NIS2 and DMARC: rules for covered entities
The EU’s NIS2 Directive is now being enforced: supervision regimes are live, several member states set mid-2026 audit milestones, and management can be held personally liable. Article 21 does not name DMARC — but it requires secured communications, and ENISA’s implementation guidance points squarely at email authentication.
Last reviewed
Does this mandate name DMARC?
Article 21 requires appropriate measures including “secured … communications”. It is outcome-based and technology-neutral, as EU directives generally are. ENISA’s guidance is where email authentication, DMARC included, is identified as a key practice.
Appropriate and proportionate technical measures, including secured communications, evidenced to your national supervisory authority. National transposition still varies between member states in 2026 — the obligation you are held to is your own country’s law.
Email authentication as ENISA describes it: SPF, DKIM and DMARC on the domains your entity sends from, at a policy that stops impersonation instead of only reporting it.
The facts, with dates.
Essential and important entities across 18 critical sectors in the EU — energy, transport, health, digital infrastructure, ICT service management, and more — generally medium-sized and larger, plus some entities regardless of size. Non-EU organizations providing in-scope services in the EU can also be covered.
What NIS2 requires
Article 21 of NIS2 obliges covered entities to take “appropriate and proportionate technical, operational and organisational measures” to manage cybersecurity risk, and lists ten minimum measure areas — including, in Article 21(2)(j), “the use of … secured voice, video and text communications.” The Directive is principles-based: it defines outcomes, and national transpositions plus ENISA guidance fill in the technical detail.
The enforcement machinery is what changed in 2024–2026. Member states transposed the Directive into national law (deadline: October 17, 2024, with several running late), supervisory authorities stood up proactive supervision for essential entities — regular audits and on-site inspections — and reactive supervision for important entities. Several national transpositions set June 30, 2026 as a first-audit or compliance-evidence milestone, though timelines vary by country.
NIS2 also puts management on the hook: governing bodies must approve and oversee the risk-management measures, and can be held liable for infringements. That has moved email security from an IT ticket to a board-level compliance item at covered entities.
Penalties under NIS2
Where DMARC fits
NIS2 does not list DMARC as a compliance requirement. What it requires is secured communications and demonstrable risk management — and ENISA’s technical implementation guidance identifies email authentication, including DMARC, as a key practice for meeting that bar. Domain spoofing is a standard entry vector for exactly the incidents NIS2 makes reportable, so supervisors read email authentication as evidence you are managing the risk.
For an audit, the useful posture is not “we published a DMARC record” — it is a documented control: SPF, DKIM, and DMARC at an enforcement policy across your sending domains, with monitoring, alerting, and records you can produce when a supervisory authority asks how you secure communications.
DDMARC gives covered entities that evidence trail: readable aggregate reports, continuous DNS monitoring with alert history, EU data residency, and a clear path from p=none to enforcement — so the control is real and provable, not a checkbox.
Every claim on this page, sourced.
Primary sources only — the standard, the regulator, or the provider's own documentation. No vendor blog posts quoting other vendor blog posts.
Your compliance checklist.
Tick these off as you go — the state stays in this browser and is sent nowhere, which matters when the list is an inventory of controls you do not yet have. The configuration steps take an afternoon; the move to enforcement is the one that takes weeks.
Check whether you are an essential or important entity under your member state’s transposition — sector, size, and criticality all factor in.
Include subsidiaries and country-level domains; supervision covers the entity, not just the primary brand domain.
A free scan shows each domain’s DMARC, SPF, and DKIM state in seconds.
Check your domainPublish DMARC with aggregate reporting, align every legitimate sender, and step up to p=quarantine or p=reject.
DMARC setup guideKeep policies, dashboards, alert history, and DNS-check logs ready — audits ask you to demonstrate the measure, not just claim it. Free monitoring needs no card and EU residency is available on every plan, so the log starts before the audit is scheduled.
Start free monitoringQuestions people ask.
Not by name. Article 21 requires appropriate technical measures including “secured voice, video and text communications,” and ENISA’s implementation guidance identifies email authentication — including DMARC — as a key risk-management practice. In practice, DMARC at enforcement is one of the clearest ways to demonstrate secured email communications to a supervisory authority, but the Directive itself is technology-neutral.
Essential and important entities across 18 critical sectors — energy, transport, banking, health, drinking water, digital infrastructure, ICT service management, public administration, space, postal services, waste, chemicals, food, manufacturing, digital providers, and research. Coverage generally starts at medium-sized companies (50+ staff or €10M+ turnover), with some entities covered regardless of size. Non-EU organizations offering in-scope services in the EU can also fall under it.
Essential entities face fines up to €10 million or 2% of total worldwide annual turnover, whichever is higher; important entities up to €7 million or 1.4%. Management bodies can be held personally liable, and in serious cases authorities can temporarily ban individuals from management functions at essential entities.
They already have. Member states were required to transpose NIS2 by October 17, 2024, and supervisory regimes are live in 2026 — proactive (regular audits, inspections) for essential entities, reactive for important entities. Several national transpositions set June 30, 2026 as a first-audit or evidence milestone, but timelines differ by country, so check your member state’s implementation.
Yes, if you provide in-scope services within the EU. Certain digital-infrastructure and ICT providers established outside the EU but offering services in the Union fall under the Directive and typically must designate an EU representative. If EU customers depend on your covered services, review your exposure with counsel.
Most teams are covered by more than one.
All merchants and service providers that store, process, or transmit payment-card data — regardless of size or transaction volume.
Anyone sending ~5,000+ messages a day to Gmail, Yahoo, or consumer Outlook (outlook.com, hotmail.com, live.com) addresses — and once you cross the threshold, the obligations stick. Smaller senders must still authenticate with SPF and DKIM.
Any organization applying for or renewing cyber-liability coverage — especially where the application includes email-security or ransomware supplemental questionnaires.
Audit on the calendar?
A free scan shows where you stand today, in about 30 seconds and with no account. A14-day trial shows every sender that fails alignment within 48 hours of the first reports. Under 60 days to go? The Enforcement sprint takes one domain from p=none to p=reject in about 30 days, for $2,500 per domain, one-time.
Free plan: 2 domains, no card, no expiry · Trial: card required, billed on day 15 unless you cancel · 14-day money-back on new paid plans