NCSC to retire Web Check and Mail Check
By 31 March 2026, organisations should have alternatives to Mail Check and Web Check in place.
Mail Check and Web Check were retired on 31st March 2026.
Over the past 8 years, there have been significant developments in the external attack surface management (EASM) market, with a range of EASM products now available to organisations of all sizes.
EASM products identify and scan your internet-accessible assets to identify any misconfigurations, exposures or vulnerabilities that could be exploited by an attacker to gain access to your data and services. This is effectively the same function that the NCSC’s Web Check and Mail Check services have been providing since 2017.
Since there are many commercial EASM products widely available – most of which provide additional features and checks – the NCSC will be retiring the Web Check and Mail Check services on 31 March, 2026.
What does this mean for my organisation?
As of 31st March 2026, Mail Check and Web Check users will no longer receive findings related to those services. Note that organisations subscribed to Early Warning and DNS Check will continue to receive findings via their MyNCSC accounts.
We strongly recommend that organisations implement a commercial EASM product before Mail Check and Web Check are retired. Our ACD 2.0 research identified a strong and diverse market, offering EASM products with that cover what Web Check and Mail Check provide within a single product, plus many more features and checks. Accordingly, the NCSC has produced a buyer’s guide to choosing the right EASM product.
The guide outlines the features you can expect in EASM products, and includes questions to consider to ensure the product matches your requirements. There is no one-size-fits-all for EASM; accordingly the guide helps you find out how providers' products will support your specific needs, and the features you need to consider. These will include:
- Visibility and insight: features which provide you with an overview across your whole attack surface, such as which technologies you are using (and where you are using them), your DNS configuration, websites and certificates.
- Security analysis: the types of risks or issues identified (like the findings from Mail Check or Web Check) such as software security, email security, or identifying exposed services.
- Supporting functions: additional features to help you manage your attack surface, such as overview dashboards, reports for downloading and sharing, or workflow features like adding comments or setting status fields on findings.
We also recommend you subscribe to the NCSC’s Check your cyber security service, which checks your email domain for two important areas:
- email anti-spoofing (preventing cyber criminals sending emails pretending to be you (known as spoofing)
- email privacy (making it harder for cyber criminals to intercept and read your email in transit)
Retiring these services is in keeping with our roadmap for ACD 2.0, which stated last year that the NCSC will only deliver solutions where the cyber security market is unable to, or where being part of GCHQ presents a unique opportunity to drive up resilience at scale. This will allow us to divert resources to new initiatives designed to help protect the UK’s cyber infrastructure.
Hannah E
Service Owner: MyNCSC, Early Warning and Vulnerability Checking Services, NCSC
Share and print this article
Written by
