collector |
| DMARC and SPF policy checks | 31 March 2026 | The NCSC's Check your email security, or any DNS checker |
| MTA-STS and inbound TLS checks | 31 March 2026 | The same |
The dates come from the NCSC's own pages: the Mail Check update for the 2025 change, and the notice retiring Mail Check and Web Check for 2026.
In that notice the NCSC recommends buying an external attack surface management product and using its free Check your email security. That service reads a domain's public DNS when you ask it to. It doesn't receive DMARC reports, so you can't use it to see which servers are sending as you.
626 domains still report to Mail Check
In our September 2026 scan of the Tranco top million and a US federal cohort, 626 domains still had dmarc.service.gov.uk in their rua= tag. In the August 2026 scan it was 636. The figures are in the DMARC Census data.
When I checked in September 2026, the address still accepted mail, and the NCSC still published the DNS record that authorizes it to receive reports for other domains. Receivers keep sending reports there, and the NCSC no longer shows them to the domain's owner.
Read your DMARC reports for free
DomainCanary reads DMARC aggregate reports, which is the feature Mail Check ended first. Your first domain is free, and the free plan doesn't expire. You add our address to your rua= tag. We read the reports from every receiver and list each server that sent as your domain, with whether it passed. The free plan keeps 90 days of report detail and sends you a summary every week.
On the Starter plan and up, we propose each policy change when your reports show it's safe, and you approve it before we publish it. We don't read TLS-RPT reports, so point that record at another collector.
Change the rua tag and nothing else
The first line below is a record that sends reports to Mail Check. The second is the same record with a new address.
Our DMARC record generator reads the record you publish today and keeps its other tags when you change the address. Our address is on a different domain from yours, so receivers first look for a DNS record that authorizes us to receive your reports (RFC 7489, section 7.1). We publish that record, so you have nothing to add.
Don't lower your policy while you switch. A domain at p=reject stays at p=reject. If you're still at p=none, the reports are how you find the senders to fix before you tighten it, and the guide to moving to p=reject covers the order.
Read your domain's DMARC record
The policy, the alignment modes and where the reports go, with the gaps marked.
Free · No signup · The result names what to change
Questions
When was NCSC Mail Check retired?
The NCSC retired Mail Check and Web Check on 31 March 2026. Mail Check had already stopped DMARC aggregate reporting, DMARC Insights, DKIM checks and TLS reporting on 24 March 2025.
Should I remove dmarc-rua@dmarc.service.gov.uk from my DMARC record?
Yes. The NCSC no longer gives you reports from that address. Replace it with the address of a report reader you can log in to, and leave every other tag as it is.
Does changing the rua address weaken my DMARC policy?
No. Receivers send reports to the address in the rua tag and use it for nothing else. They act on your p= and sp= tags when mail fails, and you don't touch those.
What does the NCSC recommend instead of Mail Check?
Its retirement notice recommends a commercial external attack surface management product, plus the NCSC's free Check your email security service for a one-off look at a domain's anti-spoofing and email privacy settings.
Keep reading
Checking as you go? The DMARC checker reads the policy you are moving up, the SPF and DKIM checkers show whether your senders will survive it, and the report analyzer reads an aggregate report you already have. No signup.
DomainCanary is a DMARC monitoring service that protects your domain from email spoofing without blocking your own mail.