NIS2 Email Authentication Readiness Scorecard

Why this matters now

The NIS2 Directive is in force across the EU — the transposition deadline was October 17, 2024 and national enforcement is rolling out now (Germany's NIS2UmsuCG has been in force since December 6, 2025). Essential and important entities — from mid-market manufacturing to managed-service providers across the 18 sectors in Annexes I and II — must demonstrate the technical and organisational measures listed in Article 21 §2. Three of the ten measures map directly to email authentication:

• §2(d) supply-chain security — auditors expect you to verify that DNS-borne identity (DMARC, SPF, DKIM) cannot be spoofed upstream. DNSSEC is the answer.
• §2(g) basic cyber hygiene — the Directive lists "basic cyber hygiene practices and cybersecurity training"; the Commission's Implementing Regulation (EU) 2024/2690 counts "the deployment of internationally agreed and interoperable modern email communications standards" and "protection from phishing" among them. SPF, DKIM, and DMARC are those standards.
• §2(h) cryptography and encryption — covers encryption in transit for email, which translates to MTA-STS in enforce mode and TLS-RPT for visibility.

What this tool does

Run a domain through the scanner above. Each control is checked against the NIS2 baseline derived from Article 21 §2, the Commission's Implementing Regulation, and the national guidance published by ANSSI (France) and BSI (Germany). Every result links to a deeper protocol checker if you need to see the raw record.

The scan runs entirely in your browser via Cloudflare DoH. Nothing is sent to our servers and nothing is stored. If you want the same scorecard packaged as an auditor-ready PDF with a NIS2 control cross-walk, the paid tier emails it on a weekly cadence.

Article 21 §2 quick reference

Scope check — does this apply to you?

NIS2 covers essential entities (energy, transport, banking, healthcare, ICT services, public administration, and more) and important entities (manufacturing, food, postal services, digital providers, research). If your organisation has 50 or more employees — or exceeds the medium-enterprise ceilings of Recommendation 2003/361/EC on turnover and balance sheet — and operates in any of the 18 listed sectors, you are in scope under Article 2(1). National transpositions decide who supervises you: Germany's NIS2UmsuCG routes supervision through the BSI, whose statutory registration deadline has already passed; France routes through ANSSI.

What this tool does not cover

Article 21 is broader than email. The seven §2 paragraphs not listed above — risk policies, incident reporting timelines, business continuity, vulnerability handling, access control, asset management, MFA — are organisational and process controls that DNS cannot speak to. Use this scorecard as the evidence pack for the email-specific portion of an Article 21 audit, not as a full NIS2 gap analysis.

Read the complete EU · NIS2 guide to learn more.