DMARC reports stopped after 31 March 2026

Your DMARC aggregate reports simply stopped arriving around the end of March 2026, and nothing in your own DNS changed. You're not sure whether something broke.

Check your domain first — 10 seconds, free, no signup.
See your DMARC policy, SPF lookup count and every issue explained in plain English.
Run the free check →

What this means

Nothing on your side broke — the reader went away. If your DMARC rua= tag pointed at an NCSC Mail Check reporting address, those reports had a destination that stopped processing them when Mail Check was retired on 31 March 2026. Your domain is still generating aggregate reports; there's just no longer anything at that address turning them into findings. This is different from the “no reports ever arrived” case (a missing external-destination authorisation record) — here reports were arriving and then stopped on a known date, which points straight at the retired service rather than a misconfiguration. Source: NCSC — retiring Web Check and Mail Check · verified 2026-07-17

What to do instead

Step 1. Check what your rua= tag points at — if it's a Mail Check / NCSC destination, that's why the reports stopped.
Step 2. Replace it with a live reporting address from a tool that reads aggregate reports on any DNS host.
Step 3. You don't need to change anything else in the DMARC record — only the reporting destination moved.
Step 4. Wait one reporting cycle (up to 24–48h) after repointing, then confirm reports are flowing again.

Frequently asked

Did the NCSC tell us to stop using DMARC?

No. The NCSC retired the Mail Check tool on 31 March 2026, but its email-security and anti-spoofing guidance stayed live and still recommends publishing DMARC and monitoring your reports — it simply expects you to use an open-source or commercial tool to do it now.

Do we have to migrate our DNS to switch tools?

No. DMARC reporting is controlled by the rua= tag in a single DNS TXT record. Moving from Mail Check to another tool is a one-line change to that record — your DNS stays where it is, with no delegation.

Will switching reset the progress we made toward p=reject?

No. Your DMARC policy lives in your own DNS record, not inside Mail Check. Retiring the tool or changing your reporting address doesn't touch the policy you already reached.

Don't want to babysit DNS records?
DMARCKeeper monitors your reports, names every sender, and walks you to full p=reject protection.
Start free monitoring →