DORA ICT Email Control Mapper
Map your domain's DMARC, SPF, MTA-STS, TLS-RPT, and DNSSEC posture to DORA Articles 9, 10, and 11. Built for EU financial entities preparing for supervisor reviews under Regulation (EU) 2022/2554.
Why this matters
The Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554) has applied across the EU financial sector since January 17, 2025. Every bank, insurer, investment firm, crypto-asset provider, and critical ICT third-party serving the FS sector must demonstrate the five ICT risk-management pillars listed in Article 6. Three of those pillars depend directly on email-authentication posture:
- Article 9 — Protection & prevention: §2(a) names "protection and prevention measures" against unauthorised access — DMARC, SPF, and DKIM are the only DNS-borne controls that block sender impersonation at receiver edge. §3(c) requires cryptographic protection of data in transit (MTA-STS).
- Article 10 — Detection: §1 requires mechanisms that promptly detect anomalous activities. TLS-RPT is the email-transport telemetry source supervisors look for.
- Article 11 — Response & recovery: DMARC aggregate (rua) reports feed the §1 incident-response process with first-party evidence of authentication failures during a security event.
What the supervisor will ask
Under Article 5(3), management bodies of FS entities are accountable for the ICT risk-management framework. The standard supervisor question on email-auth is "show us the policy, show us the evidence, show us the monitoring." This tool produces the evidence layer. The policy and monitoring layers are free — DMARC report ingestion and weekly compliance digests are included at no cost; Slack, webhook, and SIEM routing for control-drift alerts is on Pro.
DORA Article 9-11 cross-walk
| Article | Requirement | Email-auth control |
|---|---|---|
Art. 9(2)(a) | Protection & prevention against unauthorised access | DMARC + SPF + DKIM |
Art. 9(3)(b) | Integrity of data | DNSSEC (signed identity records) |
Art. 9(3)(c) | Cryptographic protection of data in transit | MTA-STS enforce mode |
Art. 10(1) | Detection of anomalous activities | TLS-RPT (transport-layer telemetry) |
Art. 11(1) | Response & recovery — incident process | DMARC rua aggregate reports |
Subcontractors and the ESP supply chain
Commission Delegated Regulation (EU) 2025/532 sets out what a financial entity must determine and assess when it subcontracts ICT services supporting critical or important functions. It names no email provider; our reading is that if your firm sends customer mail through an ESP (Mailgun, SendGrid, Postmark, etc.), that ESP's SPF/DKIM posture is part of what you assess — auditors will follow the include chain. Use the SPF flattener to walk it and the DMARC report analyzer to confirm each subcontractor is signing the messages they send on your behalf.
What this tool does not cover
Article 6 lists five pillars: governance & organisation, ICT risk-management framework, ICT third-party risk management, digital operational resilience testing, and information & intelligence sharing. The email-auth check above evidences the technical sub-controls of the second pillar only. Use this scorecard as supporting evidence inside a DORA programme, not as the programme itself.
Read the complete EU · DORA guide to learn more.
Get the full picture with DMARCguard
Continuous monitoring, aggregate report parsing, and actionable insights for all your email authentication protocols.
Start Free