DMARC for Government Domains

Introduction

Government domains have been among the earliest adopters of mandatory DMARC enforcement. The UK Government Digital Service required p=reject years ago; the US CISA Binding Operational Directive 18-01 set similar requirements. This article covers the government-sector DMARC landscape.

Why this topic matters

Government brands are heavily targeted for phishing — fake tax notices, fake benefits communications, fake regulatory updates. Citizens trust government mail; attackers exploit that trust. DMARC at enforcement removes the exact-spoofing capability.

Government mandates

• UK — National Cyber Security Centre and Government Digital Service require p=reject for .gov.uk domains.
• US — CISA Binding Operational Directive 18-01 required executive branch agencies to publish DMARC and reach p=reject.
• EU — National CERTs increasingly publish DMARC adoption targets.
• Various national governments — adopting similar mandates.

The trend is universal: government domains are expected to be at full enforcement.

What DMARC protects

• Citizen-targeting phishing. Fake tax/benefits/health communications.
• Inter-agency BEC. Fake official inter-departmental emails.
• Fraud-inducement. Fake government invoices or fines.
• Brand-trust damage. Citizens losing trust in official communications.

All exact-domain spoofing scenarios.

Step-by-step approach

1. Identify all government domains. Often more than expected at any level of government.
2. Audit current posture per domain.
3. Inventory senders. Government IT often has decentralized sender estates.
4. Roll out per domain following the standard playbook.
5. Coordinate with national CERT for guidance and reporting.

Best practices

• Treat as mandate compliance. Government adoption is non-negotiable.
• Coordinate across departments. Decentralized IT needs explicit governance.
• Use subdomain policy carefully for departmental autonomy.
• Pair with broader cybersecurity framework (NIST, ENISA, etc.).
• Report compliance to oversight bodies.

Recommended next step

Government IT leads should treat DMARC as a regulatory deliverable. The rollout is the work; compliance reporting is the artefact.

FAQ

Which governments require DMARC?

UK, US (executive branch), and various others. Trend is universal.

What about local government?

Increasingly under similar mandates. Check national CERT guidance.

How does this interact with FedRAMP / NIST SP 800-53?

Email authentication is referenced. DMARC adoption supports compliance.

What about countries without explicit mandates?

National CERTs increasingly publish DMARC targets even without statutory mandate.

Should governments require DMARC of suppliers?

Some do. UK government procurement increasingly references it.

Final thoughts

Government DMARC is no longer optional. The mandates exist, the citizen-protection case is direct, and the work is well-understood.

Roll out per domain, coordinate across departments, report compliance. The shape of the work is the same as elsewhere; the regulatory pressure is higher.