Cyber Insurance & DMARC — What Underwriters Ask in 2026

Cyber-insurance questionnaires have become technically specific. Beazley’s cyber applications — publicly available on its site — ask applicants which protocols they use to authenticate the sender and content of email, listing SPF, DKIM, and DMARC by name, with related guidance pointing at enforcement policies (p=quarantine or stricter) rather than monitor-only records. Other major carriers include email-authentication and anti-phishing control questions in their applications and ransomware supplementals.

Coalition, one of the largest cyber-insurance providers, publishes guidance walking policyholders through SPF, DKIM, and DMARC — because business email compromise and social engineering account for roughly half of the claims it sees. Insurers price what causes losses, and email impersonation is at the top of that list.

There is no universal “DMARC or no coverage” rule — carriers differ, and many treat email authentication as one factor among several. But the direction is one-way: each renewal cycle, the questions get more specific and the answers matter more.

The questionnaire answer underwriters want to see isn’t “we have a DMARC record” — it’s “our domains are at p=quarantine or p=reject, and we monitor the reports.” Getting there safely takes a few weeks of monitoring: publish DMARC at p=none with aggregate reporting, identify every legitimate service sending as your domain, fix each one’s SPF/DKIM alignment, then step up to enforcement.

DDMARC compresses that cycle: readable aggregate reports show exactly which senders fail alignment, a policy simulator previews what quarantine or reject would have blocked before you commit, and continuous DNS monitoring alerts you if a record breaks after you’ve attested to it on an application.

Keep the evidence, too. Dashboards, alert history, and DNS-check logs document that the control you claimed on the application is actually operating — useful for renewals, audits, and if a claim ever gets scrutinized.