43% of Australian government bodies lack strongest DMARC setting

More than two in five Australian government bodies assessed by Proofpoint had not implemented the strongest email authentication policy, according to company findings published by GovTech Review on 11 November 2026.

The analysis, conducted in October 2026, examined 155 primary bodies listed on the Australian Government Organisations Register. Proofpoint found 97% had adopted Domain-based Message Authentication, Reporting and Conformance, or DMARC, but only 57% used its strongest policy setting, known as reject.

The results highlight a gap between adopting the protocol and configuring it to block fraudulent messages using an organisation’s exact domain. They measure authentication settings, rather than documenting successful attacks against the bodies assessed.

According to the Proofpoint-attributed article, 34% of bodies used a quarantine policy, which directs suspicious messages to a spam folder. Another 6% used a monitor policy, which tracks activity without blocking or quarantining messages, while 3% had no DMARC record.

DMARC allows organisations to tell receiving mail servers how to handle messages that fail authentication checks. At the reject level, it helps prevent messages spoofing an organisation’s exact domain from reaching recipients. That protection addresses a technique used in phishing and business email compromise, rather than establishing protection against every form of email fraud.

Steve Moros, Proofpoint’s senior director of the Advanced Technology Group for Asia Pacific and Japan, said the findings represented progress from the company’s previous research, but argued that implementation remained too slow.

“A year ago, our research revealed that half of Australia’s government bodies were falling short on basic email defences,” Moros said in the GovTech Review article. “While progress is encouraging, it is nowhere near fast enough in today’s evolving threat landscape.”

The latest figures are vendor research reported in the publication, not findings from a government audit. A separate primary report from Western Australia’s Office of the Auditor General provides broader context on public sector security controls, but does not validate Proofpoint’s DMARC results.

Published on 6 March 2026, that audit examined how seven state government entities managed and secured Microsoft 365. The work was conducted alongside general computer controls audits for the 2024-25 financial year.

The auditor found weaknesses in governance, identity and access management, information protection, logging and monitoring, and threat protection. It warned that these weaknesses heightened the risk of cyber incidents, data breaches and operational disruptions. The entities were not named to reduce their exposure to cyber threats.