Web Check and Mail Check have closed: what the NCSC says small businesses should do now

If you ever signed up to the NCSC's free Web Check or Mail Check, the alerts have stopped. The National Cyber Security Centre retired both services on 31 March 2026. Nothing breaks on your website or email when a monitoring service goes, which is exactly why it is easy to miss. This post explains what changed, what still exists for free, and what a small business can sensibly do about the gap.

What was retired, and what was not

The NCSC's own pages are clear: Mail Check and Web Check were retired on 31 March 2026, and users no longer receive findings related to those services. Mail Check helped organisations check their email set-up, covering SPF, DKIM, DMARC and TLS. If you relied on either as your only warning system, you now have no warning system from the NCSC for those areas.

Two other services are unaffected. The NCSC says Early Warning and DNS Check carry on, and organisations subscribed to them keep receiving findings through their MyNCSC accounts.

Early Warning: still free, still worth five minutes

Early Warning is a free NCSC service that emails alerts about potential cyber attacks on an organisation's network. Any organisation based in the UK can sign up. You need a free MyNCSC account, your organisation's name, your public IP addresses and domain names, and contact details for whoever should receive alerts (at least a name and email address). The NCSC says setup takes about five minutes.

It sends three kinds of alert:

• Incident notifications, which suggest an active compromise, such as a device infected with malware.
• Network abuse events, which show your assets linked to malicious activity, such as a machine scanning the internet.
• Vulnerability and open port alerts, which flag vulnerable services or unwanted applications exposed to the internet.

Two limits matter. First, Early Warning does not scan your networks itself. The NCSC says it uses information from other networks, so it can only tell you about things that show up there. Second, the NCSC states it should complement your existing security controls, not be your only layer of defence. Treat it as a smoke alarm, not a locked door.

One practical point: an alert is only useful if someone reads it. Send it to a shared mailbox that more than one person checks, or to your IT provider, not to the inbox of someone who has left.

Checking your email set-up without Mail Check

Email spoofing is when someone sends messages that appear to come from your domain. The NCSC's guidance on anti-spoofing points to a directory of open source and commercial tools, and says most of them check whether DMARC, SPF, DKIM and TLS are configured correctly and often advise on fixing errors. The NCSC also recommends its own Check your cyber security service, which checks email anti-spoofing and email privacy for your domain. When you run a check, look for three things:

• An SPF record that lists the services genuinely allowed to send as you.
• DKIM signing switched on for your main email provider and any marketing or invoicing tools.
• A DMARC record, so receiving mail servers know what to do with messages that fail the checks.

If you do not know what those terms mean, our earlier post on SPF, DKIM and DMARC covers them in plain English. Re-check after any change of email provider or when you add a new tool that sends mail for you, because that is when records quietly go out of date.

What the NCSC says about commercial monitoring

The NCSC's headline advice to organisations that used Web Check and Mail Check is to adopt a commercial external attack surface management product, usually shortened to EASM. It also published a buyer's guide. The guide describes EASM as identifying, monitoring and reducing vulnerabilities in assets that are accessible from the internet, and notes that these products automate discovery and show you your estate as an attacker would see it.

The guide is written for organisations of every size, including sole traders and small and medium-sized organisations, and is aimed at those that maintain multiple internet-accessible services. A small shop with one website and one email domain may not need one. If you are weighing it up, the questions the guide suggests asking are a good filter:

• What exactly are you trying to achieve? The more specific the goal, the better the choice.
• How does the product discover your assets, and can you exclude things that are not yours?
• Who needs to see the results, and in what form: a web dashboard, email alerts, or a PDF report for a client or insurer?
• How does it prioritise risks, so you are not left with a long list and no idea where to start?
• How often does it check: hourly, daily or weekly?
• Do you need it to confirm that something is actually vulnerable, or is "likely vulnerable" enough?

A word of caution on vendor material. Several security companies have published guides on this change, and some promote their own products as the replacement. They can be useful for dates and detail, but read them as sales pages and compare with the NCSC's own guide before spending money.

What to do this week

You do not need to buy anything to close most of the gap. A sensible order of work looks like this:

• Find out whether you were ever signed up. Search old email for NCSC or MyNCSC messages. If you were, assume you have had no Web Check or Mail Check findings since 31 March 2026.
• Sign up to Early Warning using a shared mailbox, and list your public IP addresses and domains. Include every domain you own, not only the main one.
• Run an email check on each domain and fix any missing SPF, DKIM or DMARC records.
• Put the website on someone's list. Ask whoever looks after it, or your hosting provider, who is watching for vulnerabilities and updates, and get the answer in writing.
• Decide whether paid monitoring is proportionate. If you hold lots of customer data or take payments directly, it may be. If you run a simple brochure site, the free steps may be enough for now.

If you are not sure who looks after your website, hosting and domains, that is itself the finding. Our cloud and security team can talk through what is in place and what is missing.

The short version

A free national monitoring service for websites and email has gone, and the NCSC itself says commercial tools are the way forward for organisations that need that depth. For a typical small business, the practical response is modest: register for Early Warning, check your email records, and make sure a named person is responsible for the website. Do those three things and you have the basics in place, with a clear idea of when it would be worth paying for more.