New research raises questions about whether Australians can trust emails appearing to come from government bodies

SYDNEY, Australia – 11 November 2026 – Proofpoint, Inc., a global leader in human and agent cybersecurity, has found that more than two in five (43%) of Australian government bodies are lagging behind on email authentication, subjecting the Australian public, government workers, professionals, and other stakeholders to a higher risk of email fraud.

These new findings are based on a Domain-based Message Authentication, Reporting and Conformance (DMARC) analysis of 155 primary bodies in the Australian government, spanning the likes of Defence; Home Affairs; Foreign Affairs and Trade; Education; Employment and Workplace Relations; Social Services; Climate Change, Energy, the Environment and Water; Treasury; and Finance. Many of these bodies hold substantial data on the Australian population, plus vital information related to Australia’s security. 

DMARC is an email authentication protocol designed to protect domain names from being misused by cybercriminals, authenticating senders’ identities before allowing a message to reach its intended destination. It has three levels of protection – monitor, quarantine, and reject, with reject being the strongest policy setting for blocking spoofed emails before they reach an inbox.

Email remains a primary vector for cyberattacks, with phishing and impersonation schemes constantly evolving. DMARC lets organisations instruct receiving servers to block messages that spoof their domain, a technique used in phishing, business email compromise (BEC), and other email-based attacks. When fully implemented at the “reject” level, it helps block spoofed emails that use an organisation’s exact domain from reaching recipients, and it is a widely deployed standard for authenticating a sender’s “From” address.

The findings reveal that while 97% of Australian government bodies have adopted the email authentication protocol, fewer than three in five (57%) have implemented it at the highest level (reject), blocking spoofed emails. Alarmingly, 3% of Australian government bodies do not have any DMARC record at all, leaving them vulnerable to cyberattacks.

The analysis comes amid a surge in cyber incidents affecting public services and critical infrastructure, with the Australian Signals Directorate’s Annual Cyber Threat Report 2025–26 warning that AI is accelerating cyber threats and increasing the risk of operational disruption. Government bodies that lack strict email verification can be impersonated through convincing scams designed to steal credentials, login details, or sensitive personal data.

When Proofpoint published its first DMARC analysis of Australia’s government domains in 2025, it found that 50% of Australian government bodies were implementing DMARC’s strictest protection level. A year on, that has risen slightly from 50% to 57%, a seven-percentage-point increase.

“A year ago, our research revealed that half of Australia’s government bodies were falling short on basic email defences. While progress is encouraging, it is nowhere near fast enough in today’s evolving threat landscape,” said Steve Moros, senior director of the Advanced Technology Group for Asia Pacific and Japan at Proofpoint. “Government bodies are prime targets for cybercriminals, holding vast amounts of sensitive personal information with significant implications for national security. Without the strongest protections in place, government domains can be used to send convincing fraudulent emails that can fundamentally erode the trust Australians place in government communications.”

The full findings of Proofpoint’s DMARC analysis of Australia’s government bodies show:

• 57% of Australian government bodies have implemented the highest DMARC protection level: reject.
• 34% have a quarantine policy, meaning suspicious emails are sent to a spam folder.
• 6% have a monitor policy, which only tracks DMARC activity without blocking or quarantining emails.
• 3% have no DMARC record at all.

Best Practices for Enhanced Email Security:

• Check the validity of all email communication and be aware of potentially fraudulent emails impersonating colleagues, suppliers, and stakeholders.
• Be cautious of any communication attempts that request login credentials or threaten to suspend service or an account if a link isn’t clicked.
• Adopt phishing-resistant multifactor authentication, such as passkeys.

This analysis was conducted in October 2026 using data from 155 primary bodies on the Australian Government Organisations Register.

About Proofpoint, Inc.

Proofpoint, Inc. is a global leader in human and agent cybersecurity, securing how people, data, and AI agents connect across email, cloud, and collaboration tools. Proofpoint is a trusted partner to over 80 of the Fortune 100, over 14,000 large enterprises, and millions of smaller organisations in stopping threats, preventing data loss, and building resilience across people and AI workflows. Proofpoint’s collaboration, data, and AI security platform helps organisations of all sizes protect their people, defend their data, and adopt AI securely and confidently. Learn more at www.proofpoint.com.

Connect with Proofpoint on LinkedIn

Proofpoint is a registered trademark or tradename of Proofpoint, Inc. in the U.S. and/or other countries. All other trademarks contained herein are the property of their respective owners.