Cyber Essentials Email Security Checklist

Cyber Essentials is the UK government-backed certification scheme run by the National Cyber Security Centre (NCSC). It is mandatory for suppliers bidding for certain UK government contracts and increasingly required across the supply chain. Cyber Essentials Plus adds a hands-on technical audit on top of the self-assessment.

This guide covers what the scheme expects for email security, what the technical controls look like, and how to verify your domain meets the bar before your assessment.

What Cyber Essentials Covers

The Cyber Essentials scheme focuses on five technical control categories:

• Firewalls and internet gateways
• Secure configuration
• User access control
• Malware protection
• Patch management

Email authentication (SPF, DKIM, DMARC) is not one of the five primary control areas. However, phishing protection sits under malware protection and secure configuration — and the NCSC's own guidance consistently recommends DMARC, DKIM, and SPF as baseline controls for any organisation.

Cyber Essentials Plus and Phishing Tests

Cyber Essentials Plus includes a simulated phishing assessment. Assessors send test phishing emails to your organisation and check whether your technical controls prevent them from being delivered or acted upon. A domain with a strong DMARC policy makes it significantly harder for spoofed emails to reach your staff.

In practice, assessors also review your domain's email configuration as part of the wider audit. Missing or weak email authentication records will be noted, even if they don't directly cause a certification failure.

The NCSC's Email Security Baseline

The NCSC publishes its own email security guidance separately from the Cyber Essentials scheme. Their recommended baseline for all UK organisations includes:

• SPF — a TXT record specifying which servers can send email for your domain, with -all (hardfail) as the recommended mechanism
• DKIM — a cryptographic signature on outgoing emails, with a 2048-bit key minimum
• DMARC — a policy record that ties SPF and DKIM together; the NCSC recommends moving to reject as the end state
• TLS — encrypted connections for both web (HTTPS) and mail (STARTTLS) — TLS 1.2 minimum, TLS 1.3 preferred
• DMARC reporting — an rua address so you receive aggregate reports on who is sending email from your domain

The Full Cyber Essentials Email Checklist

Before your Cyber Essentials assessment, verify the following for every domain your organisation uses to send email:

• SPF record present with -all and under 10 DNS lookups
• DKIM configured for your email provider — 2048-bit RSA key or Ed25519. If you use Google Workspace, check the google selector. For Microsoft 365, check selector1 and selector2
• DMARC policy at quarantine or reject — not none
• DMARC reporting — an rua address configured
• SSL certificate valid, not expiring within 30 days, TLS 1.2 or higher
• HSTS header present on all web properties
• X-Content-Type-Options and X-Frame-Options headers set

Don't forget parked or legacy domains — attackers frequently spoof inactive domains that have no email authentication configured, because they know these are typically unmonitored.

You can run a full check against any domain in seconds using PostureCheck — it covers all of the above with no sign-up required.

Check your domain for free

SPF · DKIM · DMARC · SSL · Security Headers