# DMARC for cyber insurance: what insurers ask and how to answer

Insurers ask about email security when you apply for cyber insurance or
renew it, usually as a few checkboxes about SPF, DKIM and DMARC. Some also
scan your domain from the outside, which means
your answer can be checked.

## What the forms ask

Ransomware and cyber supplemental applications typically ask which
controls protect incoming email, as checkboxes. Two published examples:

- **Beazley** (Ransomware Supplemental): "What security controls do you
  have in place for incoming email?", with options including DKIM,
  "Sender Policy Framework (SPF) strictly enforced" and DMARC.
- **AXIS** (Cyber Ransomware Supplemental): "Please identify the email
  security controls in place", with DKIM, DMARC and SPF checkboxes.

Neither form asks for a specific DMARC policy. But ticking "DMARC" while
your record says `p=none` is a weak answer: `p=none` monitors spoofing
without stopping any of it. If a claim follows a spoofing attack, the
difference matters.

## What insurers can see from outside

SPF and DMARC records are public DNS, so anyone can check them in
seconds. Coalition, for example, scans its policyholders' external attack
surface and shows email security findings, including DMARC and SPF, in
its Control product, and says issues left unfixed can lead to conditions
at renewal. Other insurers and brokers use similar scans when quoting.

Assume the underwriter can see the same records you can.

## What "having DMARC" should mean

To answer yes with a clear conscience:

1. **SPF**: one record listing every service that sends for you, within
   the [10-lookup limit](/guides/spf-too-many-dns-lookups).
2. **DKIM**: signing on, with your domain, in every sending service. See
   [set up DKIM](/guides/dkim-setup).
3. **DMARC at enforcement**: `p=quarantine` or, better, `p=reject`,
   after reading the reports to make sure your own mail passes. See
   [DMARC from none to reject](/guides/dmarc-none-to-reject).
4. **Parked domains locked down**: domains that never send get
   `v=spf1 -all` and `p=reject`, so they can't be spoofed either.

That's also what governments ask of themselves: US federal agencies
have had to use `p=reject` since CISA's BOD 18-01, and UK government
guidance requires DMARC moving to quarantine or reject.

## Related requirements

- **PCI DSS v4** (requirement 5.4.1) asks for automated mechanisms that
  protect staff against phishing. DMARC isn't named in the requirement,
  but PCI Security Standards Council guidance gives DMARC, SPF and DKIM as
  examples of controls that help stop your domain being spoofed.
- **Gmail and Outlook.com** require DMARC from bulk senders anyway: see
  [Gmail 550 5.7.26](/guides/550-5-7-26) and
  [Outlook 550 5.7.515](/guides/550-5-7-515).

## Before your renewal

- Check your records now, before the insurer does.
- Keep a dated note or screenshot of your DMARC policy and when you moved
  to enforcement; some forms ask when controls were introduced.
- If you're still at `p=none`, say so honestly on the form, and plan the
  move to enforcement. It usually takes a few weeks of reading reports.

## Check your domain

The [DMARC checker](/tools/dmarc-checker) shows your policy as an
insurer's scan would see it. The [free scan](/#scan) checks SPF and DMARC
together, and the lookalike domains that could send email as you.

## Sources

- [Beazley: Ransomware Supplemental Application (F00765, PDF)](https://www.beazley.com/globalassets/product-documents/application/beazley_ransomware_supplemental_052022_ed.pdf)
- [AXIS: Cyber Ransomware Supplemental Application (PDF)](https://www.axiscapital.com/docs/default-source/resources/axis-1012739-0623-axis-cyber-ransomware-supplemental-application-7-20-23.pdf)
- [Coalition: Coalition Control support](https://help.coalitioninc.com/hc/en-us/articles/7520435280027-Coalition-Control-Support)
- [CISA: BOD 18-01, enhance email and web security](https://www.cisa.gov/news-events/directives/bod-18-01-enhance-email-and-web-security)
- [GOV.UK: Set up government email services securely](https://www.gov.uk/guidance/set-up-government-email-services-securely)
- [PCI SSC: Best practices for anti-phishing mechanisms, PCI DSS v4.0 req. 5.4](https://www.pcisecuritystandards.org/eucm_wednesday_track-2_07_best-practices-for-anti-phishing-mechanisms-pci-dss-v4-0-req-5-4_vui-huang-tea_final_approved/)

---
Source: https://nameward.app/guides/dmarc-cyber-insurance (updated 2026-10-31)