NCSC is shutting down its DMARC reporting service

[jthompson]

Just received an email from NCSC stating that they've decided to shut down their DMARC aggregate reporting service (part of their MailCheck service) on 24th March 2025. It's a shame because that was a great free option.

What is changing

 

Mail Check will continue to automatically scan your email domains and alert for the following:

• DMARC policy, policy strength and errors
  
• SPF policy, and effectiveness and errors
  
• MTA-STS policy, and policy strength and errors
  
• Inbound TLS (e.g. certificate validity, encryption cyphers)
  

Mail Check will no longer provide:

• DMARC aggregate reporting, DMARC Insights and related DKIM Checks
  
• TLS Reporting (TLS-RPT)
  

 

I'm tempted to have a crack at writing something myself that can parse incoming reports and feed a simple database.

[Jaan]

We've had this. I seem to recall us having to mess with some records..... i'll have to unpick what's actually involved. Edited November 14, 2024 by Jaan

[robintech]

as an aside I don't like they way they use svc.dynamics.com links in their emails which then expand and redirect to wherever

[DavR]

I'll have to do some reading, to remind me what each of these different things mean - I got my head round them once, to set them up, but now a few years have passed I don't remember!

 

At a surface read, though, I assume that means we'll lose access to DMARC insights, and need to either find a new DMARC reporting service, or just remove the reporting email line from our DMARC and TLS-RPT DNS entries.

 

Oh well, it was a useful tool while we were getting everything set up.

[ZeroHour]

Postmark do a free service but I dont know how well it will fit in as a replacement: https://dmarc.postmarkapp.com/

 

Also if your domain is hosted on Cloudflare you can get DMARC reports in there.

[TechMonkey]

We've had this. I seem to recall us having to mess with some records..... i'll have to unpick what's actually involved.

 

You will have a line that says something like

v=DMARC1; p=reject; pct=100; rua=mailto:[email protected];

 

You will need to remove, or edit, the rua=mailto:[email protected] bit

[jthompson]

We've had this. I seem to recall us having to mess with some records..... i'll have to unpick what's actually involved.

 

Our DMARC records already specify one of our own mailboxes for delivery of aggregate reports alongside the addresses for the NCSC and Postmark reporting services, so we've been merrily collecting the reports and doing nothing with them. Time for a bit of Apps Script fun!

[Edu-IT]

Postmark do a free service but I dont know how well it will fit in as a replacement: https://dmarc.postmarkapp.com/

 

Also if your domain is hosted on Cloudflare you can get DMARC reports in there.

Looks like Cloudflare does the same as NCSC and is free.

[Koldov]

Eventually got round to looking at this as I need to set my (p=none) to (p=quarantine)!

 

So who is everybody using to provide their DMARC aggregate reports?

 

Looks like Cloudflare does the same as NCSC and is free.

 

Don't you have to have an account and be using their DNS though?

 

"DMARC Management (beta) is available to all Cloudflare customers with Cloudflare DNS."

[DavR]

I have Postmark - https://dmarc.postmarkapp.com/ - down on my To Do list to try, seemed to be the free one that come out on a few other discussions I've read.

 

Haven't done more than note down the name and read the blurb so far, though.

[Driftingashore]

Also interested in alternatives as we don't have our DNS in Cloudflare.. I can see the option for a domain I do have there, so know it's not an option for us unless we move dns over.

 

Question: does anybody have a school.county.sch.uk domain in cloudflare? I remember it being a total pain to find anyone that would host ours when the LA cut us loose (but that was quite a while ago).

 

The cheapest two I've seen so far are:

 

https://dmarceye.com/#pricing

https://www.uriports.com/pricing

 

..but no idea how good they are

[PrimaryNetMan]

https://dmarcreport.com free for a single domain.

[foofighterjim]

Question: does anybody have a school.county.sch.uk domain in cloudflare? I remember it being a total pain to find anyone that would host ours when the LA cut us loose (but that was quite a while ago).

 

Yes, I moved my previous school to Cloudflare back in 2023, they were on the standard school domain. I don't recall having any issues getting the domain setup on there at all, although that may have been helped by the fact that the domain hadn't been hosted by the LA but by our ISP for a number of years prior.

[Primus]

Question: does anybody have a school.county.sch.uk domain in cloudflare? I remember it being a total pain to find anyone that would host ours when the LA cut us loose (but that was quite a while ago).

(

 

Yes - you're not moving domain registrar just changing with the registrar which DNS servers are used.

[andy_b]

Been testing dmarceye.com for a couple of days - doesn't seem as useful as the NSCS service was, unless I am missing something.

 

It has nice charts - but maybe not enough detail?

[DavR]

I've just signed up for Postmark DMARC, but, it looks like it's actually just a weekly email digest - I don't think you get a console to view data and trends on.

[Driftingashore]

I don’t know if this will be helpful or just lead people down the wrong path, but I initiated a dns transfer on Cloudflare without actually going ahead and changing my name servers (so the domain shows as pending), but the option for DMARC is now available.. haven’t tested it yet, and not totally sure my the transfer won’t time out, but I may give it a shot..

[andy_b]

Just looking at Cloudflare, this might be a problem for us:

 

Currently, DMARC Management doesn't support subdomains. You can only use this feature with your zone top-level domain

[DavR]

Currently setting up a trial of DMARC Report (dmarcreport.com) which looks like it's got far more options and better analysis capabilities than Postmark.

 

Unfortunately though, it doesn't allow MTA-STS Reporting in the free tier. What are people doing with this, or are you a) confident enough in your MTA-STS setup to not bother reporting, or b) never got as far as setting this up in the first place?

 

We could probably just dump the reporting side of this, as I'm fairly sure it's working correctly. But that does make me a bit nervous, in case we ever make changes.