News & analysis
NCSC Mail Check migration guide: what to do now it's gone
NCSC Mail Check retired on 31 March 2026. A step-by-step guide to migrating your DMARC and TLS reporting to a replacement, without overpaying.
Shaun Cooke
Founder of SealedMail and a UK email-security specialist in DMARC, SPF, DKIM and email authentication for regulated sectors. He personally reads the DMARC and TLS reports behind every SealedMail account and writes the company's plain-English guides.
Explainer
Domain spoofing explained: how anyone can send email as you
Receiving a scam email “from your own address” feels like a breach. Usually nothing was hacked - email’s 1980s design simply lets anyone write any sender address. Here is how spoofing works, what each side sees, and the one control that ends it.
Explainer
What is DMARC? A plain-English guide
DMARC is the standard that tells the world's mail servers what to do with email pretending to be from your domain - and reports back on what they saw. Here is how it works, in plain English, with no diagrams to decode.
Explainer
What does a DMARC report actually show?
Add a reporting address to your DMARC record and the world's mail providers start sending you XML files daily. Here is what every field in those files actually means, why the raw format is unreadable at any scale, and what a useful translation looks like.
Explainer
What is SPF? The guest list for your domain's email
SPF is a public guest list of the servers allowed to send email for your domain. It is simple in concept and surprisingly easy to break in practice. Here is how it works, the 10-lookup limit that catches everyone out, and why SPF alone will not protect you.
Explainer
What is DKIM? The tamper-proof seal on your email
DKIM puts a tamper-proof seal on every email your domain sends - a cryptographic signature any receiver can verify. Here is how it works in plain English, why keys need rotating, and what it means when DKIM fails.
Explainer
What is TLS reporting? Knowing your encryption actually works
Your mail servers support encryption - but do the servers sending to you actually achieve it? TLS-RPT is the standard that tells you, in a daily report. Here is what those reports contain, and what an anomaly looks like.
Explainer
What is MTA-STS? Enforcing encryption for inbound email
Most email travels encrypted - but only politely, and a criminal in the middle can ask both servers to drop the encryption. MTA-STS removes that option. Here is how it works, why the NCSC recommends it, and why starting in testing mode matters.
Explainer
What is BIMI? The honest guide to logos in the inbox
BIMI displays your verified logo next to your emails in Gmail, Apple Mail and Yahoo. It is real, it works - and for most small UK businesses the costs outweigh the benefit. Here is the complete, honest picture, including what the certificates cost.
Transparency
What happens to your DMARC data? A transparency post
Before pointing your DMARC reports at any provider, you should know exactly what you are handing over. Here is the complete answer for SealedMail: what arrives, what is stored, for how long - and the email content and personal data that were never in the reports at all.
Explainer
Email blacklists: what they are and how to check yours
Hundreds of shared registers quietly grade your domain’s reputation, and the world’s mail servers consult them millions of times a second. Here is how blacklisting happens, what it does to your email, and how to find out - for free - whether you are listed.
