For organisations that used Mail Check and Web Check
Mail Check and Web Check have closed. Keep an eye on your domains.
The NCSC retired Mail Check and Web Check on 31 March 2026 and suggests organisations use a commercial tool instead (NCSC announcement). Domain Detective checks the email and website settings of the domains you choose, keeps watching them, and tells you when something changes.
No account needed: 2 free checks a day from the website. A free account gives you 3 a day.
Domain Detective is an independent service, not connected to or endorsed by the NCSC.
What Domain Detective checks
- DMARC, SPF and DKIM records: whether they are published and valid, and an alert if a policy is weakened or removed.
- DMARC aggregate reports: the daily reports mail providers send, turned into which services send mail as your domain and how much of it passes. Each workspace has its own reporting address.
- MTA-STS record and mail servers (MX), with an alert when they change.
Website
- HTTPS certificate: who issued it, the names it covers and a warning before it expires; an alert when a new certificate is issued for the domain by a certificate authority it hasn't used before.
- TLS versions accepted, HTTP to HTTPS redirection, HSTS and other security headers.
- Uptime and response time, third-party scripts and trackers added to the home page, and robots.txt rules that would hide the site from search engines.
Domain and DNS
- Name servers, address records, CAA and DNSSEC; whether every name server gives the same answer.
- Registration: registrar, expiry date and registry lock, with reminders before it expires.
Every change is confirmed by a second check before an alert goes out, and kept as a history you can compare. See a sample report and exactly what our checker does.
What it doesn't do
- No vulnerability scanning, port scanning or login attempts: it reads public records and makes ordinary requests to the home page.
- It does not test your mail servers' own encryption (STARTTLS) or certificates.
- Checks come from one server in the UK, so uptime is seen from there, not from around the world.
If you need those, NCSC's announcement links to a buyer's guide for external attack surface management products.
Moving over
- Run a free check on your main domain to see where things stand.
- Create an account and add the domains you want watched, choosing how often each is checked.
- To receive DMARC reports, add your workspace's reporting address (shown on the DMARC reports page) to each domain's DMARC record.
- Choose who gets alerts, by e-mail, Slack, Teams or webhook. Plans and prices.
Questions
When did Mail Check and Web Check stop?
The NCSC retired both services on 31 March 2026. Organisations subscribed to Early Warning and DNS Check continue to receive those findings through MyNCSC.
Is Domain Detective connected to the NCSC?
No. Domain Detective is an independent service. It is not provided, endorsed or approved by the NCSC.
Can I try it without an account?
Yes. A check from the website needs no account, and a free account gives more checks a day. Monitoring and alerts are part of the paid plans.
Does it receive DMARC reports?
Yes. Each workspace has its own reporting address to add to a domain's DMARC record. Reports are only accepted for domains you monitor whose DMARC record names your address, and reports can also be uploaded.
Does it scan for vulnerabilities?
No. It reads public records and makes ordinary requests to the home page. It does not scan ports, test for software vulnerabilities or try to log in.