Start with the public-sector boundary
A UK government email requirement should be attached to a named organisation, domain and information-handling context. It should not become a claim that every UK company must deploy a particular DNS policy. The GOV.UK securing-government-email page, last updated 4 March 2024 and reviewed here on 8 November 2026, expressly covers internet email domains operated by public-sector organisations. It requires at least TLS and DMARC, alongside appropriate protection of the information exchanged. That is a government policy context, not evidence of a universal commercial-sector statute. GOV.UK policy.
Begin the applicability record with the organisation's legal identity and public-sector relationship. Add each sending and receiving domain, the service owner and the classification of information handled. A supplier's involvement needs its own contractual analysis: government customers and a familiar domain suffix do not, by themselves, identify every obligation that binds a supplier. Record the actual policy or agreement that carries the requirement into that service.
Read policy and configuration instructions together
The companion setup guide includes mailboxes, relays, filtering services and third-party transactional senders. Its authentication instructions cover inbound checking and staged outbound DMARC enforcement, with SPF and DKIM configuration. Treat a staged policy as an implementation step with an owner and exit criteria, rather than an indefinite definition of completion. The guide's March 2024 date also matters when evaluating its operational dependencies. Government email setup.
For information-classification context, Cabinet Office Guidance 1.5, version 2.0 dated 5 August 2024, identifies domain authentication and transport protections in its email controls. The OFFICIAL email column includes DMARC, DKIM, SPF, MTA-STS and TLS reporting; more sensitive tiers have different sharing arrangements. Do not detach that column from the surrounding classification table or present one internet-mail design as suitable for every classification. Security-adviser guidance.
Resolve the retired-service dependency
There is a concrete version problem in the source set. The older setup page still directs administrators towards NCSC Mail Check, including reporting and registration examples. NCSC's own retirement notice confirms that Mail Check and Web Check ended on 31 March 2026. Consequently, a current implementation plan cannot treat those older instructions as proof that the service remains available. This is a dependency reconciliation issue, not a reason to discard the underlying authentication controls. NCSC retirement notice.
Inventory report destinations, notification ownership and the service used to investigate failures. Identify which destinations belong to the organisation and which depend on retired or externally supplied processing. Propose a replacement only after assessing access, retention, confidentiality and cost. This article does not authorise changing reporting addresses or subscribing to a service. Retain old records and the approved transition plan so an auditor can distinguish a planned migration from an unexplained monitoring gap.
Build evidence around the actual mail flows
A useful control record has separate fields for the requirement, the intended setting and the observed result. Publishing a restrictive DNS policy proves neither that every legitimate application aligns nor that every recipient rejects spoofing. DMARC evaluates the Author Domain against an aligned authenticated identity; the current core specification is RFC 9989, published in May 2026. Its publication does not prove that every product has adopted its updated processing. Current DMARC specification.
Prepare an evidence plan covering staff mail, case-management notifications, public subscription messages and delegated senders. For each flow, identify the visible From domain, responsible team, signing service, report destination and impact if delivery fails. Preserve receiver observations only when an authorised test actually occurs. A spreadsheet cell saying configured should not silently become a successful delivery test. Keep incident reports and sensitive message content in approved repositories rather than embedding them in a public article.
Work through a fictional council example
Imagine a fictional council operating staff mail and a separate appointment-notification supplier. Its project initially records DMARC enforcement as complete because the staff domain has a restrictive policy. The proposed review finds an unanswered question: does the supplier use an aligned identity for appointment messages? No message has been inspected in this example, so the finding is an evidence gap, not a failed test.
The council's policy owner would first confirm the relevant public-sector scope. The messaging team would then define representative appointment flows and a controlled acceptance plan. The security team would separately verify that reports reach a maintained destination after Mail Check retirement. A completed supplier questionnaire would be useful preparation but would not replace the actual message evidence. Approval should name both the business owner accepting disruption risk and the operator permitted to change DNS.
Make exceptions and review dates explicit
An exception record should say which domain or route is affected, why the target control is not yet met, what compensating measures exist, and who can accept the residual risk. Add a review date and a trigger such as a supplier migration, classification change or retirement notice. Do not manufacture a statutory deadline from a webpage's last-updated date, or assume that historical assessment arrangements still apply because they remain in a change log.
The catalogue requires: An authority-to-control table reviewed by the appropriate regulatory or legal specialist. The accompanying map is an unapproved preparation of that table, not specialist review. Before publication, obtain UK policy and legal-owner confirmation, technical SME review of the service transition, and original operational evidence for any implementation claims. The full reader also leaves visual, production-route and owner-release gates open. No council, government system or report destination was accessed or changed for this article.