NZ leads Five Eyes in government email security, but gaps remain

New Zealand has overtaken its Five Eyes intelligence partners on a key measure of protection against intercepted government emails, with new research finding 55% of core government domains enforce secure delivery settings compared with less than 1% in the United States.

The SMX Email Security Report, released in October 2026, found New Zealand ahead of the United Kingdom, Australia, Canada and the US in adopting a standard that helps prevent messages being diverted or exposed while travelling between mail systems. The findings on government email security were also discussed by SMX Email co-founder Thom Hooker on NZ Herald’s Herald NOW Business programme.

The study comes as New Zealand government agencies move from the ageing SEEMail service to the Secure Government Email (SGE) framework. Auckland-based cybersecurity company SMX Email says the transition has improved protection, although unprotected domains remain a potential point of attack.

New Zealand tops Five Eyes on encrypted email delivery

SMX Email examined 1,940 domains within official government namespaces across the five countries, using publicly available DNS and HTTPS information collected on 24 August 2026. The government email security assessment looked at whether the domains had deployed and enforced relevant controls. Researchers did not access government systems or private data.

Of the 120 core New Zealand government domains included, 66 were enforcing Mail Transfer Agent Strict Transport Security (MTA-STS), equivalent to 55%. The UK followed on 46.9%, then Australia on 15.3% and the US on 0.9%. None of the Canadian government domains assessed was enforcing the measure.

MTA-STS is designed to help receiving organisations require encrypted connections to legitimate mail servers. Without effective transport protection, an attacker who interferes with the connection may be able to redirect or intercept a message before it reaches its intended recipient.

Hooker says the result is a change from New Zealand’s previous position relative to some of its international partners.

“New Zealand has spent years playing catch-up in some areas of email security, particularly against Australia, but in this instance we’re actually leading the way.”

Secure Government Email rollout exposes remaining weaknesses

The Government’s shift to SGE replaces a proprietary system with a standards-based approach that agencies can apply to their email services. The official Secure Government Email implementation framework covers controls for authenticating senders and protecting mail in transit, including DMARC and MTA-STS.

Government guidance set October 2026 as the implementation deadline for the new framework, while the wider retirement of SEEMail was planned for 2026. SMX Email said in its October announcement that the broader decommissioning programme was expected to finish by November.

But the company’s analysis indicates that 54 of the 120 core New Zealand domains measured were not yet enforcing MTA-STS. That leaves substantial work despite New Zealand’s comparative lead in government email security.

Hooker describes the remaining exposure as a shrinking pool of weaker domains that may become easier for attackers to identify as other agencies improve their systems.

“As more of the Government’s email environment is secured, the remaining gaps become easier for attackers to identify, which means you don’t want to leave part of the estate behind.”

The risk extends beyond messages exchanged between government departments. Businesses and members of the public may also send information to government addresses, including material relating to individuals, commercial activity and public services. Stronger delivery settings reduce one avenue for interference with those communications, but do not eliminate every form of email attack.

Australia and US ahead on protection against forged senders

New Zealand’s lead does not extend to every government email security standard. SMX Email found Australia, the UK and the US all had higher levels of enforced Domain-based Message Authentication, Reporting and Conformance (DMARC), which helps stop criminals impersonating legitimate government addresses.

About 66.7% of New Zealand’s core government domains enforced DMARC, against 90.3% in Australia, 84.5% in the UK and 83.3% in the US. Canada recorded 20.5%.

The two measures address different threats. DMARC provides a way to check whether messages claiming to come from a domain are authorised. MTA-STS addresses the security of connections used to deliver incoming mail. A domain can perform well on one measure while remaining exposed on the other.

Hooker says the US results illustrate the difference between the two kinds of protection.

“The US has one of the strongest records in the Five Eyes for stopping forged government email but almost no adoption of enforced transport protection, while New Zealand is combining relatively strong performance across both measures.”

Higher standards may reach businesses dealing with government

SMX Email expects changes in government email security under SGE to influence organisations beyond central government, particularly businesses and public sector bodies that regularly exchange information with government agencies. Hooker says these organisations may also need to strengthen their own email configurations as secure communication requirements become more widely adopted.

The company’s findings suggest New Zealand has made faster progress on secure transport than its Five Eyes partners, but its DMARC results show that preventing impersonation remains another priority. The August 2026 snapshot measures the settings visible on government domains at that point, rather than proving that messages were intercepted or that all security weaknesses have been resolved.

“No Five Eyes country has finished the job across every measure, but New Zealand is now closer than most to having both sides properly covered,” Hooker says.

Technology communications and cybersecurity media relations

Impact PR is an Auckland-based New Zealand public relations agency working across technology and business communications. Cybersecurity research can be difficult for non-technical audiences to interpret, particularly when different controls protect against different risks. The agency provides technology public relations services, including media relations and support for explaining technical developments to business audiences. Impact PR distributed the SMX Email findings to media on behalf of the company. Accurate reporting on government email security can help organisations communicate risks, industry research and changes in security standards without overstating what the evidence establishes.