Cyber Essentials v3.3 and your email domain: what it asks, and the free DNS checks alongside
Applying for Cyber Essentials and wondering what it says about email? This page lists what the v3.3 requirements actually ask that touches your email service, says plainly what they do not ask, and links free public-DNS checks you can run as good practice.
This is public-DNS research and plain-English reading of published documents. It is not consultancy, not certification and not assessment advice. Whether your organisation meets a requirement is for your IASME Certification Body to decide.
The Short Answer
- Cyber Essentials: Requirements for IT Infrastructure v3.3 (NCSC, April 2026, in use from 27 April 2026) has five technical controls: firewalls, secure configuration, security update management, user access control and malware protection.
- When checked on 1 November 2026, the v3.3 document does not name SPF, DKIM, DMARC, MTA-STS or any other DNS record as a requirement. You do not need them to answer the question set.
- Your email service is still in scope. Hosted email such as Microsoft 365 or Gmail counts as a cloud service, and cloud services cannot be excluded from scope.
What v3.3 Asks That Touches Your Email
These are requirements in the v3.3 document. A public DNS scan cannot see any of them; they are settings inside your accounts and devices.
| v3.3 topic | What the document says | Can a public DNS check see it? |
|---|---|---|
| Cloud services in scope | If your data or services are hosted on cloud services, they must be in scope; cloud services cannot be excluded. Microsoft 365 and Gmail are given as examples. The applicant is always responsible for making sure all controls are in place. | No |
| Multi-factor authentication | Authentication to cloud services must always use MFA. That includes your email accounts. | No |
| Separate admin accounts | Use separate accounts for administrative activities, with no emailing or web browsing from them. | No |
| Malware protection | The document lists malicious email attachments as a source of malware that the malware protection control is there to stop. | No |
| Default passwords | Change default administrative passwords on firewalls and devices, and do not expose admin interfaces to the internet without MFA or an IP allow list. | No |
- Source: NCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3, www.ncsc.gov.uk (PDF) (checked 1 November 2026). Sections: B. Definitions; D(iv) Cloud services; E1 Firewalls; E4 User access control; E5 Malware protection.
Email DNS Checks That Sit Alongside (Good Practice, Not CE Requirements)
The NCSC's separate guidance, Email security and anti-spoofing, describes SPF, DKIM and DMARC as anti-spoofing controls and recommends TLS for mail in transit. Customer and supplier questionnaires sent alongside Cyber Essentials often ask about them. Each line below is a free check you can run on your own domain.
- SPF record. Lists the servers allowed to send mail for your domain. Check there is one SPF record, that it ends in
~allor-all, and that it stays under the 10 DNS lookup limit. Run it free → - DMARC policy. Tells receivers what to do with mail that fails SPF and DKIM:
p=none(monitor),p=quarantineorp=reject. Run it free → - Where your DMARC reports go. The
rua=address receives a daily report on mail sent in your name. Check whether it is your own address or an outside one, and that you know who reads it. Run it free → - DKIM. Signs your outgoing mail. A public scan cannot see DKIM keys without the selector name, so check DKIM signing in your mail provider's admin console; DMARC reports also show DKIM results.
- MTA-STS and TLS-RPT. Standards (RFC 8461 and RFC 8460) that let your domain ask senders to use TLS and report failures. Check the policy mode (testing or enforce) and that the report record exists. Run it free →
- MX records. Show which service receives your mail. Check they point where you expect and that old providers are gone. Run it free →
- Source: NCSC, Email security and anti-spoofing, www.ncsc.gov.uk (checked 1 November 2026).
Keeping a Record
The free scan runs in your browser and we do not store your results. You can download a timestamped PDF and JSON record, with a SHA-256 hash, of what public DNS showed at the moment of the scan, and keep it with your assessment file. It is a point-in-time observation, not Cyber Essentials evidence. For how these records relate to ISO 27001 and NIS2 questions, see How FaultyPacket evidence supports Cyber Essentials, ISO 27001 and NIS2 email questions.
Check your email domain free, in your browser. No account, nothing stored.
Run the free SuperTool Get the board-ready fix pack (one-off £5–£39)Limits
- FaultyPacket is independent and not affiliated with the NCSC or IASME. Cyber Essentials certification is awarded by IASME Certification Bodies; find one through IASME's directory.
- Requirements change. Always read the current requirements document; this page reflects v3.3 as checked on 1 November 2026.
- Scan domains you own or are authorised to check, and no others.
Prepared by FaultyPacket, 1 November 2026.