NIS2 Article 21: DNS Auditors Ask For
EU auditors map Article 21 to DNS and mail controls they can verify. Here is what they request and how to produce it.
The auditor does not open with firewalls. They ask for your domain's DMARC aggregate reports from Q1. A 95-person medical device distributor in Munich went through a NIS2 readiness review in March 2026. The CISO brought endpoint logs, backup test results, and a vendor risk spreadsheet. The external assessor spent forty minutes on email DNS: current SPF TXT, proof DKIM was signing production mail, whether DMARC policy had moved past monitor-only, and who reviewed DNS changes when marketing added a new ESP in January. Article 21 of Directive (EU) 2022/2555 (NIS2) requires essential and important entities to implement appropriate technical and organizational measures. Member state laws name sectors and enforcement timelines; by 2026, supervisory authorities in multiple EU countries are actively scheduling reviews. The directive text does not say "publish SPF." Assessors still ask for nis2 article 21 dns evidence because transmission security and detectability of incidents are easier to verify on mail infrastructure than on abstract policy PDFs. If you cannot show DNS controls operated during the assessment window, you are arguing trust. They want artifacts.
What Article 21 Actually Requires (Plain Language)
Article 21(2) lists measure categories: risk analysis, incident handling, business continuity, supply chain security, security in network acquisition and maintenance, policies on cryptography, human resources, and access control policies.
Paragraph 2(g) adds use of cryptography and encryption where appropriate. Paragraph 2(h) covers human resources and access control.
Where DNS and email fit
- Transmission security (2(g)): MTA-STS, TLS-RPT, SMTP TLS posture for domains that receive or relay sensitive mail.
- Network acquisition and maintenance (2(d)): DNS records are part of your network configuration. Unauthorized or accidental changes to SPF/DKIM/DMARC are incidents waiting to happen.
- Risk analysis (2(a)): Spoofing and BEC via your domain are identified risks. Authentication records are controls.
- Incident handling (2(b)): DMARC aggregate and forensic signals (where used) feed detection of abuse.
No single annex lists "ten TXT records." Assessors map your controls to these paragraphs and ask for proof they ran in the period under review.
The DNS Controls Auditors Request Most Often
From NIS2-focused reviews we see in 2026, these requests recur:
1. Current authentication records
Exports or screenshots of SPF, DKIM selectors, and DMARC TXT with dates. They check for -all on sending domains, published rua=, and whether policy is none, quarantine, or reject.
2. Alignment evidence
Test messages or Authentication-Results headers showing dmarc=pass on production paths (M365, Google Workspace, ESP). Failures without remediation tickets raise flags.
3. DMARC aggregate history
30-90 days of RUA summaries: pass/fail volumes, unknown senders, trend lines. "We receive reports" is not enough if nobody parsed them.
4. Change management for DNS
Who approved the Mailchimp include added in January? Ticket ID, approver, rollback plan. Ad-hoc Cloudflare edits without logs fail mature assessments.
5. Continuous monitoring proof
Alerts when SPF, DKIM, DMARC, MX, or MTA-STS changed. Point-in-time scans before the audit are weak. Daily or weekly monitoring with retained history is what SOC2-trained auditors increasingly expect.
6. MTA-STS and TLS-RPT (inbound)
Policy file URL, mode (testing vs. enforce), and whether TLS failure reports are reviewed.
7. Named accountable role
Job title responsible for mail DNS posture, not a shared mailbox from 2019.
“Auditors do not grade your intentions. They grade dated artifacts tied to named controls.”
Sample Auditor Questions (And What They Really Want)
"Show continuous monitoring of email-related DNS."
They want timestamps: what the record was on March 1, what changed on March 14, who was notified, what you did. Excel snapshots without history are incomplete.
"How do you detect unauthorized sending from your domain?"
DMARC reports plus blocklist monitoring plus incident playbook. p=none without a roadmap to enforcement is a finding in regulated sectors in 2026.
"Who reviews DMARC aggregate reports and how often?"
Weekly is a credible answer for production domains. "The IT director when they have time" is not.
"Prove encryption for email transmission."
MTA-STS enforce mode or documented SMTP TLS requirements for outbound relays. PCI and health data environments get extra scrutiny.
"What happens if SPF returns PermError?"
They are testing whether you understand authentication failures. Know the 10 lookup limit and your remediation process. Reference: zerohook.org/fix/spf-permerror.
How to Prepare an Evidence Pack in Two Weeks
Inventory every domain that sends or receives regulated mail. Export current DNS for SPF, DKIM, DMARC, MX, MTA-STS, TLS-RPT from your DNS host (Cloudflare, Route53, etc.).
Run baseline validation on each domain. Fix PermError, missing DKIM, and alignment failures before you bundle evidence. Free checkers at zerohook.org/spf-checker and zerohook.org/dmarc-checker cover point-in-time baseline.
Enable DMARC aggregate reporting to an inbox or parser your team monitors. Archive 60 days minimum before the review window.
Turn on continuous monitoring with alert routing to a named owner. Retain change logs for the assessment period.
Write a one-page control narrative: which Article 21 paragraphs each DNS control satisfies, who owns it, review cadence, and where evidence lives (ticket system, monitoring export, shared drive path).
Tabletop one scenario: spoofed CEO email or blocklist listing. Document detection time and steps taken. Attach redacted tickets to the pack.
What Fails Reviews (And Cheap Fixes)
Fail: DMARC p=none for three years, no enforcement plan.
Fix: Document staged rollout (quarantine with pct=, then reject) with dates. Link to zerohook.org/blog/dmarc-p-reject-rollout-8-weeks.
Fail: Marketing ESP not in SPF, DKIM unsigned.
Fix: Authenticate domain in ESP, publish records, re-test alignment.
Fail: No evidence between annual audits.
Fix: Monitoring tier with retained history ($29/month Deliverability for single domain baseline; Evidence tier at $199/month for auditor PDFs and 365-day tamper-proof logs).
Fail: Controls described in policy but no owner.
Fix: RACI line in the control narrative: Responsible, Accountable, Consulted, Informed.
Frequently Asked Questions
Is NIS2 Article 21 the same as GDPR Article 32?
No. GDPR Article 32 covers security of personal data processing broadly. NIS2 Article 21 targets network and information systems for in-scope entities under the cybersecurity directive. Overlap exists on transmission security, but legal bases and supervisors differ. Many firms map both to the same DNS monitoring evidence to avoid duplicate work.
Do US companies need Article 21 DNS evidence?
Not for NIS2 unless you have an EU in-scope entity or critical supplier obligations. Your EU customers may still require the same artifacts in vendor security questionnaires.
How long should we retain DNS monitoring logs?
Align to your audit cycle. Twelve months is a common minimum for SOC2-style reviews; regulated sectors may require longer. Evidence tier retention options extend to multiple years on paid plans.
Can consultants produce evidence we do not have?
They can document current state and remediation plans. They cannot fabricate historical monitoring you never ran. Start monitoring now; retroactive evidence is not a thing.
Key takeaways
Article 21 does not list SPF, but DNS and mail authentication are the fastest controls for assessors to verify.
Prepare dated artifacts: records, DMARC summaries, change tickets, monitoring alerts, named owners.
Continuous monitoring beats pre-audit panic scans.
Link controls explicitly to Article 21 paragraphs in your narrative.
Fix authentication gaps before the review, not during it.
Map your domains to NIS2 controls and start monitoring at zerohook.org/nis2-guide before the first auditor email arrives.
Share this analysis
Help others discover this content
About the author
The ZeroHook Team tracks NIS2, ISO 27001, SOC2, and GDPR evidence requirements for EU SMBs. We write what auditors actually ask for, not what vendor decks claim.
