---
title: "How can the government and public sector agencies protect their domains with DMARC? | DMARC Report"
description: "How can the government and public sector agencies protect their domains with DMARC? from DMARC Report explains practical steps for email authentication."
image: "https://dmarcreport.com/og/blog/how-government-public-sector-agencies-protect-domains-with-dmarc.png"
canonical: "https://dmarcreport.com/blog/how-government-public-sector-agencies-protect-domains-with-dmarc/"
---

Quick Answer

DMARC (RFC 7489) ties SPF and DKIM together by requiring alignment between the envelope sender and the visible \`From\` header. According to Google's February 2024 bulk sender requirements, a DMARC policy of at least \`p=none\` is now mandatory for any domain sending 5,000+ messages per day to Gmail users. DMARC Report

Related: [Free DMARC Checker](/tools/dmarc-checker/) ·[How to Create an SPF Record](/tools/spf-record-generator/) ·[SPF Record Format](/blog/spf-format-checker-dos-and-donts-for-email-authentication/) 

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fhow-government-public-sector-agencies-protect-domains-with-dmarc%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=How%20can%20the%20government%20and%20public%20sector%20agencies%20protect%20their%20domains%20with%20DMARC%3F&url=undefined%2Fblog%2Fhow-government-public-sector-agencies-protect-domains-with-dmarc%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fhow-government-public-sector-agencies-protect-domains-with-dmarc%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fhow-government-public-sector-agencies-protect-domains-with-dmarc%2F&title=How%20can%20the%20government%20and%20public%20sector%20agencies%20protect%20their%20domains%20with%20DMARC%3F "Share on Reddit") [ ](mailto:?subject=How%20can%20the%20government%20and%20public%20sector%20agencies%20protect%20their%20domains%20with%20DMARC%3F&body=Check out this article: undefined%2Fblog%2Fhow-government-public-sector-agencies-protect-domains-with-dmarc%2F "Share via Email") 

![How can the government and public sector agencies protect their domains with DMARC?](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg) 

## Try Our Free DMARC Checker

Validate your DMARC policy, check alignment settings, and verify reporting configuration.

[ Check DMARC Record → ](/tools/dmarc-checker/) 

![Dmarc office 365 9980 150x150](https://media.mailhop.org/dmarcreport/images/2025/10/dmarc-office-365-9980-150x150.jpg) 

> Email authentication isn’t just about preventing spoofing - it’s about trust, says Vasile Diaconu, Operations Lead at DuoCircle. Every email your organization sends either builds trust or erodes it. SPF, DKIM, and DMARC are the foundation of that trust. Without them, receivers have no way to distinguish your legitimate email from an attacker’s.

DMARC ([RFC 7489](https://datatracker.ietf.org/doc/html/rfc7489)) ties SPF and DKIM together by requiring alignment between the envelope sender and the visible `From` header. According to Google’s February 2024 bulk sender requirements, a DMARC policy of at least `p=none` is now mandatory for any domain sending 5,000+ messages per day to Gmail users. DMARC Report

How can the government and public sector agencies protect their domains with DMARC?

```
					<button title="Play" aria-label="Play Episode" aria-pressed="false" class="play-btn">
						
```

Play Episode

```
					</button>
					<button title="Pause" aria-label="Pause Episode" aria-pressed="false" class="pause-btn hide">
						
```

Pause Episode

```
					</button>
				

					<audio preload="none" class="clip clip-32842">
						<source src="https://media.mailhop.org/dmarcreport/images/2025/10/How-can-the-government-and-public-sector-agencies-protect-their-domains-with-DMARC.mp3">
					</audio>
						

							<button class="player-btn player-btn__volume" title="Mute/Unmute">
								
```

Mute/Unmute Episode

```
							</button>
							<button data-skip="-10" class="player-btn player-btn__rwd" title="Rewind 10 seconds">
								
```

Rewind 10 Seconds

```
							</button>
							<button data-speed="1" class="player-btn player-btn__speed" title="Playback Speed" aria-label="Playback Speed">1x</button>
							<button data-skip="30" class="player-btn player-btn__fwd" title="Fast Forward 30 seconds">
								
```

Fast Forward 30 seconds

```
							</button>
						

							<time class="ssp-timer">00:00</time>
							
```

/

```
							<!-- We need actual duration here from the server -->
							<time class="ssp-duration" datetime="PT0H2M19S">2:19</time>
			

								<nav class="player-panels-nav">
												<button class="subscribe-btn" id="subscribe-btn-32842" title="Subscribe">Subscribe</button>
																		<button class="share-btn" id="share-btn-32842" title="Share">Share</button>
										</nav>

						
```

RSS Feed

```
							<input value="https://dmarcreport.com/feed/podcast/dmarc-report" class="input-rss input-rss-32842" title="RSS Feed URL" readonly />
						

						<button class="copy-rss copy-rss-32842" title="Copy RSS Feed URL" aria-label="Copy RSS Feed URL"></button>
					

						Share						
					

						<a href="https://www.facebook.com/sharer/sharer.php?u=https://dmarcreport.com/blog/podcast/how-can-the-government-and-public-sector-agencies-protect-their-domains-with-dmarc/&t=How can the government and public sector agencies protect their domains with DMARC?" target="blank" rel="noopener noreferrer" class="share-icon facebook" title="Share on Facebook">
							

						</a>
						<a href="https://twitter.com/intent/tweet?text=https://dmarcreport.com/blog/podcast/how-can-the-government-and-public-sector-agencies-protect-their-domains-with-dmarc/&url=How can the government and public sector agencies protect their domains with DMARC?" target="blank" rel="noopener noreferrer" class="share-icon twitter" title="Share on Twitter">
							

						</a>
						<a href="https://media.mailhop.org/dmarcreport/images/2025/10/How-can-the-government-and-public-sector-agencies-protect-their-domains-with-DMARC.mp3" target="blank" rel="noopener noreferrer" class="share-icon download" title="Download" download>
							

						</a>
					

						Link						
					

						<input value="https://dmarcreport.com/blog/podcast/how-can-the-government-and-public-sector-agencies-protect-their-domains-with-dmarc/" class="input-link input-link-32842" title="Episode URL" readonly />
					

					<button class="copy-link copy-link-32842" title="Copy Episode URL" aria-label="Copy Episode URL" readonly=""></button>
					

						Embed						

					
```

/\*! This file is auto-generated \*/ ’ title=“Embed Code” class=“input-embed input-embed-32842” readonly/>

```
					<button class="copy-embed copy-embed-32842" title="Copy Embed Code" aria-label="Copy Embed Code"></button>


```

Emails from government or public sector agencies are not just a means of communication or dissemination of important information; they also reinforce **trust and authority**. Imagine if someone receives a [fraudulent email](https://www.usatoday.com/story/money/columnist/2023/09/21/ai-cyber-scams-security/70920106007/) from a seemingly official government address, the trust they place in that institution would be shattered.

_After all, it is more than just about an individual’s loss; it reflects a security gap for the citizens of the nation and erodes their confidence in public systems_. To mitigate such risks, it is important that your institution implements the right **strategies and tools**. One such critical tool that every organization (whether government or private) must have in its cyber defense arsenal is DMARC.

To put it simply, [DMARC](https://dmarcreport.com/) helps ensure that emails sent from your domain are genuine and not from fraudsters pretending to be you. It works together with SPF and DKIM to verify emails, block fake ones, and provide reports on suspicious activity. This keeps \*\*official communication secure and helps maintain public trust .

In this article, we will dig deeper to understand what DMARC does and how it \*\*protects government agencies from falling prey to email fraud.

## Why does email security even matter for public sector domains?

When receiving an email from a [public sector](https://info.mercell.com/en/blog/what-is-public-sector/) domain or a government agency, your readers might treat it as critical and credible, but that’s not always the case. Such fraudulent emails easily slip through the cracks and make their way into the inboxes of unsuspecting citizens.![Dmarc analyzer](https://media.mailhop.org/dmarcreport/images/2025/10/dmarc-analyzer-6662.jpg)

As of 2025, DMARC is mandatory under multiple compliance frameworks. [CISA BOD 18-01](https://www.cisa.gov/news-events/directives/bod-18-01) requires p=reject for US federal domains. [PCI DSS v4.0](https://www.pcisecuritystandards.org/) mandates DMARC for organizations processing payment card data as of March 2025\. Google and Yahoo require DMARC for bulk senders (5,000+ messages/day) since February 2024, and [Microsoft began rejecting](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure) non-compliant email in May 2025\. The UK [NCSC](https://www.ncsc.gov.uk/collection/email-security-and-anti-spoofing), Australia’s [ASD](https://www.cyber.gov.au/resources-business-and-government/essential-cyber-security/ism/cyber-security-guidelines/guidelines-email), and Canada’s [CCCS](https://www.cyber.gc.ca/en/guidance/implementation-guidance-email-domain-protection) all mandate DMARC for government domains. Cyber insurers increasingly require DMARC enforcement as an underwriting condition.

Since these users inherently trust the **government’s identity**, they are more likely to open such emails, follow instructions, or share personal and financial details, which is exactly what [cybercriminals](https://incyber.org/en/article/united-states-amounts-stolen-by-cybercriminals-up-33/) want.

Here’s why email security is a [non-negotiable](https://www.aljazeera.com/news/2025/9/15/lula-defends-bolsonaro-verdict-tells-trump-brazils-democracy-not-on-table) for the public sector:

- The recipients might ignore sketchy-looking messages from a shopping website but not from a government office
- The reach of government emails is huge. One such email is enough to dupe millions of people at once.
- They affect critical services. A single bad email can disrupt healthcare, defense, or [disaster response](https://en.wikipedia.org/wiki/Disaster%5Fresponse) systems.

## How are governments across the world implementing DMARC?

[Email security](https://dmarcreport.com/blog/why-email-security-matters-and-how-to-get-it-right/) for these agencies is very different from that of private organizations. With private companies, the goal is just to **protect customer data**; if public sector domains are at risk, national security is at stake. This is why you should be proactive, structured, and thorough in implementing DMARC.

![Dmarc analyzer](https://media.mailhop.org/dmarcreport/images/2025/10/dmarc-analyzer-6220.jpg) 

Here’s how governments across the world are doing it:

## United States

In the US, the [Department of Homeland Security (DHS)](https://en.wikipedia.org/wiki/United%5FStates%5FDepartment%5Fof%5FHomeland%5FSecurity) issued a directive called [BOD 18-01](https://www.infosecurity-magazine.com/news/despite-bod-1801-fed-agencies-not/), which requires all [civilian federal agencies](https://imegcorp.com/markets/civilian-agencies/) to set up SPF, DKIM, and DMARC and \*\*send regular reports on their email activity.

## United Kingdom

The UK government made it mandatory for all government domains to have a [DMARC policy](https://dmarcreport.com/blog/what-is-a-dmarc-policy-and-how-does-it-affect-sending-my-emails/) set to “**p=reject**”, the highest enforcement level . This means that any unauthenticated or suspicious email is blocked before it reaches recipients.

## Germany

In Germany, all internet service providers and public sector domains must implement [SPF](http://autospf.com/blog/spf-guide-understanding-sender-policy-framework/), DKIM, and DMARC to prevent email-based scams.

## New Zealand

Under the [Secure Government Email (SGE)](https://www.digital.govt.nz/products-and-services/products-and-services-a-z/secure-government-email) Framework, all email-enabled government domains must use **DMARC with “p=reject**”, SPF with hard-fail (-all), and DKIM signing for every outgoing email.

![What is dmarc](https://media.mailhop.org/dmarcreport/images/2025/10/what-is-dmarc-4451.jpg) 

## How should government and public sector domains implement DMARC?

Implementing DMARC for government agencies is not a one-and-done approach. It must be structured and well-planned. Here’s how you **can go about it**:

## Map every sender

Create an inventory of all the IPs, services, and vendors that send emails using your \*\*government domain or its subdomains.

## How Do You Implement SPF and DKIM for a strong foundation?

Once you have a list of authorized servers and addresses, publish it on a valid [SPF record](https://dmarcreport.com/tools/spf-record-generator/). Next, enable DKIM signing for all outgoing mail, and make sure your \*\*public DKIM keys are available as [DNS TXT records](https://www.cloudflare.com/learning/dns/dns-records/dns-txt-record/). Be sure to test these protocols thoroughly before moving to the next steps.

![Dmarc report](https://media.mailhop.org/dmarcreport/images/2025/10/dmarc-report-9993.jpg) 

## Publish a monitored DMARC record

After you have configured SPF and [DKIM](https://dmarcreport.com/blog/dkim-explained-how-dkim-works-and-why-is-dkim-important-for-organizations/), the next step is to implement DMARC.

\_In the early stages of implementation, make sure you start with the monitoring mode (p=none) instead of full enforcement (p=reject). \_This will help you understand how your domain is being used without disrupting legitimate emails.

## How Do You Analyze DMARC reports and move on to p=reject?

Review [DMARC reports](https://dmarcreport.com/blog/how-to-read-dmarc-reports-guide-2026/) to see who’s sending emails from your domain and fix any issues. Once you’re sure all genuine **senders are verified,** change your policy to p=reject to stop fake or unauthorized emails completely.

_We understand that implementing DMARC for public sector domains can be tricky, especially when the stakes are so high._ This is why our team of experts is here to help you do it seamlessly and efficiently. [Contact us](https://dmarcreport.com/contact/) today to **get started**!

## Sources

- [CISA Binding Operational Directive 18-01](https://www.cisa.gov/news-events/directives/bod-18-01)
- [Microsoft Outlook DMARC Enforcement May 2025](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure) (2025)
- [PCI DSS v4.0 - DMARC Requirement](https://www.pcisecuritystandards.org/) (2025)
- [RFC 7489 - Domain-based Message Authentication, Reporting, and Conformance (DMARC)](https://datatracker.ietf.org/doc/html/rfc7489)

## Topics

[ dkim ](/tags/dkim/)[ DMARC ](/tags/dmarc/)[ dmarc record ](/tags/dmarc-record/)[ email security ](/tags/email-security/)[ SPF ](/tags/spf/) 

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

[ Brad Slavin ](/authors/brad-slavin/) 

General Manager

Founder and General Manager of DuoCircle. Product strategy and commercial lead for DMARC Report's 2,000+ customer base.

[LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) 

## Take control of your DMARC reports

Turn raw XML into actionable dashboards. Start free - no credit card required.

[Start Free Trial](https://app.dmarcreport.com/) [Check Your DMARC Record](/tools/dmarc-checker/) 

## Related Articles

[  Foundational 7m  4 sectors that need email authentication the most and why  Oct 15, 2024 ](/blog/4-sectors-that-need-email-authentication-the-most-and-why/)[  Foundational 4m  8 Misconceptions About DMARC and its Deployment for Businesses  Dec 4, 2023 ](/blog/8-misconceptions-about-dmarc-and-its-deployment-for-businesses/)[  Foundational 8m  9 technologies to protect your emails from cyber actors  Dec 10, 2024 ](/blog/9-technologies-to-protect-your-emails-from-cyber-actors/)[  Foundational 14m  Add TXT Record on Namecheap: A Complete DNS Guide  Mar 5, 2025 ](/blog/add-txt-record-on-namecheap-a-complete-dns-guide/)

```json
{"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"470","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"How can the government and public sector agencies protect their domains with DMARC?","description":"How can the government and public sector agencies protect their domains with DMARC? from DMARC Report explains practical steps for email authentication.","url":"https://dmarcreport.com/blog/how-government-public-sector-agencies-protect-domains-with-dmarc/","datePublished":"2025-10-16T11:14:47.000Z","dateModified":"2026-04-16T15:53:43.000Z","dateCreated":"2025-10-16T11:14:47.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://dmarcreport.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the founder and General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 2,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"470","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/how-government-public-sector-agencies-protect-domains-with-dmarc/"},"articleSection":"foundational","keywords":"dkim, DMARC, dmarc record, email security, SPF","wordCount":1215,"image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg","caption":"How can the government and public sector agencies protect their domains with DMARC?","width":900,"height":600},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Foundational","item":"https://dmarcreport.com/foundational/"},{"@type":"ListItem","position":4,"name":"How can the government and public sector agencies protect their domains with DMARC?","item":"https://dmarcreport.com/blog/how-government-public-sector-agencies-protect-domains-with-dmarc/"}]}
```