In short: Check Point DMARC Management is an add-on to Check Point Email Security (Harmony Email and Collaboration). It collects DMARC reports in a Check Point-hosted mailbox, shows every service sending as your domains, helps manage SPF and DKIM, and gives recommendations so you can move from monitoring to a quarantine or reject policy safely.
What DMARC is and why it is hard to finish
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers what to do with messages that claim to come from your domain but fail authentication. It builds on two other records:
- SPF lists the servers allowed to send mail for your domain
- DKIM adds a cryptographic signature that proves a message came from you and was not altered
A DMARC record has three main policies: p=none (monitor only), p=quarantine (send failures to junk) and p=reject (refuse them). Only quarantine and reject actually stop spoofing of your exact domain.
Most organisations publish p=none and stop there, because they are not sure which services send on their behalf: the CRM, the finance system, the marketing platform, the website form, a supplier's helpdesk. Turn on reject too early and legitimate invoices or password reset emails start disappearing. Check Point's DMARC Management add-on exists to close that gap.
How Check Point DMARC Management works
Check Point positions the add-on as taking the heavy lifting out of DMARC, SPF and DKIM: confirming that every legitimate sender is authorised so you can move to a restrictive policy. Its published capabilities are:
| Capability | What it does |
|---|---|
| Hosted reporting mailbox | DMARC aggregate (RUA) reports from receiving mail servers go to a dedicated mailbox that Check Point hosts, so nobody has to read raw XML reports |
| Sender visibility | Shows every service sending email on behalf of your domains and subdomains, legitimate or not |
| Authorised senders | Lets you manage the list of sending sources you have approved |
| SPF management | Simplified SPF management that Check Point says helps overcome SPF's limitations, working with DMARC for ongoing monitoring and issue resolution |
| DKIM | Helps make sure all of your email is cryptographically signed, so receivers can verify it is authentic and unaltered |
| Recommendations | Actionable recommendations to improve enforcement, including guidance on what should happen to mail that fails authentication |
A common SPF limitation is the limit of 10 DNS lookups per record, which is easy to exceed once you add several cloud services. Check Point does not spell out how the add-on handles this, so we review your SPF record as part of the set-up.
It is managed alongside the rest of Harmony Email and Collaboration in the Check Point Portal.
From monitoring to enforcement, step by step
A typical journey for a UK organisation with a few sending services looks like this:
- Inventory your domains, including parked domains that never send mail (these can go straight to a reject policy)
- Publish or update a p=none DMARC record that sends aggregate reports to the Check Point-hosted mailbox
- Review the senders the reports reveal, and decide which are legitimate
- Fix SPF and DKIM for each legitimate service until its mail passes and aligns with your domain
- Move to p=quarantine, watching the reports for anything legitimate that fails
- Move to p=reject once only unauthorised mail is failing
- Keep monitoring, and add new sending services properly when the business adopts them
How long this takes depends on how many services send as you and how quickly their owners can make changes. We will not rush you to reject before the reports say it is safe.
DMARC and impersonation: what it does and does not stop
A reject policy stops criminals sending mail that uses your exact domain, which protects your customers, suppliers and staff from the most convincing spoofs and helps your legitimate mail land in inboxes.
It does not stop:
- Lookalike domains, such as an extra letter or a different ending
- Display-name spoofing, where the name looks right but the address is a free webmail account
- Compromised supplier accounts sending genuine, authenticated mail
Those are inbound threats, and they are handled by the anti-phishing, business email compromise and impersonation engines in Harmony Email Advanced Protect. DMARC Management protects your domain's reputation outwards; the core product protects your users inwards. Together they cover both directions of email impersonation.
The UK context: NCSC, Mail Check and mailbox provider rules
The National Cyber Security Centre (NCSC) recommends SPF, DKIM and DMARC as anti-spoofing controls for all of an organisation's domains, and publishes guidance on setting them up. The UK government's guidance on setting up government email services securely asks departments to publish DMARC starting at p=none and rise to quarantine or reject during implementation.
NCSC Mail Check has been retired. The NCSC retired its Mail Check and Web Check services on 31 March 2026. Public sector bodies and other organisations that relied on Mail Check to read their DMARC reports now need another way to do it. The NCSC points organisations to commercial external attack surface management tools and to its Check your cyber security service for email domain checks. A hosted DMARC reporting service such as Check Point's add-on is one way to fill the gap if you already use Check Point Email Security.
Large mailbox providers have tightened their rules too. Google requires every sender to Gmail accounts to use SPF or DKIM, and anyone sending more than 5,000 messages a day to also publish DMARC, with the From domain aligned. If your organisation sends marketing or high volumes of transactional email, a working DMARC set-up is no longer optional.
For the broader picture of protecting your mail, see our email security guide.
Licensing and how we help
DMARC Management is an add-on to Harmony Email and Collaboration and is licensed with your subscription; the Harmony pricing guide explains the factors that affect cost. Forever Systems can audit your current SPF, DKIM and DMARC records, set up the add-on, work with your suppliers' sending services, and take each domain to enforcement at a safe pace.
Contact us for a DMARC review and a quote.
How Forever Systems supplies and supports Check Point Harmony
We supply and support the whole Check Point Harmony suite, now marketed as Check Point Workspace Security, for UK organisations: from a single product to endpoint, email, SaaS, mobile, browser and SASE together, with Check Point MDR if you want round-the-clock cover.
- Scoping and licensing: the right products, editions and plans for your users, devices and risk, and a clear view of what the old Harmony names now mean
- Proof of value: trial deployments that show what Harmony finds in your own mailboxes, devices and traffic
- Deployment: endpoint agents and policies, the Microsoft 365 or Google Workspace connection, mobile roll-out through your MDM, browser extensions and SASE access policies
- Migration: moving from another endpoint, email or VPN product, or from Harmony Connect to Harmony SASE
- Ongoing support: policy tuning, alert triage, upgrades and renewals, managed in the Check Point Portal
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, including other options if Harmony is not right for you.
Want a Check Point Harmony quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What does Check Point DMARC Management do?
It collects your DMARC aggregate reports in a Check Point-hosted mailbox, shows every service sending email as your domains, helps you manage SPF and DKIM, and recommends the changes needed to move safely from a monitoring policy to quarantine or reject.
Is p=reject safe for my domain?
It is safe once every legitimate service that sends as your domain passes SPF or DKIM in alignment. That is exactly what the DMARC reports show you. Moving to reject before then risks blocking your own invoices, alerts and marketing.
Does DMARC stop phishing emails to my staff?
Only those that spoof your exact domain. Lookalike domains, display-name tricks and compromised supplier accounts need inbound protection, which Harmony Email and Collaboration's anti-phishing and impersonation engines provide.
Do I need Harmony Email and Collaboration to use DMARC Management?
Yes. Check Point sells DMARC Management as an add-on to Check Point Email Security (Harmony Email and Collaboration), managed from the same console.
Does the NCSC recommend DMARC?
Yes. The NCSC recommends SPF, DKIM and DMARC as anti-spoofing controls for all of your organisation's domains and publishes guidance on setting them up.
What has replaced NCSC Mail Check?
The NCSC retired Mail Check, along with Web Check, on 31 March 2026. It now points organisations to commercial external attack surface management tools and to its Check your cyber security service for email domain checks. For ongoing DMARC reporting, you need a DMARC reporting service, such as Check Point's DMARC Management add-on for Check Point Email Security customers.