Is it free, as Mail Check and Web Check were?

For one domain, yes: a full audit once a month, alerts on critical findings and a weekly summary. DMARC and TLS reports, weekly audits and more domains start with Solo, €19 a month.

Any organisation, public or private, in any country. Schools, charities, councils and companies use the same service; there is no eligibility rule.

Do you need access to our systems?

No. Everything is read from outside: DNS, certificates, your public sites and mail servers, public sources. To see detailed findings you prove you own the domain, with a DNS record.

Can we keep another DMARC tool at the same time?

Yes. A DMARC record can send its reports to several addresses: add ours next to the one you have.

Do you cover schools and multi-academy trusts with many domains?

Yes: Agency covers 25 domains for €79 a month, with clients or sites kept apart, and the next plan covers 100. Domains can be imported from a list.

UK organisations

After Mail Check and Web Check: keep watching your domains

The NCSC retired Mail Check and Web Check on 31 March 2026 and advises organisations to have an alternative in place. Perimetry Cloud runs the same kind of checks on your e-mail and web domains, from outside, and tells you what to fix: 45 checks, free for one domain, with an open-source scanner.

Free for one domain
Nothing to install
Open-source scanner (AGPL-3.0)

What stopped, and what continues

What stopped: Since 31 March 2026, Mail Check and Web Check users no longer receive findings from these services, which had been running since 2017. In the year to August 2025, the NCSC counted 13,193 organisations using Mail Check, for 402,796 domains. NCSC, “NCSC to retire Web Check and Mail Check” · NCSC Annual Review 2025, Active Cyber Defence
What the NCSC advises: A commercial external attack surface management product: one that finds and scans your internet-facing assets for misconfigurations, exposures and vulnerabilities. Its buyer’s guide lists what to expect and the questions to ask a supplier. NCSC, “NCSC to retire Web Check and Mail Check” · NCSC, external attack surface management buyer’s guide
What continues: Early Warning and DNS Check still send their findings through MyNCSC. They are free: keep them. Perimetry Cloud does not replace them, it takes over what Mail Check and Web Check were watching. NCSC, “NCSC to retire Web Check and Mail Check”

What you had, and what Perimetry Cloud does

What you had	With Perimetry Cloud	From plan
Anti-spoofing checks: SPF, DKIM, DMARC	Read at every audit: a missing or weak record, too many SPF lookups, a DMARC policy that only watches, a weak DKIM key. Each finding comes with the record to publish.	Free
DMARC reports	The aggregate reports of the mailbox providers, read for you: who sends mail in your name, what passes, what fails. Then step by step to p=reject: you are told when each step is safe, and what to do about each sender that still fails.	Solo (€19)
Mail encryption (TLS)	Your mail servers are asked for STARTTLS, without any message being sent: encryption missing or failing, a certificate that is untrusted or about to expire, old TLS versions, DANE.	Free
MTA-STS	Whether a policy is published, can be fetched and is enforced, or is still in testing mode.	Free
TLS reports (TLS-RPT)	The daily reports of the servers that send you mail: how many of their connections were encrypted, and why the others failed.	Solo (€19)
Websites: misconfigurations and known weaknesses	Certificates, HTTPS and its redirects, security headers, outdated JavaScript libraries, WordPress plugins with known vulnerabilities, forgotten subdomains that someone else could take over, known vulnerabilities on your addresses.	Free
Findings sent to you	An e-mail on critical findings and a weekly summary on every plan. From Solo: what changed since the last audit, and alerts by e-mail, webhook, Slack and Microsoft Teams.	Free

What we say about the NCSC’s services was read on its own pages on 14 November 2026. Sources: NCSC, Mail Check · NCSC, “NCSC to retire Web Check and Mail Check” · NCSC, external attack surface management buyer’s guide · NCSC Annual Review 2025, Active Cyber Defence

See everything we check

Perimetry Research

What we see on the UK State’s own domains

In November 2026 we measured the 497 domains of the UK State, with the same checks. On the domains that carry a site of their own, 74.6% enforce DMARC: years of Mail Check show. But of the 227 domains that only redirect or only carry mail, 33.9% can still be spoofed, and only 42.1% of the sites send HSTS. The work is not finished, and nobody is sending the findings any more.

Read the study France and the UK compared

What Perimetry Cloud is not

Not a government service: An independent service, operated from Ireland, in the European Union. This page is ours; the NCSC does not endorse it.
Not a replacement for Early Warning: Early Warning and DNS Check are the NCSC’s own services and they continue. We look at the configuration of your domains from outside, as Mail Check and Web Check did. Keep both.
No hosting of your MTA-STS policy: We check the policy you publish and tell you what is wrong with it; we do not host it for you.
No intrusive testing: The audits read public sources and make ordinary requests to your sites and mail servers. Nothing is attacked, nothing is installed.

Procurement

For those who have to buy it

Price: Free for one domain, audited once a month. Solo: €19 a month for 5 domains, audited every week. Agency: €79 a month for 25 domains, audited every day. Prices in euros, excluding VAT.
Where your data is: On servers in the Netherlands, in the European Union, with encrypted volumes and backups kept in the EU. Not in the United Kingdom: check that this suits your organisation’s rules.
What you can verify: The scanner is open source (AGPL-3.0): every check can be read, and run on your own machine. A finding always shows the evidence it rests on.
Compliance view: Each finding is linked to Cyber Essentials, NIS2 and ISO 27001 controls, as an indication.

Four steps

Moving over

Look firstRun the free check below on one of your domains: score and three most serious findings in about two minutes, without an account.
Add your domainsCreate an account and add them. Prove each one is yours with a DNS record: detailed findings are for proved owners only.
Point your DMARC reports to usTurn on DMARC reports for a domain and add the address we give you to the rua= of its DMARC record, next to any address you keep.
Choose who is toldAlerts by e-mail, webhook, Slack or Microsoft Teams, and the weekly summary, for the people who fix things.

Questions

Is it free, as Mail Check and Web Check were?: For one domain, yes: a full audit once a month, alerts on critical findings and a weekly summary. DMARC and TLS reports, weekly audits and more domains start with Solo, €19 a month.
Who can use it?: Any organisation, public or private, in any country. Schools, charities, councils and companies use the same service; there is no eligibility rule.
Do you need access to our systems?: No. Everything is read from outside: DNS, certificates, your public sites and mail servers, public sources. To see detailed findings you prove you own the domain, with a DNS record.
Can we keep another DMARC tool at the same time?: Yes. A DMARC record can send its reports to several addresses: add ours next to the one you have.
Do you cover schools and multi-academy trusts with many domains?: Yes: Agency covers 25 domains for €79 a month, with clients or sites kept apart, and the next plan covers 100. Domains can be imported from a list.

See what your domain shows the world

Score and three most serious findings in about two minutes, without an account. Nothing is attacked.

Create a free account See the plans

Mail Check, Web Check, Early Warning and MyNCSC are services of the UK National Cyber Security Centre, named here only to say what they did. This page is ours and is not endorsed by the NCSC. Spotted an error or an outdated fact? Write to hello@perimetry.cloud and we will correct it.