Skip to content

Guides · Email and DMARC

DMARC for cyber insurance: what insurers ask and how to answer

Cyber insurance applications ask about SPF, DKIM and DMARC. What the forms ask, what insurers can see from outside, and how to answer yes honestly.

Updated 31 October 2026 · 3 min read

Insurers ask about email security when you apply for cyber insurance or renew it, usually as a few checkboxes about SPF, DKIM and DMARC. Some also scan your domain from the outside, which means your answer can be checked.

What the forms ask

Ransomware and cyber supplemental applications typically ask which controls protect incoming email, as checkboxes. Two published examples:

  • Beazley (Ransomware Supplemental): "What security controls do you have in place for incoming email?", with options including DKIM, "Sender Policy Framework (SPF) strictly enforced" and DMARC.
  • AXIS (Cyber Ransomware Supplemental): "Please identify the email security controls in place", with DKIM, DMARC and SPF checkboxes.

Neither form asks for a specific DMARC policy. But ticking "DMARC" while your record says p=none is a weak answer: p=none monitors spoofing without stopping any of it. If a claim follows a spoofing attack, the difference matters.

What insurers can see from outside

SPF and DMARC records are public DNS, so anyone can check them in seconds. Coalition, for example, scans its policyholders' external attack surface and shows email security findings, including DMARC and SPF, in its Control product, and says issues left unfixed can lead to conditions at renewal. Other insurers and brokers use similar scans when quoting.

Assume the underwriter can see the same records you can.

What "having DMARC" should mean

To answer yes with a clear conscience:

  1. SPF: one record listing every service that sends for you, within the 10-lookup limit.
  2. DKIM: signing on, with your domain, in every sending service. See set up DKIM.
  3. DMARC at enforcement: p=quarantine or, better, p=reject, after reading the reports to make sure your own mail passes. See DMARC from none to reject.
  4. Parked domains locked down: domains that never send get v=spf1 -all and p=reject, so they can't be spoofed either.

That's also what governments ask of themselves: US federal agencies have had to use p=reject since CISA's BOD 18-01, and UK government guidance requires DMARC moving to quarantine or reject.

  • PCI DSS v4 (requirement 5.4.1) asks for automated mechanisms that protect staff against phishing. DMARC isn't named in the requirement, but PCI Security Standards Council guidance gives DMARC, SPF and DKIM as examples of controls that help stop your domain being spoofed.
  • Gmail and Outlook.com require DMARC from bulk senders anyway: see Gmail 550 5.7.26 and Outlook 550 5.7.515.

Before your renewal

  • Check your records now, before the insurer does.
  • Keep a dated note or screenshot of your DMARC policy and when you moved to enforcement; some forms ask when controls were introduced.
  • If you're still at p=none, say so honestly on the form, and plan the move to enforcement. It usually takes a few weeks of reading reports.

Check your domain

The DMARC checker shows your policy as an insurer's scan would see it. The free scan checks SPF and DMARC together, and the lookalike domains that could send email as you.

Sources

Free scan

No signup. Only scan domains you own or manage.

More in Email and DMARC