Cyber insurance and DMARC: what underwriters ask
Business email compromise drives roughly half of cyber-insurance claims, and underwriters have responded: email-authentication questions now appear directly on major carriers’ applications. If your renewal is coming up, your DMARC posture is part of the price you will pay — get it in order before you fill in the questionnaire.
Last reviewed
Does this mandate name DMARC?
This is not a regulation and there is no deadline. It is a question you are asked in writing, repeatedly: Beazley’s cyber applications ask which protocols authenticate the sender and content of email, naming SPF, DKIM and DMARC. What you answer is an attestation.
Nothing, in the legal sense. But an inaccurate answer is the kind that gets revisited when a claim is scrutinized, and weak answers can affect premiums, coverage terms, or whether you are insurable at all.
DMARC at p=quarantine or stricter, monitored — that is the bar application guidance references. Keep the evidence too: dashboards, alert history and DNS-check logs document that the control you attested to was operating.
The facts, with dates.
Any organization applying for or renewing cyber-liability coverage — especially where the application includes email-security or ransomware supplemental questionnaires.
What is on the applications
Cyber-insurance questionnaires have become technically specific. Beazley’s cyber applications — publicly available on its site — ask applicants which protocols they use to authenticate the sender and content of email, listing SPF, DKIM, and DMARC by name, with related guidance pointing at enforcement policies (p=quarantine or stricter), not monitor-only records. Other major carriers include email-authentication and anti-phishing control questions in their applications and ransomware supplementals.
Coalition, one of the largest cyber-insurance providers, publishes guidance walking policyholders through SPF, DKIM, and DMARC — because business email compromise and social engineering account for roughly half of the claims it sees. Insurers price what causes losses, and email impersonation is at the top of that list.
There is no universal “DMARC or no coverage” rule — carriers differ, and many treat email authentication as one factor among several. But the direction is one-way: each renewal cycle, the questions get more specific and the answers matter more.
How weak email authentication shows up at renewal
Getting enforcement-ready before your renewal
The questionnaire answer underwriters want to see is not “we have a DMARC record” — it is “our domains are at p=quarantine or p=reject, and we monitor the reports.” Getting there safely takes a few weeks of monitoring: publish DMARC at p=none with aggregate reporting, identify every legitimate service sending as your domain, fix each one’s SPF/DKIM alignment, then step up to enforcement.
DDMARC compresses that cycle: readable aggregate reports show exactly which senders fail alignment, a policy simulator previews what quarantine or reject would have blocked before you commit, and continuous DNS monitoring alerts you if a record breaks after you have attested to it on an application.
Keep the evidence, too. Dashboards, alert history, and DNS-check logs document that the control you claimed on the application is operating — useful for renewals, audits, and if a claim ever gets scrutinized.
Every claim on this page, sourced.
Primary sources only — the standard, the regulator, or the provider's own documentation. No vendor blog posts quoting other vendor blog posts.
Your compliance checklist.
Tick these off as you go — the state stays in this browser and is sent nowhere, which matters when the list is an inventory of controls you do not yet have. The configuration steps take an afternoon; the move to enforcement is the one that takes weeks.
Find the email-security and ransomware-supplemental questions so you know exactly what you will attest to.
A free scan shows where every domain stands on DMARC, SPF, and DKIM.
Check your domainThird-party platforms (CRM, payroll, marketing) must pass SPF or DKIM aligned to your domain, or enforcement will block them.
DMARC setup guideUse aggregate reports (and DDMARC’s policy simulator) to confirm enforcement will not break real mail, then step up.
Policy guide: none vs. rejectKeep dashboards and DNS-monitoring alerts as evidence the control stays live year-round — not just on application day. Free monitoring needs no card, so the alert history can start before the application does.
Start free monitoringQuestions people ask.
It varies by carrier, and there is no universal mandate. Beazley’s applications ask explicitly which email-authentication protocols you run, naming SPF, DKIM, and DMARC; Coalition publishes email-authentication guidance and treats email compromise as a leading claims driver. In practice, weak or missing DMARC shows up as a control gap that can affect premiums, terms, or insurability — even where it is not a hard requirement.
Possibly. Industry advisories cite 5–15% reductions for organizations with strong email authentication, but no carrier publishes a guaranteed discount — pricing weighs your whole control set. What is clearer is the downside: answering “no” to authentication questions invites higher premiums, exclusions, or declined applications at some carriers.
Usually not, if the question is about protecting against spoofing. p=none is monitor-only — it observes impersonation without blocking it. Application guidance that references DMARC points at p=quarantine or stricter. If you are at p=none today, plan the move to enforcement before your renewal date.
BEC is fraud where attackers impersonate a trusted party — your executives, your vendors, or your own domain — to trick staff into payments or credential disclosure. Coalition reports BEC and social engineering account for roughly half of cyber claims, and the FBI has documented more than $50 billion in losses over the past decade. DMARC enforcement shuts down the exact-domain spoofing variant of these attacks.
Whatever proves the control operates: your published DMARC policy, aggregate-report dashboards, alerting history, and DNS-monitoring logs. If a record breaks mid-policy-period after you attested to it, you want to know before it matters — continuous monitoring covers that.
Most teams are covered by more than one.
All merchants and service providers that store, process, or transmit payment-card data — regardless of size or transaction volume.
Anyone sending ~5,000+ messages a day to Gmail, Yahoo, or consumer Outlook (outlook.com, hotmail.com, live.com) addresses — and once you cross the threshold, the obligations stick. Smaller senders must still authenticate with SPF and DKIM.
Essential and important entities across 18 critical sectors in the EU — energy, transport, health, digital infrastructure, ICT service management, and more — generally medium-sized and larger, plus some entities regardless of size. Non-EU organizations providing in-scope services in the EU can also be covered.
Renewal on the calendar?
A free scan shows where you stand today, in about 30 seconds and with no account. A14-day trial shows every sender that fails alignment within 48 hours of the first reports. Under 60 days to go? The Enforcement sprint takes one domain from p=none to p=reject in about 30 days, for $2,500 per domain, one-time.
Free plan: 2 domains, no card, no expiry · Trial: card required, billed on day 15 unless you cancel · 14-day money-back on new paid plans