Government bodies still falling short on basic email security

Research by Proofpoint has found that more than two in five (43%) of Australian Government bodies are lagging behind on email authentication, subjecting the Australian public, government workers, professionals and other stakeholders to a higher risk of email fraud.

The findings are based on a Domain-based Message Authentication, Reporting and Conformance (DMARC) analysis of 155 primary bodies in the Australian Government. Many of these bodies hold substantial data on the Australian population, plus vital information related to Australia’s security.

DMARC is an email authentication protocol designed to protect domain names from being misused by cybercriminals, authenticating senders’ identities before allowing a message to reach its intended destination. It has three levels of protection — monitor, quarantine and reject — with reject being the strongest policy setting for blocking spoofed emails before they reach an inbox.

Email remains a primary vector for cyber attacks, with phishing and impersonation schemes constantly evolving. DMARC lets organisations instruct receiving servers to block messages that spoof their domain, a technique used in phishing, business email compromise (BEC), and other email-based attacks. When fully implemented at the ‘reject’ level, it helps block spoofed emails that use an organisation’s exact domain from reaching recipients, and it is a widely deployed standard for authenticating a sender’s ‘From’ address.

The findings reveal that while 97% of Australian Government bodies have adopted the email authentication protocol, fewer than three in five (57%) have implemented it at the highest level (reject), blocking spoofed emails. Alarmingly, 3% of Australian Government bodies do not have any DMARC record at all, leaving them vulnerable to cyber attacks.

The analysis comes amid a surge in cyber incidents affecting public services and critical infrastructure, with the Australian Signals Directorate’s Annual Cyber Threat Report 2025–26 warning that AI is accelerating cyberthreats and increasing the risk of operational disruption. Government bodies that lack strict email verification can be impersonated through convincing scams designed to steal credentials, login details or sensitive personal data.

“A year ago, our research revealed that half of Australia’s government bodies were falling short on basic email defences. While progress is encouraging, it is nowhere near fast enough in today’s evolving threat landscape,” said Steve Moros, senior director of the Advanced Technology Group for Asia Pacific and Japan at Proofpoint. “Government bodies are prime targets for cybercriminals, holding vast amounts of sensitive personal information with significant implications for national security. Without the strongest protections in place, government domains can be used to send convincing fraudulent emails that can fundamentally erode the trust Australians place in government communications.”

The full findings of Proofpoint’s DMARC analysis of Australia’s government bodies show:

• 57% of Australian Government bodies have implemented the highest DMARC protection level: ‘reject’.
• 34% have a quarantine policy, meaning suspicious emails are sent to a spam folder.
• 6% have a monitor policy, which only tracks DMARC activity without blocking or quarantining emails.
• 3% have no DMARC record at all.
   

The analysis was conducted in October 2026 using data from 155 primary bodies on the Australian Government Organisations Register.

Image credit: iStock.com/Just_Super