DMARC Requirements in Japan: MIC, JSDA and the Anti-Phishing Council
by
Last Updated:
9 min read
Japan has had a rough stretch with phishing. In 2025, criminals used fake securities-firm emails to hijack customer accounts and run unauthorized trades, and regulators moved fast. This post explains the DMARC requirements in Japan from three bodies: the Ministry of Internal Affairs and Communications (MIC), the Japan Securities Dealers Association (JSDA), and the Anti-Phishing Council of Japan. You’ll see who each one covers, which policy it expects, and what to do next. DMARC (Domain-based Message Authentication, Reporting and Conformance) is an email authentication protocol that tells receiving servers what to do with mail that fails SPF and DKIM checks on your domain.
Why Is Japan Pushing DMARC Enforcement?
In April 2025, the Ministerial Meeting on Crime Countermeasures adopted “Comprehensive Measures to Protect the Public from Fraud 2.0.” One of its listed actions against scam emails and SMS is to further adopt sender domain authentication, such as DMARC. That is the policy backdrop for everything below.
The trigger was securities accounts. MIC’s letter says attackers used login IDs and passwords stolen through phishing emails impersonating real securities firms, then traded in customers’ accounts without permission. The Anti-Phishing Council of Japan put 2025 losses from these unauthorized trades at about 739.3 billion yen in its Phishing Report 2026. The same report counted 2,454,297 phishing reports for 2025, a record and roughly 1.43 times the 2024 total.
MIC gives a second reason. Generative AI can now produce natural Japanese in bulk, so clumsy wording no longer gives a phishing email away. That puts more weight on checks the reader never has to make, like sender authentication.
For the basics, see why DMARC is important, and for adoption numbers, see our Japan DMARC and MTA-STS adoption report.
MIC (Ministry of Internal Affairs and Communications) DMARC Request
Who Does the MIC Request Apply To?
On September 1, 2025, MIC sent a request letter (document 総基用第76号) titled “Strengthening Phishing Email Countermeasures.” It went to four associations: the Telecommunications Carriers Association, the Telecom Services Association, the Japan Internet Providers Association, and the Japan Cable Television Federation. MIC asked each one to pass the request to its member carriers and ISPs. Ordinary businesses are not addressed directly.
The letter states its own legal status. It counts as administrative guidance under Article 2, item 6 of the Administrative Procedure Act, and it is not a formal administrative disposition.
What Does the MIC Ask For?
MIC outlines three requests under “Strengthening Phishing Email Countermeasures.” :
- Better mail filtering. Improve filter accuracy, including AI for spam detection, and set filtering strength so it can handle more polished phishing.
- DMARC on both sides. Deploy DMARC and set a policy of quarantine or reject. On the receiving side, process mail according to the sender’s DMARC policy and send DMARC reports. MIC also asks providers to actively consider domain reputation, BIMI (Brand Indicators for Message Identification) and measures against relay abuse.
- User awareness. Promote the anti-phishing services the provider already offers to a wider range of users.
There is a reporting duty too. MIC asked the associations to follow up on member progress from September 2025 to the end of August 2026 and to report every three months to the ministry within one month after it ends. That follow-up window has now run out, so watch MIC’s site for what comes next.
JSDA (Japan Securities Dealers Association) DMARC Guideline
The Japan Securities Dealers Association (JSDA) DMARC Guideline is a set of security directives established by JSDA, the self-regulatory body for financial instruments firms in Japan, that aims to protect retail investors and financial markets from email-based phishing, spoofing, and unauthorized account access.
By incorporating DMARC into its regulatory compliance framework, JSDA mandates that securities firms implement strict domain authentication protocol standards. This ensures that fraudulent emails claiming to be from official brokerage firms are blocked before reaching customers. The aim is to prevent malicious actors from stealing login credentials and execution permissions.
What Changed in the October 2025 Guideline Revision?
JSDA revised its “Guideline for Preventing Unauthorized Access in Internet Trading” on October 15, 2025, and the revision took effect the same day. The reason given is that credentials stolen by phishing and malware were being used for unfair trading, not just illicit withdrawals.
The DMARC item sits in the phishing prevention section, under the “Standard” tier. JSDA defines Standard as items members need to address, while “Best Practice” covers desirable items. The wording asks firms to identify the domains they use to email customers, deploy DMARC in a planned way, review DMARC reports, and then set the policy to reject. The text gives an effective date but no deadline for reaching reject.
Other Standard items in the same section matter for email teams:
- Manage domains as part of the brand, including the domain lifecycle and defenses against drop-catching and subdomain takeover
- Take down phishing sites that impersonate the firm
- Use the shared SMS short code and publish it
- Avoid putting login links or password-entry URLs in emails and SMS, unless there is no alternative
BIMI and S/MIME signatures for notification emails are listed as Best Practice. The same revision also makes phishing-resistant multi-factor authentication (MFA), such as passkeys or PKI-based login, a Standard item that must be on by default for login, withdrawals and changes to the withdrawal bank account.
Where Do Securities Firms Stand Now?
TwoFive’s survey, published on May 21, 2026, covered 200 JSDA member firms and 421 domains. It found 48.7% of those domains protected by an enforcing policy (quarantine or reject), up from 36.4% in November 2025. Nikkei 225 companies stood at 18.5% on the same measure.
The share of firms with DMARC on at least one domain went from about 71.6% in May 2025 to about 77.6% in November 2025 and about 81.0% now. Domains publishing a BIMI certificate (VMC or CMC) rose from 5% to 21% in six months. TwoFive links the jump to the account takeover wave and the guideline revision. A bit over half of securities-firm domains are still below enforcement.
Anti-Phishing Council of Japan (フィッシング対策協議会) Guideline
The Council published its Anti-Phishing Guideline 2026 edition on June 1, 2026. Sender domain authentication, with DMARC as an example, is one of five priority items. The guideline recommends p=reject. It also recommends showing the brand logo through a VMC (Verified Mark Certificate) and using webmail services that display brand icons, so users can recognize the sender without reading domain names. DMARC first appeared in this guideline in 2022.
A related point from the 2026 edition: use the same domain name for your website and for the sender address in emails to users. The guideline is a recommendation. Nothing in it requires BIMI.
The Council’s Phishing Report 2026 adds a warning. In February 2025, spoofed-sender emails jumped to about 69.0% of reports, and those attacks picked domains with p=none or no DMARC at all. After October, the share of such domains fell to about 27.0%. The report suggests the September MIC request may have pushed attackers away from spoofing, and by December attacks that sent from their own domains and passed DMARC made up about 75.3%.
The lesson is simple. DMARC protects your domain, not lookalike domains an attacker registers. It needs to sit next to brand and lookalike domain monitoring.
MIC vs JSDA vs Anti-Phishing Council: Side-by-Side
| Body | Document and date | Who it covers | Required policy | Other measures | Legal status | Reporting |
|---|---|---|---|---|---|---|
| MIC | Request letter on strengthening phishing email countermeasures, September 1, 2025 | Four industry associations and, through them, member carriers, ISPs and cable operators | Quarantine or reject | Receiving-side DMARC handling and reports, domain reputation, BIMI, anti-relay measures, AI filtering, user awareness | Administrative guidance, not a formal disposition | Status to MIC every three months, September 2025 to end of August 2026 |
| JSDA | Guideline for Preventing Unauthorized Access in Internet Trading, revised October 15, 2025 | Member securities firms offering internet trading | Reject, after planned rollout and report review (no deadline stated) | Phishing-resistant MFA, domain management, site takedown, shared SMS short code, BIMI and S/MIME as Best Practice | Self-regulatory guideline, DMARC item in the Standard tier | None specified for DMARC |
| Anti-Phishing Council | Anti-Phishing Guideline 2026 edition, June 1, 2026 | Businesses that email customers and run sites that can be impersonated | Recommends p=reject | VMC and BIMI logo display, webmail brand icons, same domain for site and sender | Recommendation | None |
Other Drivers: Government Standards and Global Mailbox Rules
Three other sources push in the same direction. In February 2023, MIC, the National Police Agency and the Ministry of Economy, Trade and Industry (METI) jointly asked credit card companies to deploy DMARC on every domain they publish to users, including domains that don’t send mail, and to run a policy that rejects spoofed mail. Our PCI DSS 4.0 DMARC guide covers the finance side. The National Center of Incident Readiness and Strategy for Cybersecurity (NISC) guideline for government agencies’ security rules also names DMARC for sending and receiving, and its FY2023 draft told agencies not to stay on p=none for long.
Mailbox providers set a lower bar. Gmail’s bulk sender rules apply to senders above 5,000 messages a day, and Outlook.com enforcement started on May 5, 2025, for the same volume. Both need SPF, DKIM, and DMARC, but p=none is enough. That is why p=none passes the mailbox rules and still falls short of what Japan’s regulators expect.
For the global picture, see our DMARC requirements guide, and for a local example, Yahoo! JAPAN DMARC adoption.
How to Meet DMARC Requirements in Japan Step by Step
The path to p=reject is the same whichever body you answer to. Our DMARC guide has the full rollout details.
- Inventory every customer-facing domain and subdomain. Include parked domains and ones that never send mail. This is also what JSDA means by identifying the domains you email customers from.
- Publish p=none with rua. A starter record looks like v=DMARC1; p=none; rua=mailto:[email protected]. Let reports run until you can see every legitimate sender.
- Align SPF and DKIM for every ESP and SaaS tool. Marketing platforms, ticketing tools, and billing systems are the usual surprises. Watch the SPF limit of 10 DNS lookups, which breaks many records at this stage.
- Move to quarantine. RFC 9989, published in May 2026, replaced RFC 7489. It drops the pct tag and adds t for testing mode, np for non-existent subdomains, and psd for public suffix domains. Receivers adopt it at different speeds, so check the reports after each change.
- Move to reject. JSDA asks for this after report review, and the Council recommends it. Run a DMARC compliance check before and after the switch.
- Protect parked and non-sending domains. Publish p=reject and an SPF record of v=spf1 -all on them, since attackers like unused domains.
- Add BIMI with a VMC or CMC. BIMI needs an enforcing policy first. JSDA lists it as Best Practice, and the Council recommends logo display.
- Add MTA-STS. None of the three bodies asks for it, but it protects mail in transit and sits well beside DMARC.
PowerDMARC covers these steps from one platform. It hosts your DMARC, SPF, DKIM, MTA-STS, and BIMI records, so most DNS changes happen in the dashboard, and it processes aggregate reports for the report review JSDA expects. DNS Timeline shows record changes over time. DNS Takeover Alerts, available on Enterprise plans, check for dangling NS, MX, CNAME, and A/AAAA records and SPF subdomain takeover, which lines up with JSDA’s subdomain takeover item. The Email Deliverability Tester checks inbox placement across six seed providers (Gmail, Outlook, Yahoo Mail, iCloud, AWS Mail and Zoho Mail). The DMARC AI Agent, in beta for Basic and Enterprise users, answers authentication questions inside the dashboard, and the MCP server connects your account to AI hosts like Claude Desktop, Cursor, and Claude Code. If you’re comparing vendors, see our list of the top DMARC solutions in Japan and our breakdown of DMARC costs and prices in 2026.
Conclusion: What DMARC Requirements in Japan Mean for You
The DMARC requirements in Japan share one direction even though their legal weight differs. MIC wants quarantine or reject across carriers and ISPs, JSDA wants reject from securities firms, and the Council recommends reject for everyone with a brand to protect. If you’re still at p=none, start with the inventory and the reports.
Run a free check with our Japanese DMARC record checker or start a 15-day free trial of PowerDMARC. For the wider market view, read our page on DMARC in Japan.
DMARC Requirements in Japan FAQ
Is DMARC legally mandatory in Japan?
None of the three documents in this post is a law, and none of them sets fines. MIC’s letter is administrative guidance, JSDA’s text is a self-regulatory guideline, and the Council’s text is a recommendation.
Does the MIC request apply to ordinary businesses?
Not directly. The letter goes to four associations for their member carriers, ISPs, and cable operators. Its receiving-side part still matters to you, because those providers are asked to act on sender DMARC policies, and a missing or p=none record gives them nothing to act on.
What DMARC policy does JSDA require?
Reject. The guideline asks firms to identify their customer email domains, deploy DMARC in a planned way, review DMARC reports, and then set the policy to reject.
Is there a deadline for securities firms to reach p=reject?
The guideline took effect on October 15, 2025, and states no separate deadline for reject. Check JSDA’s site for any later notice.
Does the Anti-Phishing Council require BIMI?
No. The 2026 guideline recommends logo display through a VMC and webmail brand icons. JSDA lists BIMI as Best Practice, and MIC asks providers to consider it.
What happens if we stay at p=none?
Receivers deliver spoofed mail as normal, because p=none only monitors. You would fall short of all three expectations, and the Council’s report found that attackers favored domains at p=none or without DMARC.
