Australia DMARC & MTA-STS Adoption Report 2026

The scale of Australia’s cyber threat landscape is no longer a projection, but a present reality. In a 2025 report, the Australian Signals Directorate noted responding to more than 1,200 high-priority cyber incidents, an 11% year-on-year increase that signals not a spike, but a sustained trend. The financial toll compounds the picture. Large Australian businesses now report average cybercrime costs exceeding $200,000 per incident, a 219% surge in just one year. That’s a new report lodged roughly every six minutes.

The policy response has been swift, with the commencement of the Security of Critical Infrastructure (SOCI) Rules in April 2025. It drew a firm line that cybersecurity in Australia is no longer a voluntary posture but a legal obligation under the Cyber Security Act 2024, as part of the 2023–2030 Australian Cyber Security Strategy.

The data tells a different story on the ground. Most Australian domains carry a DMARC record, but only 46.7% actually enforce it. The rest sit in monitoring mode while email channels stay exposed. Meanwhile, the annual scam epidemic exceeded $2 billion in 2025 and continues to run largely through those same gaps.

This report breaks down Australia’s email and domain security posture sector by sector to understand where DMARC enforcement stands, where transit encryption falls short, and what the structural exposure actually looks like.

Report Request - Australia DMARC Adoption

"*" indicates required fields

This field is for validation purposes and should be left unchanged.
Name*

Click here to add your own text

Overall National Posture: The Enforcement Gap

Australia shows strong “entry-level” adoption, with nearly all domains having some form of SPF and DMARC record. However, the “Bottom Line” reveals that most organizations are in a passive state, monitoring threats rather than blocking them.

SPF

Australia SPF

DMARC

Australia-DMARC

MTA-STS

Australia MTA-STS

DNSSEC

Australia DNSSEC

National Adoption Metrics

Protocol ComponentRateRisk Implications
SPF Correctness92.3%Low risk of legitimate mail being marked as spam.
DMARC Enforcement (p=reject)46.7%CRITICAL: 53.3% of domains cannot stop spoofing.
MTA-STS Adoption5.8%High risk of “Man-in-the-Middle” interception.
DNSSEC Adoption6.8%Vulnerable to DNS hijacking and cache poisoning.

Analysis: While 9 out of 10 domains have DMARC, only half use it to actually block unauthorized emails. This creates a false sense of security where IT teams see the “check-box” for DMARC but remain vulnerable to sophisticated impersonation.

Start 15-day trial

Sector-Specific Vulnerabilities and Performance

While Australia boasts a high baseline for email authentication, a closer look at individual industries reveals a massive “Enforcement Gap.” Sectors guarding the nation’s most sensitive data, from patient records to government IDs, often rely on passive monitoring rather than active blocking, creating opportunities for sophisticated phishing and interception.

1. Healthcare: Safeguarding Patient Privacy

Australia’s healthcare sector holds the nation’s most sensitive personal data, yet email security enforcement lags dangerously behind. Ransomware incidents doubled in 2025, with cyber actors succeeding in 95% of incidents. While healthcare organizations achieve a strong SPF base (93.3%), zero DNSSEC adoption and near-zero MTA-STS deployment leave patient records exposed at every layer.

Healthcare Security Metrics

Metric Adoption Rate Status
SPF Correctness 93.3% High
DMARC Enforcement (p=reject) 46.7% Moderate
No DMARC Record 6.7% Vulnerable
MTA-STS Adoption 2.2% Negligible
DNSSEC Adoption 0% Non-existent
Healthcare SPF

The Threat

With 97.8% of healthcare domains lacking MTA-STS, patient data sent via email is susceptible to “Man-in-the-Middle” (MiTM) attacks. Attackers can intercept or alter health records in transit, leading to identity theft or incorrect medical billing.

The PowerDMARC Solution

  • Hosted DMARC:
    Allows hospitals to move to p=reject without risking the delivery of critical automated patient notifications.
  • MTA-STS & TLS-RPT:
    Automates the encryption of emails in transit, ensuring compliance with the Privacy Act and protecting PHI from interception.

2. Banking & Finance: Combating $1B in Annual Losses

Banking leads most sectors on DNSSEC adoption (14.1%), a sign that the industry somewhat understands DNS-layer risk. But it still struggles with passive DMARC policies that observe fraud rather than block it. With nearly half the sector not enforcing p=reject, criminal actors can send emails that perfectly impersonate major bank domains.

Banking & Finance Metrics

Metric Adoption Rate Status
SPF Correctness 95.3% High
DMARC Enforcement (p=reject) 51.6% Moderate
No DMARC Record 4.7% Vulnerable
MTA-STS Adoption 3.1% Low
DNSSEC Adoption 14.1% Leading (relative)
dmarc australia 2021

The Threat

Since nearly half of the sector does not enforce p=reject, scammers can send emails that perfectly mimic a bank’s domain. These “mule account” phishes trick customers into transferring funds to criminal-controlled accounts.

The PowerDMARC Solution

  • SPF Flattening:
    Financial institutions often use multiple third-party vendors (marketing, CRM). PowerDMARC prevents SPF “Too many DNS lookups” errors, ensuring emails are always authenticated.
  • AI-Threat Intelligence:
    Maps out the global sources sending mail on the bank’s behalf, identifying and blocking unauthorized IP addresses in real-time.

3. Government: The High-Enforcement Benchmark

Australia’s government sector sets the national benchmark with 70.5% DMARC enforcement at p=reject, driven by the ASD cyber maturity frameworks (with updates for enterprise IT and AI in planning) and Canberra’s push for compliance under the SOCI Rules 2025. But even the sector with the highest enforcement has a security gap. 81.8% of government domains still lack MTA-STS, leaving citizen communications exposed to unencrypted transit.

Government Metrics

Metric Adoption Rate Status
SPF Correctness 97.7% Excellent
DMARC Enforcement (p=reject) 70.5% Strong
No DMARC Record 1.5% Secure
MTA-STS Adoption 18.2% Moderate
DNSSEC Adoption 6.1% Low
dmarc australia 2021

The Threat

Despite high DMARC enforcement, the 81.8% gap in MTA-STS allows attackers to downgrade email encryption to clear text. This exposes sensitive communications between citizens and agencies like the ATO or Centrelink.

The PowerDMARC Solution

  • Hosted MTA-STS & DNSSEC:
    Simplifies the complex deployment of these protocols across various government departments, aligning with the     ASD Essential Eight maturity levels.
  • Compliance Reporting:
    Provides automated reports for auditors to prove that email channels are secured according to federal standards.
Book a demo

4. Telecommunications: High Exposure for Subscriber Data

Telcos are the gatekeepers of digital identity, yet they currently exhibit the lowest DMARC enforcement rates among Australia’s critical sectors. With only 24.1% enforcing p=reject and 12% of domains lacking any DMARC record at all, this sector is the most exposed to SIM-swapping campaigns and subscriber credential theft.

Telecommunications Metrics

Metric Adoption Rate Status
SPF Correctness 84.3% Low
DMARC Enforcement (p=reject) 24.1% Critical Risk
No DMARC Record 12.0% High Exposure
MTA-STS Adoption 1.2% Negligible
DNSSEC Adoption 10.8% Moderate
dmarc australia 2021

The Threat

1 in 8 telcos has no DMARC record, making it easy for hackers to send fake bill alerts. Once a user clicks a malicious link, their credentials are stolen, often leading to SIM swaps that bypass MFA for bank accounts.

The PowerDMARC Solution

  • Managed DMARC Services:
    Provides a phased roadmap to take telcos from     p=none to p=reject, blocking millions of spoofed emails at the source.
  • DMARC Forensic RUF Reports:
    Gives telcos visibility into the specific phishing campaigns targeting their subscribers.

5. Transport & Logistics: Stopping the Invoice Fraud Highway

With high volumes of international billing flowing through email, transport and logistics is a prime target for Business Email Compromise (BEC). Yet 17.1% of sector domains have no DMARC record at all, and only 22% enforce p=reject, leaving invoice fraud opportunities wide open across the supply chain.

Transport & Logistics Metrics

Metric Adoption Rate Status
SPF Correctness 90.2% High
DMARC Enforcement (p=reject) 22.0% Critical Risk
No DMARC Record 17.1% High Exposure
MTA-STS Adoption 1.2% Negligible
DNSSEC Adoption 4.9% Low
dmarc australia 2021

The Threat

A staggering 17.1% of domains lack DMARC. This allows attackers to spoof logistics giants (e.g., Qantas Freight or Toll), injecting fraudulent invoices into the supply chain that result in millions of dollars in wire fraud.

The PowerDMARC Solution

  • Automated SPF Management:
    Secures complex logistics networks that rely on third-party shippers, ensuring all legitimate mail is delivered while spoofers are blocked.
  • BIMI (Brand Indicators for Message Identification):
    Adds the company logo to authenticated emails in the recipient’s inbox, boosting trust for bill-paying customers.

6. Media: Defending Trust in the Information Age

Media organisations face a dual threat: impersonation that spreads disinformation, and source exposure via unencrypted communications. While media leads several sectors on DMARC enforcement (63.2% at p=reject), it is the only sector with zero MTA-STS adoption, a liability that leaves journalist-source channels completely unprotected in transit.

Media Metrics

Metric Adoption Rate Status
SPF Correctness 91.2% High
DMARC Enforcement (p=reject) 63.2% Strong
No DMARC Record 5.9% Moderate
MTA-STS Adoption 0% Non-existent
DNSSEC Adoption 4.4% Low
BIMI Logo

The Threat

Zero adoption of MTA-STS means journalist-source communications are vulnerable to state-sponsored interception. Furthermore, domains without enforcement can be used to send fake press releases that cause stock market volatility or social panic.

The PowerDMARC Solution

  • Hosted MTA-STS:
    Secures the journalist’s “digital footprint” by ensuring all communications are encrypted, protecting sources from prying eyes.
  • Enterprise-Grade Dashboard:
    Allows media conglomerates to manage hundreds of subdomains and international news desks from a single pane of glass.
Start 15-day trial

7. Education: Protecting IP and Research

Australian universities are global leaders in research, making them prime targets for intellectual property theft via credential harvesting. With only 38.3% enforcing DMARC at p=reject and 8.6% lacking any record, attackers have a wide window to impersonate institutional IT systems and compromise research databases.

Education Metrics

Metric Adoption Rate Status
SPF Correctness 91.4% High
DMARC Enforcement (p=reject) 38.3% Moderate
No DMARC Record 8.6% Moderate
MTA-STS Adoption 3.7% Low
DNSSEC Adoption 6.2% Low
dmarc australia 2021

The Threat

Low enforcement (38.3%) allows attackers to spoof “IT Password Reset” emails. When researchers or students log in to these fake portals, their credentials are used to access internal university databases and steal trade secrets or research data.

The PowerDMARC Solution

  • Domain Discovery:
    Automatically finds all “shadow IT” domains registered by students or faculty that might be lacking security controls.
  • Managed Services:
    Offloads the technical burden of DMARC maintenance from overstretched university IT departments.

Under the Hood: Four Structural Weaknesses

Beyond sector-specific risks, the Australian email ecosystem is hindered by four systemic vulnerabilities that facilitate the $2 billion yearly scam toll.

1. The “Compliance Trap” of p=none

While 92.3% of Australian domains have DMARC, only 46.7% enforce a strict policy. This leaves a massive “monitoring-only” gap where organizations can see threats but cannot stop them.

“A policy of p=none is like installing a security camera but leaving the front door unlocked. You can watch the burglars enter, but you are powerless to stop them. Australia’s adoption rate is high, but the job is only half-done until the policy is shifted to reject.”

Maitham Al Lawati, CEO, PowerDMARC

dmarc australia 2021

“Large Australian firms often break their own security as they grow. Adding a new marketing tool can push you over the 10-lookup limit, causing critical invoices to land in spam. SPF Flattening is no longer a luxury; it’s a requirement for operational stability.”

Yunes Tarada, Service Delivery Manager, PowerDMARC

dmarc australia 2021

2. SPF Complexity and the 10-Lookup Limit

92.3% of Australian domains show correct SPF, but large enterprises frequently hit the DNS lookup limit due to sprawling third-party tech stacks. This leads to random authentication failures that break deliverability.

3. MTA-STS: The Encryption Blind Spot

With just 5.8% national adoption, Australia has a near-total blind spot regarding transport security. This allows “Downgrade Attacks,” where criminals force servers to drop encryption and transmit sensitive emails in plain text.

“Opportunistic encryption (STARTTLS) is not enough. Without MTA-STS, it is trivial for an attacker to strip away security and read corporate communications in transit. This is a primary risk for any entity subject to SOCI regulations.”

Ayan Bhuiya, Operations & Delivery Shift Lead, PowerDMARC

dmarc australia 2021

“DNS hijacking can shatter decades of brand trust in minutes. DNSSEC is the guardian of digital identity, ensuring your customers connect with the real entity, not a criminal clone. It’s a fundamental layer of brand reputation management.”

Ahona Rudra, Marketing Manager, PowerDMARC

dmarc australia 2021

4. DNSSEC: The Weak Foundation

DNSSEC adoption sits at a meager 6.8%. Without this, the internet’s directory system is unprotected, allowing attackers to hijack entire domain flows and redirect them to rogue servers.

Contact us

Global Benchmarking: Australia in Context

Australian government mandates have prepared the country for high foundational compliance, its position being better when compared to global peers, but enforcement tells a different tale. Australia ranks as a “Passive Leader,” standing at the doorstep of active cybersecurity, but still hesitating and only looking in.

The Global Leaderboard: 2025 Data

CountrySPF CorrectDMARC AdoptionDMARC Enforcement (p=reject)MTA-STS (Encryption)
Australia 🇦🇺92.3%92.3%46.7%5.8%
Sweden 🇸🇪85.0%77.9%29.9%2.9%
Japan 🇯🇵95.0%74.6%9.2%0.5%
Norway 🇳🇴85.2%83.1%29.0%2.8%
Peru 🇵🇪86.1%66.0%17.9%0.6%
Nigeria 🇳🇬70.3%45.9%14.2%0.0%

Critical Insights from Australia

dmarc australia 2021

1. The Australian Edge

Australia significantly outpaces Japan and most European nations on both DMARC adoption (92.3%) and enforcement (46.7%), largely driven by the ASD Essential Eight mandate. No other surveyed country exceeds Australia on enforcement rate.

dmarc australia 2021

2. The Paradox of Visibility

Despite 92.3% DMARC adoption, 53.3% of Australian domains do not enforce p=reject, meaning they can see spoofing attempts but cannot block them. High adoption without enforcement is not security; it is observation.

dmarc australia 2021

3. The Encryption Crisis

Even though Australia leads countries on MTA-STS, it is still an open door for interception. A 94.2% gap in MTA-STS means the vast majority of Australian email in transit is not protected against downgrade attacks.

PowerDMARC Perspective

“Australia has built a technical foundation that outpaces much of the world, yet the ‘Enforcement Gap’ remains a multi-billion dollar vulnerability. The urgent imperative for 2026 is to move from passive visibility to active defense. By converting high DMARC adoption into strict ‘p=reject’ enforcement and closing the MTA-STS encryption gap, Australian organizations can transform their email domains from vulnerable targets into hardened, trusted communication channels that align with the national cyber security strategy.”

Conclusion: From Metrics to Action

The 2026 data confirms that Australia has built the foundation but has not yet finished the walls or the roof. It needs to take three concrete steps to become an ‘Active Defender’:

dmarc australia 2021

Automate the journey to enforcement: Hosted DMARC lets you move from p=none to p=reject without breaking business email workflows; no repeated DNS changes required.

dmarc australia 2021

Seal the interception gap: Implement Hosted MTA-STS to enforce encrypted email in transit and eliminate downgrade attack risk for citizen and partner communications.

dmarc australia 2021

Fix SPF at scale: Hosted SPF prevents DNS lookup limit failures as organisations add new tools and sending services, so authentication never silently breaks.

Book a demo Contact us

Turn Visibility into Defense Today

Australia’s high adoption rates prove organisations recognise the threat. The gap is not awareness; it is action. Don’t let your domain remain a passive observer while spoofed emails reach your customers and staff. Move from monitoring to enforcement before the next major breach decides for you.

Contact PowerDMARC to start your enforcement journey today.

Start 15-day trial Book a demo