Most Australian government bodies lack top email defence

Proofpoint has found that 43% of Australian government bodies are not using the strongest DMARC email authentication setting on their domains. The analysis covered 155 primary government bodies.

It found 57% had adopted DMARC at the strictest "reject" level, which blocks spoofed emails from reaching inboxes. Another 34% use a "quarantine" policy that sends suspicious messages to spam folders, 6% only monitor activity without blocking messages, and 3% have no DMARC record.

The findings cover departments and agencies across areas including Defence, Home Affairs, Foreign Affairs and Trade, Education, Social Services, Treasury and Finance. Many hold sensitive personal information and data tied to national security and public services.

DMARC, short for Domain-based Message Authentication, Reporting and Conformance, is an email authentication standard designed to stop attackers from sending messages that appear to come from a legitimate government domain. Its strongest setting, known as reject, instructs receiving servers to block emails that fail authentication checks.

The research comes as the federal government moves to tighten security obligations around artificial intelligence, including mandatory security standards and incident reporting for AI companies. That has sharpened attention on whether public sector organisations are keeping pace with longstanding cyber defences in their own systems.

The results show only limited improvement from Proofpoint's earlier review of government domains. In its 2025 analysis, 50% of Australian government bodies had implemented the reject setting, compared with 57% in the current study.

Email risks

Email remains one of the main routes used in cyberattacks, particularly phishing and impersonation attempts. When a government body does not enforce strict email authentication, attackers can mimic its domain to persuade recipients to hand over passwords, login details or personal information.

That risk extends beyond the public. Government staff, contractors, suppliers and other stakeholders can all be targeted through messages that appear to come from trusted official addresses.

The Australian Signals Directorate's Annual Cyber Threat Report for 2025-26 warned that AI is increasing the pace and scale of cyber threats and raising the risk of disruption to public services and critical infrastructure. Against that backdrop, DMARC adoption across government domains offers a snapshot of how widely basic controls have been put in place.

According to the analysis, 97% of the government bodies reviewed have adopted DMARC in some form. The issue is not awareness of the standard, but whether agencies have moved from monitoring and quarantine settings to the stricter reject policy.

Steve Moros, Senior Director of the Advanced Technology Group for Asia Pacific and Japan at Proofpoint, said the pace of change remained too slow.

"A year ago, our research revealed that half of Australia's government bodies were falling short on basic email defences. While progress is encouraging, it is nowhere near fast enough in today's evolving threat landscape," Moros said.

He said government organisations were particularly exposed because of the information they hold and the trust placed in their communications.

"Government bodies are prime targets for cybercriminals, holding vast amounts of sensitive personal information with significant implications for national security. Without the strongest protections in place, government domains can be used to send convincing fraudulent emails that can fundamentally erode the trust Australians place in government communications," Moros said.

Slow progress

The results point to a gap between broad adoption and full enforcement. A quarantine policy may divert suspicious emails to spam folders, while monitor settings let organisations track unauthorised use of their domains without stopping those messages from being delivered. For agencies with no DMARC record, there is no published instruction for receiving mail servers on how to handle unauthenticated messages.

The analysis was based on 155 primary bodies listed on the Australian Government Organisations Register. It is therefore a domain-level review of central government organisations, rather than a survey of all public sector entities.

The data suggests that, despite a modest rise in use of the reject setting, more than two in five core government bodies still have not applied the strictest domain protection against impersonation. In practice, that leaves room for fraudulent emails to reach citizens, businesses and staff while appearing to come from official addresses.

Among the 155 organisations reviewed, 3% had no DMARC record at all.