By 
The United Kingdom's National Cyber Security Centre (NCSC) has introduced a new email security check service to help organizations identify vulnerabilities that might enable attackers to spoof emails or lead to email privacy breaches.
According to the government agency that leads the UK's cyber security mission, the Email Security Check tool does not require any sign-ups or personal details. This service is provided online for free.
Email Security Check allows defenders to look up publicly available information about email domains and check for anti-spoofing and email privacy risks
It works by checking publicly available internet DNS records to verify if anti-spoofing standards such as DMARC are correctly configured and privacy protocols, such as TLS, are in place.
The anti-spoofing standards are checked to help organizations prevent cyber criminals from abusing their domain and sending out malicious emails pretending to be them. TLS are checked to ensure that emails are encrypted when in transit so they cannot be accessed and remain confidential between mail servers.
However, the Email Security Check service will only be able to identify vulnerabilities that cybercriminals can discover, but its main aim is to help organizations identify them before they are exploited and the email domain targeted in attacks.
Eligible organizations can also gain access to more "in-depth guidance" on securing their email by signing up for the NCSC's free Mail Check service.
As of now, Mail Check is not available for the private sector, but only to organizations from central government, local authorities, devolved administrations, emergency services, NHS organizations, academia, and charities.
Paul Maddinson, NCSC Director for National Resilience and Strategy emphasized that the new Email Security Check tool helps users identify where they can do more to prevent spoofing and protect privacy and offers practical advice on how to stay secure. By following the recommended actions, organizations can help strengthen their defenses and make it harder for cyber criminals.
Even though the tool can check the security of email domains, it cannot check if individual emails or email domains are malicious. The NCSC suggests those receiving suspicious emails to report them by forwarding them to [email protected].
