Mail Check alternative for councils

Your council or public-sector body used NCSC Mail Check to monitor DMARC across your email domains. Now that it has been retired, you need continuous visibility of who is sending as your domains — without losing the progress you made toward enforcement.

Check your domain first — 10 seconds, free, no signup.
See your DMARC policy, SPF lookup count and every issue explained in plain English.
Run the free check →

What this means

Mail Check's retirement on 31 March 2026 removed the dashboard, not the requirement to keep watching. The NCSC's live email-security collection still lists “Monitor, analyse and update your DNS records” as an ongoing step — the continuous task of reading aggregate reports, spotting new or failing senders, and adjusting records over time. That's precisely the loop Mail Check ran on your behalf; after retirement a council has to run it through another tool or not at all. Leaving rua= pointed at a now-dead destination means new spoofing sources and broken senders go unseen. Source: NCSC — Monitor, analyse and update your DNS records · verified 2026-07-17

What to do instead

Step 1. Restore continuous report monitoring first — an unread rua= address is the same as no monitoring at all.
Step 2. Confirm the policy you already reached (quarantine or reject) is intact; retirement doesn't roll it back.
Step 3. Prefer a tool that names each sending service instead of listing bare IPs — councils typically have many legitimate senders (payroll, planning, alerts) to keep straight.
Step 4. Check each of your domains for free (below) to confirm none silently regressed while Mail Check was winding down.

Frequently asked

Did the NCSC tell us to stop using DMARC?

No. The NCSC retired the Mail Check tool on 31 March 2026, but its email-security and anti-spoofing guidance stayed live and still recommends publishing DMARC and monitoring your reports — it simply expects you to use an open-source or commercial tool to do it now.

Do we have to migrate our DNS to switch tools?

No. DMARC reporting is controlled by the rua= tag in a single DNS TXT record. Moving from Mail Check to another tool is a one-line change to that record — your DNS stays where it is, with no delegation.

Will switching reset the progress we made toward p=reject?

No. Your DMARC policy lives in your own DNS record, not inside Mail Check. Retiring the tool or changing your reporting address doesn't touch the policy you already reached.

Don't want to babysit DNS records?
DMARCKeeper monitors your reports, names every sender, and walks you to full p=reject protection.
Start free monitoring →