How can the government and public sector agencies protect their domains with DMARC?

Email authentication isn’t just about preventing spoofing - it’s about trust, says Vasile Diaconu, Operations Lead at DuoCircle. Every email your organization sends either builds trust or erodes it. SPF, DKIM, and DMARC are the foundation of that trust. Without them, receivers have no way to distinguish your legitimate email from an attacker’s.

DMARC (RFC 7489) ties SPF and DKIM together by requiring alignment between the envelope sender and the visible From header. According to Google’s February 2024 bulk sender requirements, a DMARC policy of at least p=none is now mandatory for any domain sending 5,000+ messages per day to Gmail users. DMARC Report

How can the government and public sector agencies protect their domains with DMARC?

					<button title="Play" aria-label="Play Episode" aria-pressed="false" class="play-btn">
						

Play Episode

					</button>
					<button title="Pause" aria-label="Pause Episode" aria-pressed="false" class="pause-btn hide">
						

Pause Episode

					</button>
					


				

				

					<audio preload="none" class="clip clip-32842">
						<source src="https://media.mailhop.org/dmarcreport/images/2025/10/How-can-the-government-and-public-sector-agencies-protect-their-domains-with-DMARC.mp3">
					</audio>
					

						

					

					

						

							<button class="player-btn player-btn__volume" title="Mute/Unmute">
								

Mute/Unmute Episode

							</button>
							<button data-skip="-10" class="player-btn player-btn__rwd" title="Rewind 10 seconds">
								

Rewind 10 Seconds

							</button>
							<button data-speed="1" class="player-btn player-btn__speed" title="Playback Speed" aria-label="Playback Speed">1x</button>
							<button data-skip="30" class="player-btn player-btn__fwd" title="Fast Forward 30 seconds">
								

Fast Forward 30 seconds

							</button>
						

						

							<time class="ssp-timer">00:00</time>
							

/

							<!-- We need actual duration here from the server -->
							<time class="ssp-duration" datetime="PT0H2M19S">2:19</time>
						

					

				

			

								<nav class="player-panels-nav">
												<button class="subscribe-btn" id="subscribe-btn-32842" title="Subscribe">Subscribe</button>
																		<button class="share-btn" id="share-btn-32842" title="Share">Share</button>
										</nav>
						

	



		

						

				

					

					

				

				

					

																																																																								

					

						

RSS Feed

							<input value="https://dmarcreport.com/feed/podcast/dmarc-report" class="input-rss input-rss-32842" title="RSS Feed URL" readonly />
						

						<button class="copy-rss copy-rss-32842" title="Copy RSS Feed URL" aria-label="Copy RSS Feed URL"></button>
					

				

			

									

				

					

					

				

				

					

						Share						

					

						<a href="https://www.facebook.com/sharer/sharer.php?u=https://dmarcreport.com/blog/podcast/how-can-the-government-and-public-sector-agencies-protect-their-domains-with-dmarc/&t=How can the government and public sector agencies protect their domains with DMARC?" target="blank" rel="noopener noreferrer" class="share-icon facebook" title="Share on Facebook">
							

						</a>
						<a href="https://twitter.com/intent/tweet?text=https://dmarcreport.com/blog/podcast/how-can-the-government-and-public-sector-agencies-protect-their-domains-with-dmarc/&url=How can the government and public sector agencies protect their domains with DMARC?" target="blank" rel="noopener noreferrer" class="share-icon twitter" title="Share on Twitter">
							

						</a>
						<a href="https://media.mailhop.org/dmarcreport/images/2025/10/How-can-the-government-and-public-sector-agencies-protect-their-domains-with-DMARC.mp3" target="blank" rel="noopener noreferrer" class="share-icon download" title="Download" download>
							

						</a>
					

				

				

					

						Link						

					

						<input value="https://dmarcreport.com/blog/podcast/how-can-the-government-and-public-sector-agencies-protect-their-domains-with-dmarc/" class="input-link input-link-32842" title="Episode URL" readonly />
					

					<button class="copy-link copy-link-32842" title="Copy Episode URL" aria-label="Copy Episode URL" readonly=""></button>
				

				

					

						Embed						

					

						<input type="text" value='<blockquote class="wp-embedded-content" data-secret="3SAVW4Bv9G"><a href="https://dmarcreport.com/blog/podcast/how-can-the-government-and-public-sector-agencies-protect-their-domains-with-dmarc/">How can the government and public sector agencies protect their domains with DMARC?</a></blockquote><iframe sandbox="allow-scripts" security="restricted" src="https://dmarcreport.com/blog/podcast/how-can-the-government-and-public-sector-agencies-protect-their-domains-with-dmarc/embed/#?secret=3SAVW4Bv9G" width="500" height="350" title=""How can the government and public sector agencies protect their domains with DMARC?" - DMARC Report" data-secret="3SAVW4Bv9G" frameborder="0" marginwidth="0" marginheight="0" scrolling="no" class="wp-embedded-content"></iframe><script>

/*! This file is auto-generated / !function(d,l){“use strict”;l.querySelector&&d.addEventListener&&“undefined”!=typeof URL&&(d.wp=d.wp||{},d.wp.receiveEmbedMessage||(d.wp.receiveEmbedMessage=function(e){var t=e.data;if((t||t.secret||t.message||t.value)&&!/[^a-zA-Z0-9]/.test(t.secret)){for(var s,r,n,a=l.querySelectorAll(‘iframe[data-secret=”‘+t.secret+’”]’),o=l.querySelectorAll(‘blockquote[data-secret=”‘+t.secret+’”]’),c=new RegExp(“^https?:$”,“i”),i=0;i<o.length;i++)o[i].style.display=“none”;for(i=0;i<a.length;i++)s=a[i],e.source===s.contentWindow&&(s.removeAttribute(“style”),“height”===t.message?(1e3<(r=parseInt(t.value,10))?r=1e3:~~r<200&&(r=200),s.height=r):“link”===t.message&&(r=new URL(s.getAttribute(“src”)),n=new URL(t.value),c.test(n.protocol))&&n.host===r.host&&l.activeElement===s&&(d.top.location.href=t.value))}},d.addEventListener(“message”,d.wp.receiveEmbedMessage,!1),l.addEventListener(“DOMContentLoaded”,function(){for(var e,t,s=l.querySelectorAll(“iframe.wp-embedded-content”),r=0;r<s.length;r++)(t=(e=s[r]).getAttribute(“data-secret”))||(t=Math.random().toString(36).substring(2,12),e.src+=”#?secret=“+t,e.setAttribute(“data-secret”,t)),e.contentWindow.postMessage({message:“ready”,secret:t},"")},!1)))}(window,document); //# sourceURL=https://dmarcreport.com/wp-includes/js/wp-embed.min.js ’ title=“Embed Code” class=“input-embed input-embed-32842” readonly/>

					<button class="copy-embed copy-embed-32842" title="Copy Embed Code" aria-label="Copy Embed Code"></button>
				

			

				

Emails from government or public sector agencies are not just a means of communication or dissemination of important information; they also reinforce trust and authority. Imagine if someone receives a fraudulent email from a seemingly official government address, the trust they place in that institution would be shattered.

After all, it is more than just about an individual’s loss; it reflects a security gap for the citizens of the nation and erodes their confidence in public systems. To mitigate such risks, it is important that your institution implements the right strategies and tools. One such critical tool that every organization (whether government or private) must have in its cyber defense arsenal is DMARC.

To put it simply, DMARC helps ensure that emails sent from your domain are genuine and not from fraudsters pretending to be you. It works together with SPF and DKIM to verify emails, block fake ones, and provide reports on suspicious activity. This keeps **official communication secure and helps maintain public trust .

In this article, we will dig deeper to understand what DMARC does and how it **protects government agencies from falling prey to email fraud.

Why does email security even matter for public sector domains?

When receiving an email from a public sector domain or a government agency, your readers might treat it as critical and credible, but that’s not always the case. Such fraudulent emails easily slip through the cracks and make their way into the inboxes of unsuspecting citizens.

As of 2025, DMARC is mandatory under multiple compliance frameworks. CISA BOD 18-01 requires p=reject for US federal domains. PCI DSS v4.0 mandates DMARC for organizations processing payment card data as of March 2025. Google and Yahoo require DMARC for bulk senders (5,000+ messages/day) since February 2024, and Microsoft began rejecting non-compliant email in May 2025. The UK NCSC, Australia’s ASD, and Canada’s CCCS all mandate DMARC for government domains. Cyber insurers increasingly require DMARC enforcement as an underwriting condition.

Since these users inherently trust the government’s identity, they are more likely to open such emails, follow instructions, or share personal and financial details, which is exactly what cybercriminals want.

Here’s why email security is a non-negotiable for the public sector:

• The recipients might ignore sketchy-looking messages from a shopping website but not from a government office

• The reach of government emails is huge. One such email is enough to dupe millions of people at once.

• They affect critical services. A single bad email can disrupt healthcare, defense, or disaster response systems.

How are governments across the world implementing DMARC?

Email security for these agencies is very different from that of private organizations. With private companies, the goal is just to protect customer data; if public sector domains are at risk, national security is at stake. This is why you should be proactive, structured, and thorough in implementing DMARC.

Here’s how governments across the world are doing it:

United States

In the US, the Department of Homeland Security (DHS) issued a directive called BOD 18-01, which requires all civilian federal agencies to set up SPF, DKIM, and DMARC and **send regular reports on their email activity.

United Kingdom

The UK government made it mandatory for all government domains to have a DMARC policy set to “p=reject”, the highest enforcement level . This means that any unauthenticated or suspicious email is blocked before it reaches recipients.

Germany

In Germany, all internet service providers and public sector domains must implement SPF, DKIM, and DMARC to prevent email-based scams.

New Zealand

Under the Secure Government Email (SGE) Framework, all email-enabled government domains must use DMARC with “p=reject”, SPF with hard-fail (-all), and DKIM signing for every outgoing email.

How should government and public sector domains implement DMARC?

Implementing DMARC for government agencies is not a one-and-done approach. It must be structured and well-planned. Here’s how you can go about it:

Map every sender

Create an inventory of all the IPs, services, and vendors that send emails using your **government domain or its subdomains.

How Do You Implement SPF and DKIM for a strong foundation?

Once you have a list of authorized servers and addresses, publish it on a valid SPF record. Next, enable DKIM signing for all outgoing mail, and make sure your **public DKIM keys are available as DNS TXT records. Be sure to test these protocols thoroughly before moving to the next steps.

Publish a monitored DMARC record

After you have configured SPF and DKIM, the next step is to implement DMARC.

_In the early stages of implementation, make sure you start with the monitoring mode (p=none) instead of full enforcement (p=reject). _This will help you understand how your domain is being used without disrupting legitimate emails.

How Do You Analyze DMARC reports and move on to p=reject?

Review DMARC reports to see who’s sending emails from your domain and fix any issues. Once you’re sure all genuine senders are verified, change your policy to p=reject to stop fake or unauthorized emails completely.

We understand that implementing DMARC for public sector domains can be tricky, especially when the stakes are so high. This is why our team of experts is here to help you do it seamlessly and efficiently. Contact us today to get started!

Sources

• CISA Binding Operational Directive 18-01
• Microsoft Outlook DMARC Enforcement May 2025 (2025)
• PCI DSS v4.0 - DMARC Requirement (2025)
• RFC 7489 - Domain-based Message Authentication, Reporting, and Conformance (DMARC)