Cyber insurers are now asking for DMARC receipts

Cyber insurance isn’t just asking whether you’ve heard of DMARC anymore. In 2026, underwriters want proof that you publish SPF, sign with DKIM, and enforce DMARC—and they’re folding that into how they price and shape coverage, according to dmarcian’s analysis.

That scrutiny is landing at the same time Europe’s rules harden. NIS2 arrived in October 2024 and DORA followed in January 2025, pushing many of the same email and risk controls insurers now expect—making the insurance form and the compliance checklist start to look alike.

What happened

Underwriting questionnaires in 2026 ask whether SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting and Conformance) are implemented and enforced, alongside controls such as phishing‑resistant MFA, tested offline or immutable backups, Endpoint Detection and Response (EDR), a documented incident response plan, regular phishing training, third‑party risk assessments, and disclosure of AI usage, the source reports.

Chubb’s Irish proposal form illustrates the detail: applicants are asked to confirm whether “SPF is enforced” as part of their email controls, and Aviva’s UK cyber application explicitly references DMARC with SPF and DKIM, covering the full email authentication stack, per the source.

The claims backdrop explains the focus. The FBI’s Internet Crime Complaint Center attributed over $3.04 billion in U.S. losses to business email compromise (BEC) in 2025, a driver for why email authentication shows up on cyber insurance applications, according to the report.

Market dynamics are shifting too. U.S. direct written premiums dipped in 2024 while the number of claims climbed nearly 40%, the National Association of Insurance Commissioners (NAIC) data cited by the source shows.

Pricing has softened longer than expected, with AM Best recording eight consecutive quarters of U.S. rate declines through Q1 2026—even as rising claim severity pressures insurers to eventually turn rates upward, the source notes.

Insurers are leaning into controls‑based underwriting, where demonstrable security practices—like DMARC at enforcement—shape pricing and coverage more than blanket rate changes, according to the analysis.

The background

Cyber insurance uptake jumped from 26% of organizations in 2016 to 47% in 2020, based on U.S. Government Accountability Office figures cited in the report. That expansion set the stage for today’s more granular underwriting.

Ransomware continues to concentrate large‑claim value, but faster detection has lowered average claim severity, according to Allianz Commercial as referenced by the source. That mix pushes carriers to probe controls that limit blast radius and downtime.

Europe’s regulatory track adds pressure. NIS2, in force since October 2024, sets baseline risk‑management obligations across 18 sectors and includes incident reporting; Germany’s Federal Office for Information Security explicitly lists email authentication as an expected control, the source says.

DORA, live since January 2025 for EU financial institutions and their ICT providers, formalizes ICT risk management, third‑party oversight, resilience testing, and incident reporting—pulling email security into a regulated operational risk flow, per the analysis.

Adoption still lags risk in parts of Europe. Howden’s 2025 Cyber Report put insurance uptake at 22% in Italy and 39% in the UK, even as Allianz’s Risk Barometer ranked cyber the top business risk in Europe for two straight years, the source reports.

ENISA’s 2025 Threat Landscape found phishing behind 60% of observed intrusions across the EU, linking inbox exposure to a majority of initial access paths and underscoring why authentication is under the microscope, according to the report.

What people are saying

The source says insurers increasingly prefer “controls‑based underwriting,” where provable practices—like enforced DMARC—earn clearer terms and make quoting smoother than relying on broad market pricing alone.

Underwriters are also asking organizations to disclose how they use AI. The analysis warns that shadow AI, like shadow IT, can create coverage gaps as exclusions emerge and AI‑related claims straddle cyber, Tech E&O, directors and officers, and employment practices liability policies.

On the threat side, the report notes AI can sharpen phishing, BEC, and impersonation through polished lures and cloned voices or deepfake video; however, it doesn’t alter DMARC’s core check: is the sender authorized to use the domain? That stability keeps alignment and enforcement central to email defense.

Security teams are responding by documenting controls that map to both insurers and regulators. For senders, that means capturing DMARC alignment decisions, publishing policies at p=quarantine or p=reject, and keeping RUA/RUF reporting evidence—steps we covered in our guide to DMARC‑first BIMI readiness.

For large programs, the source highlights broader hygiene: phishing‑resistant MFA for cloud email, tested offline or immutable backups, and EDR coverage. Those controls intersect with lessons from outages and compromises we tracked in our coverage of Germany’s DMARC enforcement gains and pitfalls and our 30‑day hardening plan in Lock down your email in 30 days.

What happens next

Expect the EU compliance checklist and cyber insurance questionnaire to keep converging. The analysis says it’s reasonable that NIS2 or DORA compliance status will become standard items on EU applications as both processes ask about the same underlying controls.

In the U.S., AM Best’s recorded rate declines through Q1 2026 could reverse as claim severity rises, making documented controls a hedge against tougher terms. Organizations with enforced DMARC and auditable practices may move faster through underwriting when pricing tightens, per the source.

For senders without enforcement, the near‑term lift is tangible: authenticate all mail streams with SPF and DKIM, align domains, and move from p=none to p=quarantine or p=reject with staged rollouts. That sequencing shortens the distance between deliverability work and insurability asks—a theme we track on our industry hub.