How to Audit a UK Client Domain
Eight steps, in a fixed order, using free checkers. This is the sequence rather than the tour: what to run, what the result actually tells you, and the UK-specific traps that turn a clean-looking lookup into a wrong conclusion.
It is written for the situation most UK MSPs are in — a domain you have just been handed, a client who is not certain which platforms send on their behalf, and half an hour to work out how bad it is.
Eight steps, and the order is the point.
Most people start at the DMARC record because that is the thing they were asked about. That is step two, not step one — you cannot judge a record before you know what else is in the zone, and you cannot choose a policy before you know who sends.
Inventory the zone
DNS lookup →Resolve A, MX, TXT and NS before you look at anything else. The MX shows where mail lands, the TXT records reveal which platforms have been verified against the domain, and the nameservers tell you who genuinely controls DNS — which is not always the party you were told holds it. On a UK client this is also where the legacy brand domains surface: the rebrand that never finished, the campaign name an agency registered years ago and still resolves.
Read the DMARC record
DMARC checker →
Retrieving the record is the easy half. Interpreting it is four questions in order: is there a record at all; is it p=none, which collects data and protects nothing; is there a rua= address, without which nothing is being collected either; and is a legacy pct= tag still sitting in it.
A blank result is normal rather than remarkable. Our August 2026 research across 8,724 UK MSP domains found 52.5% of those providers’ own domains unprotected — so the baseline you are auditing against is lower than clients assume.
Check where the mail actually goes
MX from step 1 →Go back to the MX records you already pulled. Microsoft 365 dominates UK estates — among the domains in our sample that receive mail at all, 59.4% use it — so the odds are you are looking at a Microsoft tenant. What matters more is whether a security gateway sits in front of it, filtering inbound before Microsoft sees it. Note that now, because it changes how you read step seven.
Validate SPF
SPF analyzer →The ten-lookup limit is the usual failure, and UK estates reach it in a predictable way: a hosting provider include, a security gateway include and a marketing platform include, stacked on top of the mail platform’s own. Past ten lookups the record returns a permanent error and SPF stops passing for everybody, forged and legitimate alike. A count of eight or nine is not a pass — it is one new supplier away from an outage.
Validate DKIM
DKIM validator →You need the selector, and every third-party sender publishes its own. A client on Microsoft 365 with a payroll bureau and an invoicing platform may have three or four selectors in use simultaneously. This is why a missing selector is not proof of absence — far more often it means you guessed the name wrong. Record the selectors you can confirm, and treat the rest as unknown rather than as evidence that nobody else signs.
Check transport security
MTA-STS check →MTA-STS covers the connection between mail servers rather than the authenticity of the message, and it is the half of the picture the free NCSC Email Security Check also reports on. A public sector client, or a supplier who ran that check while answering a tender, may already have been told about a missing policy. Confirm the policy file is genuinely served over HTTPS and that its mode matches what the DNS record claims.
Prove it with a real message
Email header analyzer →Everything above this line is configuration. Paste a genuine header from a message the client actually sent and you find out what the receiver concluded. This is where a gateway sitting in front of Microsoft 365 announces itself: the published records look correct, and the headers record a different outcome because something rewrote the envelope in transit. When the record and the header disagree, believe the header.
Decide the next policy step
DMARC generator →Only now is there enough evidence to choose a policy and compose the record. The rollout runs in one direction:
p=nonep=quarantinep=reject
Since DMARCbis removed pct=, each step is all-or-nothing — there is no partial ramp to hide an unidentified sender behind. If step five left senders unconfirmed, the honest recommendation is still monitoring.
Useful either side of the audit — but not part of it.
These two get pulled into audits regularly and neither belongs there. One comes before you have a client, the other comes long after the record is finished.
BIMI comes at the end
A BIMI record does nothing until the domain is at full enforcement, so composing one during an audit is composing something that cannot take effect yet. Treat it as the reward at the end of a rollout: the client sees their logo in the inbox because the authentication work was completed, not instead of it. UK trademark holders register with the Intellectual Property Office if a Verified Mark Certificate is in scope.
The spoof test is for the unconvinced
A spoof test demonstrates the risk rather than measuring it. It earns its place in front of a client who has read the audit findings and still does not think the exposure is real — a message that arrives in their own inbox, apparently from their own finance address, tends to end that conversation. It is a persuasion tool, so use it before the work is approved, not during the diagnosis.
What this audit tells you that a single lookup does not — and what it still cannot.
Running all eight steps gives you a defensible picture of how a domain is configured today. It does not tell you who is sending as that domain, and no amount of checking will, because that information only exists in the reports receivers send back. That is the gap continuous monitoring exists to fill.
A checker gives you configuration
Point-in-time truth about what is published: the record exists, the syntax is valid, the lookup count is within limits, the policy is what it is. All of that is verifiable from outside, in seconds, without the client’s cooperation. That is precisely what makes it useful for a prospect audit.
Only reports give you behaviour
Which platforms actually send as the domain, how many messages they send, and which of them fail alignment. In our August 2026 sample, 43.2% of the UK MSP domains measured collected no aggregate reports on their own domain at all — so for a large share of domains, nobody has this half of the picture.
Why the order of the two matters
The audit tells you whether it is safe to publish a monitoring record today. The reports that record collects then tell you whether it is safe to move to enforcement in a month. Skipping the first produces a broken record; skipping the second produces a confident move to p=reject that stops a client’s invoices reaching anyone.
Three things that catch people out on UK domains.
The protocols behave identically on a UK domain. What differs is the shape of the names, and each of these has produced a wrong conclusion in a real audit.
The public-suffix boundary
For example.co.uk the organisational domain is example.co.uk, not co.uk. The suffix itself is not an organisational domain at all, so no record published there covers anything beneath it.
Practically: every client domain needs its own record, there is no portfolio-wide shortcut, and the same applies to .org.uk, .ac.uk and .sch.uk.
.co.uk.org.uk.sch.uk
Lookalike registrations never align
UK clients accumulate near-identical names: a hyphenated variant bought during a rebrand, a campaign domain registered by an agency, a shortened form used on vehicle livery. Each one is a separate organisational domain.
They will never align with the main domain no matter how similar they look, so step one has to enumerate them. A domain the client forgot they owned is still a domain someone can send from.
Subdomain policy via sp=
Where a subdomain has been delegated to a third party — a booking platform, a fundraising page, a school portal — the organisational domain’s policy applies to it unless sp= says otherwise.
That is how a forgotten subdomain gets quarantined the week after the parent moves to enforcement. Check for delegated subdomains during step one and decide the subdomain policy deliberately, rather than inheriting it by accident.
It covers
The NCSC’s Email Security Check is an on-demand lookup of a domain’s anti-spoofing configuration and its transport privacy. It is free, it is quick, and it overlaps with steps two, four and six above. If a client has already run it, the findings are a reasonable place to start the conversation.
It does not cover
It does not ingest DMARC aggregate reports. That means it cannot tell anyone which platforms are sending as the domain or which of them fail alignment — the behaviour half of the picture. Mail Check and Web Check — where UK organisations previously got report parsing for free — were retired on 31 March 2026.
Say it plainly on public sector work
DMARC AI is not NCSC-approved, endorsed or certified, and neither is any other commercial platform — the NCSC published a vendor-neutral buyer’s guide and left the choice to the buyer. Any supplier claiming an endorsement is misrepresenting the position, which is worth knowing before a tender response quotes one.
The rest of the UK cluster.
By sector
Questions UK MSPs ask us.
Are the DMARC, SPF and DKIM checkers free to use? add
Yes. The DNS lookup, DMARC checker, SPF analyzer, DKIM validator, MTA-STS check, header analyzer, DMARC generator and BIMI generator are all free, with no account required, and there is no cap that turns an audit into a sales call halfway through.
The monitoring platform is a separate thing and is paid: transparent MSP pricing from just £1 per domain per month, with volume-based pricing where the per-domain price falls as you add domains. There is no free tier on the platform — a free trial only, which we would rather state plainly than advertise a free plan that stops being useful at the point you need it.
Do the tools work properly on .co.uk and .org.uk domains? add
Yes, and the protocols behave identically. The thing to get right is the organisational-domain boundary, because UK second-level suffixes put it one label further down than people expect.
For example.co.uk the organisational domain is example.co.uk, and its DMARC record lives at _dmarc.example.co.uk. The suffix co.uk is a public suffix, not an organisational domain — nobody publishes a record there that covers the domains beneath it. The same applies to .org.uk, .ac.uk, .gov.uk and .sch.uk.
The practical consequence for an MSP is that there is no portfolio-wide shortcut. Every UK client domain needs its own record, its own sender inventory and its own policy decision.
Is a DMARC checker enough on its own? add
No, and the distinction is worth being precise about, because it is the difference between a safe rollout and a broken one. A checker gives you configuration: what is published right now, whether the syntax is valid, whether the SPF lookup count is inside the limit, what the policy says.
It cannot give you behaviour — which platforms are actually sending as the domain, how much they send, and which of them fail alignment. That information only exists in the aggregate reports receivers send back, and it is the half you need before moving a domain to enforcement.
Since DMARCbis removed the pct= tag, each policy step is all-or-nothing. Moving to p=reject on the strength of a configuration check alone is how a client discovers that their invoicing platform was never aligned.
What does the free NCSC Email Security Check do, and what does it not do? add
It is an on-demand lookup of a domain's anti-spoofing configuration and its transport privacy. It is free and quick, and it overlaps with the DMARC, SPF and MTA-STS steps of the workflow on this page. If a UK public sector client or one of their suppliers has already run it, its findings are a sensible starting point for the conversation.
What it does not do is ingest DMARC aggregate reports, so it cannot tell you who is sending as the domain. Mail Check and Web Check — where UK organisations previously got report parsing at no cost — were retired on 31 March 2026.
To be explicit, because it comes up on public sector work: DMARC AI is not NCSC-approved, endorsed or certified. The NCSC does not endorse individual DMARC products.
How often should I re-run an audit on a client domain? add
Run the full eight-step workflow at onboarding, and again whenever something changes that could move a record: a new marketing platform, a migration, a rebrand, an acquisition, or a supplier switch that adds an SPF include. Those events are what push an estate past the ten-lookup limit, and they rarely arrive with a change ticket.
Beyond that, a quarterly pass over the portfolio catches drift. It is genuinely quick once you have a baseline, because you are looking for differences rather than reading everything again.
A point-in-time audit is not a substitute for monitoring, though. Aggregate reports arrive daily and will surface a new sender long before a quarterly re-check would.
Can I audit a domain I do not control? add
The first six steps, yes. DNS records, DMARC and SPF policies, DKIM public keys and MTA-STS policies are all published deliberately for anyone to read, so checking them requires no access and no permission. This is exactly what makes the workflow usable for a prospect audit before you have won the account.
Two steps do need cooperation. The header analysis needs a real message from the domain, which somebody has to send you or forward to you. Publishing or changing a record needs DNS access.
Aggregate reports are the same: they are delivered to the address in the rua= tag, so you can only receive them for a domain whose DNS you can edit.
You have audited the domain. Now find out who is sending.
The checkers tell you how a domain is configured. Point the aggregate reports at DMARC AI and you get the other half — every sender, named, within about 48 hours. Transparent MSP pricing from just £1 per domain per month, with volume-based pricing where the per-domain price falls as you add domains.