| AU Australia | ASD / ACSC | SPF | 🟡 Recommended | ISM | | ACSC - How to combat fake emails |
| ASD / ACSC | DKIM | 🟡 Recommended | ISM | | ACSC - How to combat fake emails |
| ASD / ACSC | DMARC | 🟡 Recommended | ISM | ISM recommends DMARC with p=reject for all Commonwealth entities. Not a binding mandate but strongly recommended through the ISM framework. | ACSC - How to combat fake emails |
| ASD / ACSC | STARTTLS | 🟡 Recommended | ISM | | ISM - Email security controls |
| ASD / ACSC | DNSSEC | 🟡 Recommended | ISM | The ISM recommends DNSSEC for government domains as part of DNS hardening. | ISM - Australian Government Information Security Manual |
| ASD / ACSC | CAA | 🟡 Recommended | ISM | CAA records recommended in ISM guidance to restrict certificate issuance. | ISM - Australian Government Information Security Manual |
| ASD / ACSC | IPv6 | 🟡 Recommended | ISM | The ISM and ASD guidance encourage Commonwealth entities to support IPv6 for internet-facing infrastructure including email services, as… | ISM - Australian Government Information Security Manual |
| CA Canada | CCCS / Treasury Board | SPF | 🟡 Recommended | Government of Canada Email Security | | CCCS - Email security |
| CCCS / Treasury Board | DKIM | 🟡 Recommended | Government of Canada Email Security | | CCCS - Email security |
| CCCS / Treasury Board | DMARC | 🟡 Recommended | Government of Canada Email Security | CCCS recommends DMARC and progression toward p=reject. Not a binding directive as of 2026, but increasingly referenced in GC security… | CCCS - Email security |
| CCCS | STARTTLS | 🟡 Recommended | | | CCCS - Email security |
| CCCS | DNSSEC | 🟡 Recommended | | CCCS recommends DNSSEC for government domains as part of DNS infrastructure security. | CCCS - Email security |
| CCCS / Treasury Board | IPv6 | 🟡 Recommended | | Treasury Board of Canada Secretariat and Shared Services Canada have published IPv6 adoption guidance for Government of Canada… | Government of Canada IPv6 Adoption Strategy |
| DE Germany | BSI | SPF | 🟡 Recommended | BSI TR-03108 | | BSI TR-03108 - Sicherer E-Mail-Transport |
| BSI | DKIM | 🟡 Recommended | BSI TR-03108 | | BSI TR-03108 - Sicherer E-Mail-Transport |
| BSI | DMARC | 🟡 Recommended | BSI TR-03108 | | BSI TR-03108 - Sicherer E-Mail-Transport |
| BSI | STARTTLS | 🟡 Recommended | BSI TR-03108 | BSI TR-03108 requires TLS-encrypted transport. STARTTLS with strong cipher suites is mandated for email service providers qualifying under… | BSI TR-03108 - Sicherer E-Mail-Transport |
| BSI | DNSSEC | 🟡 Recommended | BSI TR-03108 | BSI recommends DNSSEC for government and critical infrastructure domains. Required as a prerequisite for DANE deployment. | BSI TR-03108 - Sicherer E-Mail-Transport |
| BSI | CAA | 🟡 Recommended | | BSI recommends CAA records as part of domain security hardening. | BSI TR-03108 - Sicherer E-Mail-Transport |
| BSI | IPv6 | 🟡 Recommended | | BSI recommends IPv6 support for government and critical infrastructure as part of network modernisation. BSI technical guidelines on secure… | BSI - Sichere Nutzung von IPv6 |
| FR France | ANSSI | SPF | 🟡 Recommended | Recommandations pour la sécurisation des courriels | | ANSSI - Recommandations pour la sécurisation des courriels |
| ANSSI | DKIM | 🟡 Recommended | Recommandations pour la sécurisation des courriels | | ANSSI - Recommandations pour la sécurisation des courriels |
| ANSSI | DMARC | 🟡 Recommended | Recommandations pour la sécurisation des courriels | | ANSSI - Recommandations pour la sécurisation des courriels |
| ANSSI | STARTTLS | 🟡 Recommended | | | ANSSI - Recommandations pour la sécurisation des courriels |
| ANSSI | DNSSEC | 🟡 Recommended | | ANSSI recommends DNSSEC as part of general DNS security guidance. | ANSSI - Recommandations pour la sécurisation des noms de domaine |
| GB United Kingdom | NCSC | SPF | ✅ Mandatory | Email security and anti-spoofing guidance | | NCSC - Anti-spoofing: SPF |
| NCSC | DKIM | ✅ Mandatory | Email security and anti-spoofing guidance | | NCSC - Anti-spoofing: DKIM |
| NCSC | DMARC | ✅ Mandatory (reject) | Email security and anti-spoofing guidance | NCSC requires DMARC for all .gov.uk and public sector domains. p=reject is the target; p=none is only acceptable as a monitoring phase. | NCSC - Anti-spoofing: DMARC |
| NCSC | STARTTLS | ✅ Mandatory | Email security and anti-spoofing guidance | | NCSC - Securing email in transit |
| NCSC | MTA-STS | 🟡 Recommended | | Recommended by NCSC Mail Check as a best practice for .gov.uk domains. | NCSC Mail Check - MTA-STS |
| NCSC | TLS-RPT | 🟡 Recommended | | Recommended alongside MTA-STS in NCSC Mail Check guidance. | NCSC Mail Check Service |
| NCSC | DNSSEC | 🟡 Recommended | | NCSC guidance recommends DNSSEC for government domains. Required for DANE deployment. Adoption across UK government domains varies; NCSC… | NCSC - Protecting domains that don't send email |
| NCSC | CAA | 🟡 Recommended | | NCSC recommends CAA records as part of domain security guidance to restrict certificate issuance to authorized CAs. | NCSC Mail Check Service |
| NCSC | IPv6 | 🟡 Recommended | | UK government guidance (GDS technology code of practice and NCSC network security recommendations) advises IPv6 readiness for public sector… | GOV.UK Technology Code of Practice — Use open standards |
| NL Netherlands | Forum Standaardisatie / NCSA | SPF | ✅ Mandatory | Pas-toe-of-leg-uit lijst | | SPF - Forum Standaardisatie |
| Forum Standaardisatie / NCSA | DKIM | ✅ Mandatory | Pas-toe-of-leg-uit lijst | | DKIM - Forum Standaardisatie |
| Forum Standaardisatie / NCSA | DMARC | ✅ Mandatory (reject) | Pas-toe-of-leg-uit lijst | p=reject is the target policy. p=quarantine is accepted as a transition state but p=reject is required for full compliance. | DMARC - Forum Standaardisatie |
| Forum Standaardisatie / NCSA | DANE | ✅ Mandatory | Pas-toe-of-leg-uit lijst | DANE/TLSA required for both inbound (MX) and outbound SMTP. DNSSEC must be enabled on the domain for DANE to function. | DANE - Forum Standaardisatie |
| Forum Standaardisatie / NCSA | STARTTLS | ✅ Mandatory | Pas-toe-of-leg-uit lijst | | STARTTLS - Forum Standaardisatie |
| Forum Standaardisatie / NCSA | TLS-RPT | ✅ Mandatory | Pas-toe-of-leg-uit lijst | | SMTP MTA-STS and TLS-RPT - Forum Standaardisatie |
| NCSC | MTA-STS | 🟡 Recommended | | Recommended as complementary to DANE for domains that cannot immediately deploy DNSSEC. Not on the mandatory list as of 2024. | NCSC - Adviezen e-mailbeveiliging |
| Forum Standaardisatie / NCSA | DNSSEC | ✅ Mandatory | Pas-toe-of-leg-uit lijst | DNSSEC is required for all government domains and is a prerequisite for DANE, which is also mandatory. Both inbound and outbound mail… | DNSSEC - Forum Standaardisatie |
| Forum Standaardisatie / NCSA | CAA | ✅ Mandatory | Pas-toe-of-leg-uit lijst | CAA records are required for all government domains to restrict certificate issuance to authorized Certificate Authorities only. | CAA - Forum Standaardisatie |
| Forum Standaardisatie / NCSA | IPv6 | ✅ Mandatory | Pas-toe-of-leg-uit lijst | IPv6 is on the Forum Standaardisatie mandatory "comply or explain" list for all government organisations. Both inbound and outbound mail… | IPv6 - Forum Standaardisatie |
| NCSC | RPKI | 🟡 Recommended | | The NCSC and Forum Standaardisatie have published guidance on routing security including RPKI ROA. Not yet on the mandatory… | NCSC - Beveilig je netwerk met RPKI |
| NO Norway | NSM | SPF | 🟡 Recommended | Grunnprinsipper for IKT-sikkerhet | NSM recommends SPF as part of email authentication hardening under the "Grunnprinsipper for IKT-sikkerhet" framework for all Norwegian… | NSM — Grunnprinsipper for IKT-sikkerhet |
| NSM | DKIM | 🟡 Recommended | Grunnprinsipper for IKT-sikkerhet | NSM recommends DKIM to cryptographically sign outgoing email and prevent message tampering in transit. | NSM — Grunnprinsipper for IKT-sikkerhet |
| NSM | DMARC | 🟡 Recommended | Grunnprinsipper for IKT-sikkerhet | NSM recommends DMARC with a policy of at least p=quarantine, progressing to p=reject. Included in the ICT security basic principles… | NSM — Grunnprinsipper for IKT-sikkerhet |
| NSM | STARTTLS | 🟡 Recommended | Grunnprinsipper for IKT-sikkerhet | NSM recommends TLS-encrypted transport for email as part of secure communication practices in the ICT security basic principles. | NSM — Grunnprinsipper for IKT-sikkerhet |
| DigDir | DNSSEC | 🟡 Recommended | Referansekatalog for IT-standardar | DNSSEC is listed in the DigDir Referansekatalog as a recommended standard for Norwegian public sector domains. Norid (the .no registry)… | Referansekatalog for IT-standardar — DNSSEC |
| DigDir | IPv6 | ✅ Mandatory | Forskrift om IT-standarder i offentlig forvaltning — §12 | §12 of the Regulation on IT standards in public administration (forskrift 2013-04-05-959) requires all government organisations to make… | Forskrift om IT-standarder i offentlig forvaltning — §12 (IPv6) |
| NZ New Zealand | DIA / Digital.govt.nz | SPF | ✅ Mandatory | Secure Government Email Common Implementation Framework | | Secure Government Email Common Implementation Framework |
| DIA / Digital.govt.nz | DKIM | ✅ Mandatory | Secure Government Email Common Implementation Framework | | Secure Government Email Common Implementation Framework |
| DIA / Digital.govt.nz | DMARC | ✅ Mandatory | Secure Government Email Common Implementation Framework | | Secure Government Email Common Implementation Framework |
| DIA / Digital.govt.nz | STARTTLS | ✅ Mandatory | Secure Government Email Common Implementation Framework | STARTTLS is required as the transport-layer TLS mechanism underpinning MTA-STS enforcement. The framework mandates TLS-encrypted mail… | Secure Government Email Common Implementation Framework |
| DIA / Digital.govt.nz | DNSSEC | 🟡 Recommended | | The govt.nz domain is DNSSEC-signed. DNSSEC is recommended for all government domains as it is a prerequisite for DANE and provides… | Secure Government Email Common Implementation Framework |
| DIA / Digital.govt.nz | MTA-STS | ✅ Mandatory | Secure Government Email Common Implementation Framework | MTA-STS is required under the framework to enforce TLS for inbound mail delivery to government domains, preventing opportunistic downgrade… | Secure Government Email Common Implementation Framework |
| DIA / Digital.govt.nz | TLS-RPT | ✅ Mandatory | Secure Government Email Common Implementation Framework | TLS-RPT is required alongside MTA-STS to provide visibility into TLS negotiation failures and ensure government agencies can detect… | Secure Government Email Common Implementation Framework |
| US United States | CISA | SPF | ✅ Mandatory | BOD 18-01 | | BOD 18-01 - Technical Implementation |
| CISA | DKIM | 🟡 Recommended | BOD 18-01 | DKIM is strongly recommended in BOD 18-01 guidance but SPF + DMARC is the minimum mandatory baseline. CISA guidance has increasingly… | BOD 18-01 - Technical Implementation |
| CISA | DMARC | ✅ Mandatory (reject) | BOD 18-01 | p=reject was required within one year of the BOD issuance (by October 2018) for all .gov sending domains. Applies to all FCEB agencies. | BOD 18-01 - Enhance Email and Web Security |
| CISA | STARTTLS | ✅ Mandatory | BOD 18-01 | | BOD 18-01 - Enhance Email and Web Security |
| CISA | MTA-STS | 🟡 Recommended | | Recommended in CISA email security best practices as a complement to STARTTLS. Not a BOD requirement. | CISA Email Security Best Practices |
| CISA | TLS-RPT | 🟡 Recommended | | Recommended alongside MTA-STS. Provides visibility into TLS failures but not a mandated requirement. | CISA Email Security Best Practices |
| CISA | DNSSEC | ✅ Mandatory | BOD 18-01 | BOD 18-01 requires DNSSEC for all .gov second-level domains. This predates the email-specific requirements and covers all federal civilian… | BOD 18-01 - Enhance Email and Web Security |
| CISA | CAA | 🟡 Recommended | | CISA recommends CAA records as part of general domain security best practices. Not a BOD-level mandate but referenced in CISA guidance on… | CISA Email Security Best Practices |
| OMB | IPv6 | ✅ Mandatory | OMB M-21-07 | OMB Memorandum M-21-07 "Completing the Transition to Internet Protocol Version 6 (IPv6)" (November 2020) requires Federal Civilian… | OMB M-21-07 — Completing the Transition to IPv6 |
| ONCD | RPKI | 🟡 Recommended | Roadmap to Enhancing Internet Routing Security | The White House Office of the National Cyber Director (ONCD) published a "Roadmap to Enhancing Internet Routing Security" in March 2024. It… | Roadmap to Enhancing Internet Routing Security — ONCD (March 2024) |
| ONCD | DNSSEC | 🟡 Recommended | Roadmap to Enhancing Internet Routing Security | The ONCD roadmap calls out DNSSEC as critical infrastructure-level protection needed to secure the DNS lookups that underpin email routing,… | Roadmap to Enhancing Internet Routing Security — ONCD (March 2024) |