New Zealand leads Five Eyes on government email security

New Zealand's government has emerged as the strongest performer among the Five Eyes countries on an email security measure designed to protect messages in transit. New research put New Zealand ahead of the UK, Australia, Canada and the US on enforced use of MTA-STS across core government domains.

The study by cybersecurity company SMX Email examined 1,940 domains across official government namespaces in the five countries. It found that 66 of New Zealand's 120 core government domains, or 55%, were actively enforcing MTA-STS, compared with 46.9% in the UK, 15.3% in Australia, 0.9% in the US and none of the Canadian government domains measured.

MTA-STS is designed to ensure emails sent to government agencies travel over encrypted connections to legitimate mail servers. This reduces the risk of a message being intercepted or altered as it moves between computer systems.

The findings come as New Zealand government agencies are moved from the older SEEMail system to the Secure Government Email framework. The broader decommissioning programme is due to be completed by November.

That transition appears to be a key factor in the country's improved position. SMX Email said the coordinated rollout of updated email standards has lifted protection levels across central government while also highlighting the agencies and domains yet to adopt the newer settings.

"New Zealand has spent years playing catch-up in some areas of email security, particularly against Australia, but in this instance we're actually leading the way," said Thom Hooker, co-founder of SMX Email.

He said the remaining unsecured domains could become easier for attackers to identify as more of the wider government network is brought under the new framework.

"As more of the government's email environment is secured, the remaining gaps become easier for attackers to identify, which means you don't want to leave part of the estate behind," Hooker said.

Different measures

The report also found New Zealand does not lead the Five Eyes on every part of government email security. Australia, the UK and the US were ahead on DMARC, a separate standard used to prevent fraudulent messages from appearing to come from a legitimate government domain.

About 66.7% of New Zealand's core government domains were enforcing DMARC, compared with 90.3% in Australia, 84.5% in the UK and 83.3% in the US. Canada stood at 20.5%.

The distinction matters because the two standards address different parts of the email chain. DMARC focuses on validating the sender, while MTA-STS is concerned with securing delivery between mail systems.

"One helps establish whether the sender really is who they claim to be, while the other helps make sure the email gets to its destination securely, so you need both.

"The US has one of the strongest records in the Five Eyes for stopping forged government email but almost no adoption of enforced transport protection, while New Zealand is combining relatively strong performance across both measures," Hooker said.

Broader impact

The shift in standards could have wider implications beyond central government. Public sector bodies and private companies that exchange sensitive information with agencies may face stronger expectations around their own email security settings as secure delivery standards become more common in official communications.

Government email systems routinely handle information relating to individuals, businesses and state agencies. That can include regulatory correspondence, procurement material, operational updates and personal data, making transport security a practical issue, not just a technical one.

New Zealand's lead on MTA-STS also marks a notable shift among Five Eyes partners. The country has often lagged larger peers in some areas of cyber adoption, but the latest figures suggest targeted, centralised changes can lift adoption quickly where there is a clear mandate across agencies.

At the same time, the figures show no Five Eyes country has fully secured all parts of its government email estate across both standards. Even in New Zealand, nearly half of the core government domains measured were not actively enforcing MTA-STS.

The research was based on publicly available DNS and HTTPS information from government domains and did not involve access to government systems or data. SMX Email assessed the deployment and enforcement of standards including DMARC and MTA-STS across the five countries.

"No Five Eyes country has finished the job across every measure, but New Zealand is now closer than most to having both sides properly covered," Hooker said.