Does Cyber Essentials require DMARC? No, and here is what it does cover.
The current Cyber Essentials requirements contain no DMARC, SPF or DKIM control, and neither does Cyber Essentials Plus. Any proposal that says otherwise will not survive contact with an assessor.
That does not make DMARC optional for your clients. It means it needs a different, honest reason, and for most UK organisations there is a better one available.
Five technical controls, none of them about email authentication.
Version 3.3 of the requirements was published in April 2026 and took effect on 27 April 2026. The scheme is administered by IASME on behalf of the NCSC.
Firewalls
Boundary and host firewalls configured to block unauthorised access.
Secure configuration
Default settings and accounts removed, unnecessary software disabled.
Security update management
Supported software, with high and critical updates applied promptly.
User access control
Accounts and privileges limited to what people need, with strong authentication.
Malware protection
Measures that stop malicious software running on in-scope devices.
help Why email authentication is not in there
Cyber Essentials is about the devices, accounts and boundaries an organisation controls, and about stopping common internet-borne attacks against them. DMARC works somewhere else entirely: it is a record published in public DNS that tells other people's mail servers what to do with mail claiming to be you.
In other words, Cyber Essentials protects you from being compromised. DMARC protects everyone else from being fooled in your name. They answer different questions, which is why one does not appear in the other.
Two UK documents name DMARC. Cyber Essentials is not one of them.
Public sector email
GOV.UK's Securing government email guidance says public sector organisations must have DMARC, DKIM and SPF in place. It is policy guidance rather than statute.
Public sector page →NHS and NHS suppliers
The Data Security and Protection Toolkit, Standard 6, names DMARC, DKIM and SPF, and is binding through the NHS standard contract and data-sharing agreements.
NHS page →Everybody else
No UK law requires a private business to publish a DMARC record, including the FCA Handbook and the SRA rules. The pressure comes from mailbox providers and procurement instead.
UK overview →Sell DMARC next to Cyber Essentials, not inside it.
Many UK MSPs run Cyber Essentials projects for their clients. That engagement is a natural moment to raise DMARC, as long as it is positioned as its own control with its own reason.
The strongest reason is not regulation. Google has required bulk senders to publish a DMARC policy since February 2024, and mailbox providers have tightened enforcement since. A client whose invoices stop reaching Gmail recipients calls you the same week, certificate or not.
The second reason is procurement. Supplier security questionnaires increasingly ask how an organisation stops its domain being spoofed. Cyber Essentials answers a lot of those questionnaires; it does not answer that line.
The third is your own credibility. An MSP that tells a client DMARC is a Cyber Essentials requirement will be corrected by the assessor: in front of the client. Saying "this is not part of the certificate, and here is why you need it anyway" is the version that holds up.
A clean way to scope it
- check_circleRun the Cyber Essentials work as scoped by the scheme.
- check_circleAlongside it, audit every domain the client owns with a DMARC check and show them the result.
- check_circleQuote DMARC as a separate line: monitoring, then enforcement in order,
p=none,p=quarantine,p=reject. - check_circleReport on it monthly, so the client sees value between annual renewals.
The rest of the UK cluster.
By sector
Questions UK MSPs ask us.
Does Cyber Essentials require DMARC, SPF or DKIM? add
No. The current Cyber Essentials requirements, version 3.3, published in April 2026 and effective from 27 April 2026, contain no DMARC, SPF or DKIM control. The five technical controls are firewalls, secure configuration, security update management, user access control and malware protection.
What about Cyber Essentials Plus? add
Cyber Essentials Plus tests the same five controls with a hands-on technical audit. It does not add an email-authentication requirement, so the answer is the same: DMARC is not part of it.
Will DMARC help us pass Cyber Essentials? add
Not directly. It will not be assessed and it will not compensate for a gap in one of the five controls. Treat it as a separate control with its own reason: protecting the people who receive mail in your name, and keeping your mail out of spam folders now that major mailbox providers expect a DMARC policy from bulk senders.
So where is DMARC actually required in the UK? add
In two places. GOV.UK’s “Securing government email” guidance says public sector organisations must have DMARC, DKIM and SPF in place. And the NHS Data Security and Protection Toolkit names DMARC, DKIM and SPF under Data Security Standard 6, which binds NHS bodies and suppliers that handle patient data.
For private businesses there is no legal requirement. The pressure comes from mailbox providers and from supplier security questionnaires.
How should an MSP position DMARC alongside a Cyber Essentials project? add
As a separate line item. Run the Cyber Essentials work as the scheme scopes it, audit the client’s domains for DMARC at the same time, and quote monitoring and enforcement as their own service. Saying “this is not part of the certificate, and here is why you need it anyway” holds up in front of an assessor; claiming it is a Cyber Essentials requirement does not.
Add DMARC to the conversation the honest way.
Start a free trial, audit a client's domains, and show them real sender data inside 48 hours. Transparent MSP pricing from just £1 per domain per month, with volume-based pricing where the per-domain price falls as you add domains.