27 August 2026 · By Nicholas “Nick” O'Sullivan, Townsville

Half of Queensland's independent schools do not enforce DMARC

Between late July and late August 2026, Suburban Secure used its own tooling to run a passive check of the public email-security records of 236 Queensland non-government schools — independent, faith-based and other schools outside the state system. We looked at one question in particular: if someone tried to send email as the school, would the school’s own published settings stop it?

The short version:

• 81% (191 schools) publish a DMARC record.
• 51% (120 schools) actually enforce it — a policy of p=quarantine or p=reject.
• 19% (45 schools) have no DMARC record at all.

We are not naming the schools that have not enforced DMARC, and we are not releasing the underlying scan data. School IT is often one or two people covering everything from classroom projectors to the payroll server, and a public list of gaps helps attackers more than it helps anyone else. Everything below is reported in aggregate.

Why this is worth writing about now

DMARC has always mattered for schools. It matters more since the 2026 Canvas incident, when the learning-management platform used by thousands of schools and universities worldwide was breached and names, email addresses and student ID numbers were taken at enormous scale. Several Queensland institutions temporarily disabled Canvas access as a precaution.

A breach like that does not just expose data — it hands criminals a ready-made contact list of families, staff and students who are expecting to hear from their school about it. Security researchers have warned that the stolen details will be reused for phishing dressed up as breach notifications, password resets and “identity protection” sign-ups. Proofpoint research cited in that coverage found that 73% of schools lacked email authentication at enforcement, and 6% had no DMARC record at all.

The breach was not caused by weak DMARC. But the most convincing version of the follow-up scam — an email that really does come from yourschool.qld.edu.au — is exactly what an enforced DMARC policy is designed to stop.

State schools are covered differently

Queensland state schools and agencies sit inside whole-of-government arrangements, where email authentication is provisioned and maintained centrally rather than school by school. A state primary school does not individually decide whether its domain enforces DMARC.

Non-government schools do. Each runs its own domain, chooses its own mail provider and makes its own call about how far to take email authentication. That independence is normal and reasonable — but it means the protection that a state school gets by default is, for an independent school, a project that somebody has to own. Our scan is an attempt to measure how that has played out across the sector.

What we checked, and how

For each school we resolved the main website domain and read only what any mail server on the internet can already see:

• whether an SPF record is published, and whether it ends in a hard fail (-all) or a soft fail (~all);
• whether DKIM signing is detectable from public selectors;
• whether DMARC is published, what policy it sets (none, quarantine or reject), and whether it asks for aggregate reports (rua);
• supporting signals such as MX records, HTTPS availability, TLS certificate health and mail-blocklist status.

Nothing in the scan sends email or touches a school’s mailbox. DKIM detection is best-effort — selectors often cannot be found without receiving a genuine message — so the real DKIM figure is likely a little higher than what we could see.

What the records show

Of the 236 schools:

• 32 (14%) publish p=reject — the receiving server is told to bin mail that fails authentication.
• 88 (37%) publish p=quarantine — failing mail is sent to the spam folder.
• 71 (30%) publish p=none — a monitoring policy that collects reports but asks receivers to block nothing.
• 45 (19%) publish no DMARC record, so a receiver has no instruction to act on at all.

That leaves 120 schools (51%) at a policy that does something, and 116 (49%) where a spoofed message would not be stopped by DMARC. Weighted by enrolment the picture is a little better — around two-thirds of the roughly 144,000 students in the set attend a school that enforces DMARC — because larger schools do better, which is the next chart.

Reporting is a bright spot: of the 191 schools with any DMARC record, 159 ask for aggregate reports. Most schools that have published p=none are at least positioned to see what would happen if they moved to enforcement.

Enforcement tracks school size

Split the schools into four enrolment bands and the pattern is stark. Schools with fewer than 200 students enforce DMARC just 24% of the time. For schools over 1,000 students it is 77%.

This is not a story about small schools not caring. It is a story about capacity. A 150-student school and a 1,800-student college face the same DNS records, the same mail-provider settings and the same need to inventory every newsletter tool and finance system that sends on the school’s behalf before tightening the policy — but they are not resourced the same way. If the sector wants to close this gap, the smallest schools are where help has to land.

This is an enforcement gap, not an awareness gap

Look across the individual controls and most schools have clearly started:

• 93% publish an SPF record.
• 81% have a detectable DKIM signature.
• 81% publish a DMARC record.
• 51% have DMARC at an enforcing policy.

The drop-off is almost entirely at the final step. Publishing p=none is quick and safe; moving to p=quarantine or p=reject means confirming that every legitimate sender is authenticated first, and that is the part that needs time and a little confidence. Of the 63 schools whose SPF ends in a soft fail rather than a hard fail, most could tighten that too. The good news is that the hard work of adoption is largely done — what is missing is the follow-through.

Schools that have it covered

Plenty of Queensland schools have taken this all the way. Twelve in our set publish p=reject, back it with a hard-fail SPF record and detectable DKIM, and ask for aggregate reports — a genuinely strong configuration. A few stood out:

• Moreton Bay College (Manly West) — p=reject with a matching subdomain policy and strict SPF and DKIM alignment.
• Kimberley College (Carbrook) — p=reject and sp=reject, full coverage (pct=100), strict alignment and forensic reporting.
• Somerset College (Mudgeeraba) — p=reject at full coverage with aggregate and forensic reporting, on a ~1,600-student domain.

Citipointe Christian College, Coomera Anglican College and Ormiston College are among the others at full enforcement. It is worth saying plainly: this is achievable for a school, it has been done by schools of very different sizes, and none of it requires exotic tooling.

Other things the scan flagged

DMARC was the focus, but a few other findings are worth a mention in aggregate:

• 5 domains responded in a way consistent with a possible open mail relay — worth a closer look by those schools.
• 12 domains had a current listing on at least one mail blocklist, which hurts legitimate deliverability.
• 13 schools had no working HTTPS on the scanned website, and 4 had no MX record on the main domain.
• The average risk score across the set was 33 out of 100 (higher is worse), spanning a low of 6 to a high of 84.

If your school is not enforcing yet

The path is well worn and low-risk if taken in order:

1. Publish p=none with rua if you have not already. Nothing is blocked; you start getting reports.
2. Read the reports for a few weeks. They will show every service sending as your domain — the newsletter platform, the permission-form tool, the finance system, the MAT results portal.
3. Authenticate the legitimate senders with SPF and DKIM until the reports are clean.
4. Move to p=quarantine, then to p=reject, watching the reports at each step.

ASD’s ACSC guidance, How to combat fake emails, walks through the same progression. To see where your domain stands right now, our free Can They Email As Me? check reads the same public records this scan used. If the reporting step is the blocker, that is what our monitored DMARC service exists to carry.

About the data

The scan covered 236 Queensland non-government schools and ran between 27 July and 27 August 2026. It is a passive read of public DNS and mail records at a point in time — schools may have changed their configuration since, and we would be glad to hear about it. It is not a penetration test, and a published enforcing policy resists direct domain spoofing but is not a defence against every impersonation method (lookalike domains, display-name tricks and compromised mailboxes are separate problems).

Aggregated results are in this article. We have not published a list of schools that have not enforced DMARC, or the underlying scan data, and we do not intend to. If you work at a school and want to know where your own domain stands, the free check reads the same public records.