DMARC for UK Charities
When a commercial brand is impersonated by email, the company loses a little trust. When a charity is impersonated, the person who loses money is usually a supporter or a beneficiary — somebody who gave because they recognised the name on the message.
That is the whole argument for this page, and we would rather state it once and then be useful. Below: what the Charity Commission actually says, which part of the problem DMARC solves, and how to do it with no IT team and very little money.
The Charity Commission does not require DMARC.
It does not require SPF or DKIM either. Its guidance names no email-authentication protocol anywhere. If you have been told that a regulator expects your charity to publish one, that claim has no source behind it, and it is worth knowing that before you spend anything.
What the guidance covers
Internal financial controls for charities (CC8) was first published on 1 July 2012 and last updated on 27 November 2024. It is about how money moves through a charity and who checks it — authorisation, segregation of duties, reconciliation.
The cyber material is behavioural
Protect your charity from cyber crime, published 27 November 2024, and the companion fraud guidance updated the same day, are written for people rather than for systems: recognise a phishing email, know what to do if it happens.
Where the technical detail went
The Commission defers to the NCSC for the how-to, pointing to the free Cyber Action Toolkit and 10 Steps to Cyber Security, and for medium and large charities to the government's Cyber Governance Code of Practice and Cyber Essentials. NCSC guidance is where DMARC, SPF and DKIM appear.
info One thing Cyber Essentials will not do for you
Because the guidance points at Cyber Essentials, charities sometimes assume certification settles the email question. It does not. The current requirements — v3.3, April 2026, effective 27 April 2026, administered by IASME — cover firewalls, secure configuration, security update management, user access control and malware protection. There is no DMARC, SPF or DKIM control among the five.
A charity domain buys an attacker something a shop domain cannot.
Recognition and goodwill are the assets a charity has spent years building, and they transfer intact to anyone who can put the domain in a From header. Four things make the sector particularly usable.
People are expecting to be asked for money
An unsolicited payment request from a retailer looks odd. From a charity a supporter already gives to, it is the normal shape of the relationship, which removes the moment of doubt an attacker would otherwise have to overcome.
Appeals are urgent by design
Emergency appeals, match-funding deadlines and campaign closing dates are public, and they legitimise exactly the urgency a fraudster needs. Nobody thinks twice about a message that says the deadline is Friday.
Money correspondence is routine
Gift Aid declarations, direct debit confirmations, legacy and payroll giving administration, grant correspondence with funders. Real messages about bank details already exist, so an imitation of one does not stand out.
Beneficiaries may be easier to reach
Charities often correspond with people who are unwell, isolated, in financial difficulty or new to the country. Mail carrying your name arrives with a level of trust you built and cannot transfer away.
None of that requires an attacker to have breached anything of yours. An unprotected domain is usable by anyone who can type it.
DMARC solves one third of this problem. Here is which third.
Three quite different attacks reach a supporter looking almost identical. They need different defences and only one of them is a DNS problem. A charity that buys DMARC believing it covers all three has bought a smaller thing than it thinks.
Both .org.uk and .co.uk are public suffixes, so the organisational domain for example.org.uk is that entire name. A separate registration such as example-appeal.org.uk can never align with yours, and nothing you publish has any authority over it.
balance Why we are telling you the limits
Charity budgets are finite, so an honest account of scope matters more here than almost anywhere. One third of a problem, solved cheaply and permanently, is a good purchase. Sold as the whole answer, it displaces spending that should have gone on account security.
visibility The part nobody expects to value
Aggregate reports list every system sending as your domain — including the fundraising platform a volunteer signed up for and the events tool from a campaign three years ago. Most charities find the inventory more useful than the blocking.
Not a requirement. A reasonable step you can show you took.
The Commission's guidance interprets a general duty of reasonable care rather than setting a cyber standard. That distinction is worth keeping straight in a trustee meeting, because it changes what the decision is actually about.
CC8 opens from the duty rather than from a control list. In the Charity Commission's words: "You and your fellow trustees must manage your charity's resources responsibly." Everything in the guidance sits underneath that sentence, and none of it descends to naming a protocol.
What that means for the board paper
- check_circleThe question in front of trustees is proportionality, not compliance. A low-cost, low-risk control that reduces a known route to supporter fraud is an easy proportionality argument.
- check_circleRecord the decision and the date. A dated minute showing the risk was considered and a step was taken is worth considerably more than a screenshot produced afterwards.
- check_circleName an owner. The commonest failure is not the absence of a record but the absence of anyone whose job it is to look at the reports next quarter.
- check_circleDo not write "required by the Charity Commission" in the paper. It is not true, and the first trustee who checks will discount everything else in the risk register.
Stated plainly: DMARC AI has no affiliation with the Charity Commission, the NCSC or IASME, and is not approved, endorsed or accredited by any of them. Nothing here is legal or regulatory advice, and we are not going to tell you what your duties as a trustee are. Where that question matters, take it to your auditor, your independent examiner or your own adviser.
Four steps, in order, none of them expensive.
Most charities doing this have no dedicated IT staff and a finance manager who already has two other jobs. The sequence below is designed for that, and the order matters more than the speed.
Find out who holds the DNS
Often it is the web agency, a former volunteer, or an account nobody has the password to. Half the charities that stall on this stall here, so resolve it before anything else. While you are there, list every domain the charity owns, including old campaign and merger names.
Publish monitoring and just watch
A p=none record with a working reporting address changes nothing about how your mail is delivered. Leave it for a full month and let the reports tell you which systems send as you, rather than assembling the list from memory.
Fix the senders you want to keep
Expect a longer list than you thought: the donation platform, the mailing tool, the events booking system, the accounts package that emails remittances, a CRM someone trialled. Each needs its authentication set up properly in that supplier's own settings.
Move to enforcement once, properly
Then p=quarantine, then p=reject. DMARCbis removed the percentage tag in RFC 9989, published May 2026, so each step applies to all of your mail or none of it. The completeness of step three is the only safety net there is.
savings What it costs, and what changed about the free option
The NCSC retired Mail Check and Web Check on 31 March 2026, announced on 6 November 2025 after the services had run since 2017. Users no longer receive findings, and the NCSC pointed people towards commercial products through a vendor-neutral buyer's guide. Early Warning and DNS Check continue via MyNCSC.
The free Email Security Check is still there and worth running today: an on-demand lookup of your anti-spoofing configuration and transport privacy. It does not ingest aggregate reports, so it cannot tell you who is sending as you.
For continuous reporting, transparent MSP pricing from just £1 per domain per month, with volume-based pricing where the per-domain price falls as you add domains. There is no free tier, only a free trial.
Deliverability, not just security.
Supporter lists are overwhelmingly personal addresses, which is exactly where the bulk sender rules apply. For a fundraising team the practical consequence has nothing to do with spoofing: it is whether the appeal arrives at all.
The threshold is lower than it sounds
Since 1 February 2024, senders of 5,000 or more messages a day to personal Gmail accounts must have SPF, DKIM and DMARC with a policy of at least p=none, keep spam complaints below 0.3% and offer one-click unsubscribe on marketing mail. One appeal to a modest list clears that in an afternoon.
Enforcement has hardened
From November 2025 Gmail escalated enforcement, moving from temporary rejections to permanent ones for senders that stay out of line. Microsoft has published comparable requirements for high-volume senders. Neither of them will telephone your fundraising manager first.
It is the same piece of work
Fixing authentication so an appeal lands and fixing it so a fraudster cannot use your name are the same four steps. If the security case has not moved your board, the deliverability case usually does, and it buys the same control.
Doing it yourself, or asking someone to do it
Plenty of charities run this in-house once the first month of reports has been read. Others hand it to whoever already looks after their systems — an IT provider, a shared services arrangement, or a trustee with the right background. Either way the platform and the price are the same.
Neighbouring sectors with a similar picture: schools and academy trusts, councils and public bodies, and health and care, which is the one UK sector where DMARC is named in a requirement document. Replacing the retired NCSC service: the Mail Check replacement page.
The rest of the UK cluster.
By sector
Questions UK MSPs ask us.
Does the Charity Commission require charities to have DMARC? add
No. The Charity Commission does not require DMARC, and it does not require SPF or DKIM either. Its guidance names no email-authentication protocol anywhere, so any supplier suggesting otherwise is describing a requirement that does not exist.
The relevant guidance is "Internal financial controls for charities (CC8)", first published on 1 July 2012 and last updated on 27 November 2024, alongside "Protect your charity from fraud" and "Protect your charity from cyber crime". The cyber material is behavioural rather than technical — recognising a phishing email, knowing what to do if the charity is targeted — and it defers to the NCSC for the technical how-to, pointing at the free Cyber Action Toolkit and 10 Steps to Cyber Security. NCSC guidance is where DMARC, SPF and DKIM appear.
The honest summary: the Commission treats cyber fraud as a trustee-duty question and leaves the controls to you.
How does this relate to our duties as trustees? add
CC8 works from a general duty rather than a control list. In the Charity Commission's words: "You and your fellow trustees must manage your charity's resources responsibly." Nothing beneath that sentence descends to naming a technology.
That makes the board question one of proportionality rather than compliance. A low-cost, low-risk control that closes a known route to supporter fraud is a straightforward proportionality argument, and a dated minute recording that the risk was considered is worth more than anything produced afterwards.
We are deliberately not going further than that. What your duties as a trustee require in your particular circumstances is a question for your auditor, your independent examiner or your own adviser. DMARC AI has no affiliation with the Charity Commission and nothing here is legal or regulatory advice.
Who actually loses money when a charity domain is spoofed? add
Usually a supporter or a beneficiary rather than the charity itself. The message reaches somebody who recognises the name, is already expecting to be asked for money, and has no way of telling that the sending server was not yours.
That is the practical difference from a commercial brand being impersonated. The goodwill the charity built is the thing being spent, and it is spent on the people the charity exists to serve or to thank.
The fix is unglamorous and cheap: authenticate the systems that genuinely send as you, publish an enforcing policy so nothing else can, and put a permanent line on your donate page saying your bank details never change by email.
Will DMARC stop people impersonating our charity? add
It stops one of the three ways it happens, and being precise about which one matters more when budgets are tight.
DMARC at an enforcing policy stops a spoof of your exact domain — somebody sending from their own server with your real domain in the From header. Once your genuine senders authenticate, receiving providers stop delivering those messages.
It does nothing about a stolen login. If an attacker has a fundraiser's password, the mail really is from your domain, authenticates cleanly and passes every check there is. That needs multi-factor authentication on every account, volunteers and trustees included, and someone checking for new mailbox forwarding rules.
It also does nothing about a domain the attacker registered. Because .org.uk and .co.uk are public suffixes, the organisational domain for example.org.uk is that whole name, and a separate registration such as example-appeal.org.uk belongs entirely to them. Watching for new registrations near your brand is a different control.
We have no IT staff and almost no budget. Is this realistic? add
Yes, and it is one of the cheaper things on a charity risk register. The work is four steps in order, and the order matters more than the speed.
First, find out who actually controls your DNS — often a web agency or a former volunteer — and list every domain the charity owns, including old campaign and merger names. Second, publish a p=none record with a working reporting address; this changes nothing about how your mail is delivered, so it is safe to leave running for a month. Third, use those reports to fix authentication for the systems you want to keep: the donation platform, the mailing tool, the events booking system, the accounts package.
Only then move to p=quarantine and p=reject. DMARCbis removed the percentage tag in RFC 9989, published May 2026, so each step applies to all of your mail or none of it — which makes the completeness of that sender list the only safety net you have.
On cost: transparent MSP pricing from just £1 per domain per month, with volume-based pricing where the per-domain price falls as you add domains. There is no free tier, only a free trial.
Is there still a free way to check this now Mail Check has gone? add
Partly. The NCSC retired Mail Check and Web Check on 31 March 2026, announced on 6 November 2025 after the services had run since 2017. Users no longer receive findings, and the NCSC pointed people towards commercial products through a vendor-neutral buyer's guide. Early Warning and DNS Check continue via MyNCSC.
The free Email Security Check remains and is worth running today. It is an on-demand lookup of your anti-spoofing configuration and transport privacy, so it will tell you whether your records are present and sensible. It does not ingest aggregate reports, which means it cannot tell you which systems are sending as your domain — and that inventory is the part most charities find genuinely useful.
Cyber Essentials does not fill the gap either. The current requirements — v3.3, April 2026, effective 27 April 2026, administered by IASME — cover firewalls, secure configuration, security update management, user access control and malware protection. No DMARC, SPF or DKIM control appears among them.
We email thousands of supporters during an appeal. Does that change anything? add
It moves the deadline. Since 1 February 2024, senders of 5,000 or more messages a day to personal Gmail accounts must have SPF, DKIM and DMARC with a policy of at least p=none, keep spam complaints below 0.3% and offer one-click unsubscribe on marketing mail. Supporter lists are overwhelmingly personal addresses, so one appeal to a modest list clears that threshold in an afternoon.
From November 2025 Gmail escalated enforcement, moving from temporary rejections to permanent ones for senders that stay out of line. Microsoft has published comparable requirements for high-volume senders.
The useful part is that this is the same piece of work. Authenticating your senders so the appeal lands and authenticating them so a fraudster cannot use your name are one job, done once. If the security case has not persuaded your board, the deliverability case often does.
Find out who is already sending as your charity.
Start a free trial, point the aggregate reports at DMARC AI, and get a dated list of every system sending as each of your domains inside 48 hours. Transparent MSP pricing from just £1 per domain per month, with volume-based pricing where the per-domain price falls as you add domains.