Government
Email security of 39 government agencies & portals
US federal agencies have been under a DMARC-enforcement mandate (BOD 18-01) since 2018 — here is how government domains worldwide actually score on it.
Across these 39 domains, 94.9% publish SPF, 89.7% publish DMARC and 84.6% enforce it (reject or quarantine), 5.1% sit on p=none, and 46.2% sign with DKIM. Scanned June 24, 2026.
Every domain in this cohort
| Domain | SPF | DMARC | DKIM | MTA-STS | TLS-RPT |
|---|---|---|---|---|---|
| australia.gov.au | Hardfail | Reject | No | No | No |
| cdc.gov | Hardfail | Reject | Yes | No | No |
| cia.gov | Hardfail | Quarantine | No | No | No |
| commerce.gov | Hardfail | Reject | Yes | No | No |
| digitalindia.gov.in | Hardfail | Quarantine | No | No | No |
| dot.gov | Softfail | Reject | Yes | No | No |
| ec.europa.eu | Hardfail | Reject | Yes | No | No |
| energy.gov | Hardfail | Reject | Yes | No | No |
| epa.gov | Softfail | Reject | Yes | No | No |
| fbi.gov | Hardfail | Reject | No | No | No |
| fcc.gov | Hardfail | Reject | Yes | No | No |
| fda.gov | Hardfail | Reject | No | No | No |
| ftc.gov | Hardfail | Reject | Yes | No | No |
| gov.sg | Hardfail | Reject | No | No | No |
| gov.uk | Hardfail | Reject | No | No | No |
| hmrc.gov.uk | Softfail | Reject | Yes | Yes | Yes |
| hud.gov | Softfail | Reject | Yes | No | No |
| india.gov.in | Softfail | Quarantine | No | No | No |
| irs.gov | Hardfail | Reject | No | No | No |
| medlineplus.gov | Softfail | Reject | No | No | No |
| mygov.in | Softfail | Quarantine | No | No | No |
| nasa.gov | Hardfail | Reject | Yes | No | No |
| nhs.uk | Hardfail | Reject | No | No | No |
| nih.gov | Softfail | Reject | Yes | No | No |
| nsa.gov | Softfail | Reject | No | No | No |
| sec.gov | Hardfail | Reject | Yes | No | No |
| ssa.gov | Hardfail | Reject | No | No | No |
| state.gov | Hardfail | Reject | Yes | No | No |
| treasury.gov | Present | Reject | No | No | No |
| usa.gov | Softfail | Reject | No | No | No |
| va.gov | Hardfail | Reject | No | No | No |
| whitehouse.gov | Softfail | Reject | Yes | No | No |
| who.int | Hardfail | Reject | Yes | No | No |
| canada.ca | Hardfail | None (monitor) | Yes | No | No |
| dod.gov | None | Missing | No | No | No |
| education.gov | None | Missing | No | No | No |
| europa.eu | Hardfail | Missing | No | No | No |
| gov.za | Softfail | Missing | No | No | No |
| parliament.uk | Hardfail | None (monitor) | Yes | No | No |
Where does your domain stand?
Run the same 15 checks on your own domain — free, no signup. If you need the result as evidence, the signed Domain Audit Report turns it into a dated artifact your auditor can verify.