In short
DMARC monitoring is collecting and reading the aggregate reports mailbox providers send to the rua address in your DMARC record, so you can see every sender and move safely from p=none to enforcement. NCSC Mail Check was retired on 31 March 2026, so UK organisations that relied on it need another platform, such as EasyDMARC, Valimail or Check Point.
Not sure where to start?
Tell us what you need to achieve and we will point you to the right option.
What DMARC monitoring shows you
DMARC is a DNS TXT record published at _dmarc.yourdomain. It tells receiving mail servers what to do with mail that uses your domain in the From address but fails aligned SPF and DKIM (opens in a new tab) checks, and where to send reports about it. The current specification, RFC 9989 (opens in a new tab), was published in May 2026 and replaces RFC 7489. It defines Monitoring Mode as the state where your policy is p=none and you are receiving aggregate reports, using what they show "to make any needed adjustments to the authentication practices for its mail streams". DMARC monitoring is that work: receiving the reports, reading them and acting on them.
The reports themselves are defined in RFC 9990 (opens in a new tab). Participating mailbox providers that saw mail from your domain send an XML file, usually daily and covering a single UTC day (RFC 9989 asks for at least one report every 24 hours, but sending reports is a receiver's choice). They only arrive if your record has a rua tag: without one, RFC 9989 says receivers "MUST NOT generate aggregate feedback reports". These are the key parts of a single record, using RFC 9990's own sample:
| Report element | Example from RFC 9990 | What it tells you |
|---|---|---|
| org_name | Sample Reporter | Which mailbox provider sent the report |
| source_ip and count | 192.0.2.123, 123 messages | Which server sent mail as your domain, and how much |
| policy_evaluated | disposition pass, dkim pass, spf fail | Whether the mail passed DMARC and how the receiver handled it |
| auth_results | DKIM domain example.com, selector abc123, result pass | The raw SPF and DKIM results behind that verdict |
Multiply that by every provider and every sending server and you have a lot of XML that lists IP addresses rather than services. As Valimail puts it (opens in a new tab), raw reports "arrive as raw XML listing IP addresses". A monitoring platform collects the files for you, maps the addresses to named services such as your email platform, your CRM or your marketing platform, and shows pass and fail rates per domain and per sender. Our DMARC reports guide walks through every element of a report, and our DMARC report analysers page covers the tools that read them.
Vendors we supply
Not sure which option fits? Ask us
Tell us what you need and we will help you choose the right option.
Check your domain now
Two free tools on this site give you a quick starting point before you choose a platform.
| Tool | What it does | Use it when |
|---|---|---|
| DMARC checker | Looks up any domain's DMARC record, tests the syntax and explains each tag | You want to know whether you have a record, which policy it sets and where reports go |
| DMARC record generator | Builds a valid DMARC TXT record from your choices, ready to copy into DNS | You are publishing your first record or adding a reporting address |
A first record for monitoring mode, taken from RFC 9989 Appendix B.2.1, is v=DMARC1; p=none; rua=mailto:dmarc-feedback@example.com, with the address replaced by your own mailbox or your platform's reporting address. The NCSC says that "within 24 hours of publishing your records you'll start receiving email reports from major email recipient domains" (NCSC: implement a DMARC policy of none (opens in a new tab)). It also advises that all of your domains, "including parked domains, should have DMARC records in place", so check the domains you do not send from as well. For a step-by-step walk-through, see how to set up DMARC.
Monitor, enforce, maintain: the path to enforcement
Monitoring is the first stage, not the goal. The NCSC's recommended implementation plan (opens in a new tab) moves from monitoring at p=none to marking spoofed mail as spam with p=quarantine, then rejecting it with p=reject where that suits the domain, then continuous improvement, keeping the rua tag in place throughout so you catch new services and changed records. Each step is a change to the p tag, and the reports tell you when it is safe to make it. The NCSC's pages on marking spoof emails as spam (opens in a new tab), rejecting spoof emails (opens in a new tab) and continuous improvement (opens in a new tab) cover each step, and our DMARC policy guide sets out how long to spend at each stage. RFC 9989 has made the old pct tag historic; its new t=y test flag asks receivers to apply the policy one level below the one you publish, so p=quarantine with t=y is treated as p=none.
RFC 9989 also changes the end point. It says "domains for general-purpose email SHOULD NOT deploy a DMARC policy of p=reject", because p=reject can cause problems for indirect mail flows such as forwarding addresses, role aliases and the mailing lists your users post to. Any such domain wanting p=reject should first use p=none "for at least a month, followed by publishing p=quarantine for an equally long period". Check Point's DMARC guidance (opens in a new tab) follows the same line and suggests end states by domain type:
- Human mailbox or general-purpose domain: usually p=quarantine
- Transactional or outbound-only subdomain: often p=reject
- Non-sending domain or unused subdomain space: p=reject, often with sp=reject and np=reject
- Mixed-use main domain: p=quarantine at the top, with stricter policies on dedicated sending subdomains
The DMARC policy guide explains each value and the signs that a domain is ready to move up.
Need help choosing?
We will recommend what fits your organisation and explain why, in plain English.
The DMARC monitoring platforms we supply
We supply three platforms. All three read your aggregate reports and identify your sending services; they differ in how reports reach them, how much of your SPF and DKIM they can host, and who they are built for.
| Platform | How reports reach it | Hosted SPF and DKIM | Management and packaging |
|---|---|---|---|
| EasyDMARC | You add EasyDMARC's reporting address to your rua tag. Addresses on rua.easydmarc.eu are processed in AWS eu-west-1, Ireland (opens in a new tab). Managed DMARC (opens in a new tab) lets you publish the record once as a CNAME and change the policy from the dashboard | EasySPF (opens in a new tab) flattens includes into IP ranges to stay under SPF's 10-lookup limit; Managed DKIM (opens in a new tab) uses a one-time _domainkey NS delegation. Plan coverage confirmed at quote | Multi-tenant client management (opens in a new tab) with roles, SSO, audit history and white-label reporting |
| Valimail | Free Valimail Monitor (opens in a new tab) works by adding Valimail's address to your rua tag. Valimail's paid tiers delegate _dmarc (opens in a new tab) with an NS record to Valimail | Instant SPF (opens in a new tab) uses SPF macros to work around the 10-lookup limit; DKIM is delegated with an NS record for _domainkey | For multi-client use, Valimail Core (opens in a new tab) has native multi-tenancy and role-based access; Pro adds BIMI management, MTA-STS, advanced alerting and API access (Core and Pro compared) |
| Check Point DMARC Management | Your rua tag points at a dedicated hosted RUA mailbox (opens in a new tab) created for your tenant, or at a protected internal mailbox; reports are stored for 60 days | SPF Management (opens in a new tab) through an include mechanism using SPF macros; DKIM Management (opens in a new tab) through NS delegation; both are part of the add-on | An add-on (opens in a new tab) to a Check Point Email Security (opens in a new tab) (Harmony Email & Collaboration) tenant, managed in the same portal |
As a rough guide: if you already use Check Point Email Security, the add-on keeps DMARC in the portal you use already. If you manage many organisations' domains, such as a group of schools or an IT provider's clients, the multi-tenant editions of EasyDMARC and Valimail are designed for that. If you want the platform to host and change your records for you, compare EasyDMARC's managed records with Valimail's delegation model. Our EasyDMARC vs Valimail page sets the two side by side. Pricing depends on the platform, your domains and your mail volume, so ask us for a quote.
Why DMARC monitoring matters now in the UK
Three changes have made reading your DMARC reports a practical necessity rather than a nice-to-have.
NCSC Mail Check has gone. UK government guidance pointed public sector bodies at NCSC Mail Check to process their DMARC reports. The NCSC retired Mail Check and Web Check on 31 March 2026 (opens in a new tab), and users no longer receive findings from it. The NCSC's anti-spoofing guidance notes that implementing these controls "can generate a lot of data" and recommends using a tool to make sense of it (NCSC: choose an anti-spoofing management tool (opens in a new tab); that page still mentions Mail Check, which has since been retired). If your reports used to go to Mail Check, it is worth checking where your rua tag points now.
Public sector rules expect regular review. gov.uk's Securing government email (opens in a new tab) guidance applies to public sector email domains. It asks them to have DMARC, DKIM and SPF records in place and to set up DMARC and TLS reporting, "reviewing the data regularly". Our DMARC compliance guide covers the UK standards in more detail.
Mailbox providers now enforce their sender rules. Gmail, Yahoo and Outlook.com all require DMARC from high-volume senders. None of them requires p=reject, but all of them need your mail to pass DMARC, which means every service sending as you must be aligned.
| Provider | Who the DMARC rule applies to | What it asks for | Enforcement |
|---|---|---|---|
| Gmail (opens in a new tab) | Senders of close to 5,000 or more messages a day to personal Gmail accounts | A DMARC record (p=none is acceptable) with the From domain aligned to SPF or DKIM | From November 2025 Gmail is ramping up enforcement, including temporary and permanent rejections (FAQ (opens in a new tab)) |
| Yahoo (opens in a new tab) | Bulk senders (Yahoo sets no published threshold) | A valid DMARC policy of at least p=none, and DMARC must pass; a rua tag is strongly recommended | Rolled out from February 2024; non-compliant mail may go to spam or be rejected |
| Outlook.com (opens in a new tab) | Domains sending more than 5,000 messages a day to Outlook.com, Hotmail and Live.com addresses | SPF and DKIM pass, and DMARC of at least p=none aligned with SPF or DKIM | Non-compliant mail rejected with error 550 5.7.515 from 5 May 2025 (Microsoft Support (opens in a new tab)) |
Our DMARC sender requirements page covers the rest of each provider's rules, such as one-click unsubscribe and spam rate limits.
How we help
We supply EasyDMARC, Valimail and the Check Point Email Security DMARC Management add-on, so we can match the platform to your domains, your senders and how hands-on you want to be. Our DMARC management page explains the work in more detail.
- Assess your domains: we can review the DMARC, SPF and DKIM records on your domains, including parked domains, and the services that send email as them
- Set up reporting: we can help you point your rua tag at the platform and check that reports start arriving
- Choose and supply the platform: we compare EasyDMARC, Valimail and Check Point against what you need and quote for the one that fits
- Work through your senders: we help you identify each sending service in the reports and fix its SPF and DKIM alignment
- Move you to enforcement: we help you plan each policy change, domain by domain, at a pace that suits you
- Licensing in one place: EasyDMARC and Valimail are supplied through the Pax8 cloud marketplace and can be billed monthly, with terms confirmed at quote
We can help businesses, schools, charities and public sector organisations. Contact us to talk through your domains.
More DMARC guides
Frequently asked questions
Is DMARC monitoring the same as DMARC?
Not quite. DMARC is the DNS record and policy that tells receivers how to treat mail that fails authentication and where to send reports. DMARC monitoring is what you do with those reports: collecting them, turning the XML into named senders and pass rates, and watching for changes. RFC 9989 calls a domain at p=none that receives aggregate reports Monitoring Mode, but monitoring carries on after you reach enforcement.
Do I still need DMARC monitoring once I am at p=reject?
Yes. Your sending services change over time: a new marketing platform, a moved CRM or a rotated DKIM key can start failing DMARC, and at p=reject receivers may refuse that mail. The NCSC's continuous improvement step recommends using your DMARC report processing tool to spot new systems without the right SPF and DKIM set-up. Reports also show who is still trying to spoof your domain.
Does DMARC monitoring change my mail flow?
Adding a reporting address to your rua tag does not change how your mail is delivered. The NCSC describes p=none as a monitoring phase that does not interfere with your email traffic, and EasyDMARC and Valimail both say pointing your reports at them leaves your mail flow unchanged. Delivery only changes when you move your policy to quarantine or reject, which is why you monitor first.
How soon will I see DMARC reports?
Usually within a day. Participating mailbox providers usually send aggregate reports daily, and the NCSC says you should start receiving reports from major providers within 24 hours of publishing your record. A full picture of your senders takes longer: RFC 9989 notes it may take many months of reading aggregate reports before a domain owner is sure all of its mail is properly authenticated, and the NCSC suggests several weeks at p=none before moving on.
What does DMARC monitoring cost?
It depends on the platform, how many domains you have and how much mail you send. EasyDMARC plans are based on domains and email volume, Valimail prices its paid products (Enforce and Amplify; Core and Pro for multi-client use) by quote, based on your domains and sending environment, and Check Point licenses DMARC Management as a per-user add-on to Check Point Email Security. Valimail Monitor is free for visibility only. Ask us for a quote and we will price the options for your domains.
Still have a question about DMARC monitoring?
Ask us and a member of our team will get back to you.