What Is BOD 18-01 and Why Does It Matter for Government Email Security?

You receive an email that looks like it’s from your agency’s official address, complete with the right logo and tone. It asks for sensitive information or a quick login. You’re not sure if it’s real. This isn’t a rare incident—it’s a growing risk, and it’s happening because someone is exploiting weak email security in government domains.

BOD 18-01, issued by CISA in 2018, is a direct response to this problem. It’s not just a checklist—it’s a mandate that forces federal agencies to stop letting spoofed emails slip through. The core idea is simple: if you run a government domain, you must block unauthorized senders by enforcing DMARC with a policy of ‘p=reject’ or ‘p=quarantine’. That means emails not authorized by your domain are automatically rejected, not just flagged.

This matters because every unsecured domain is a potential entry point for phishers and impersonators. Without BOD 18-01 compliance, official communications lose credibility—and that’s a national risk. This article explains how BOD 18-01 works, why enforcement is non-negotiable, and what happens when agencies fall short. The goal: ensure you know what’s required, why it’s needed, and how to actually meet it.

Key takeaways

  • BOD 18-01 requires U.S. federal agencies to enforce DMARC with 'p=reject' or 'p=quarantine' to block spoofed emails.
  • Non-compliance increases the risk of impersonation attacks and erodes trust in official government communications.
  • Failure to implement DMARC under BOD 18-01 exposes agencies to phishing, data breaches, and reputational damage.

How DMARC Works in Government Email Security Mandates

DMARC protects government email by validating that messages sent from your domain are authorized. It checks SPF and DKIM signatures, verifies alignment with the "From" header, and applies a policy—none, quarantine, or reject—based on results. If alignment fails, the email is blocked, stopping spoofing and phishing at scale.

SPF and DKIM: The Foundation of DMARC

DMARC doesn’t work alone. It relies on SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to verify sender identity. SPF checks if the sending IP is listed in the domain’s DNS record. DKIM verifies the email wasn’t altered in transit by applying a digital signature. For DMARC to pass, both must succeed and align with the domain in the "From" header.

Let’s say a government agency sends an email from [email protected]. If SPF says the IP is authorized, and DKIM confirms the content hasn’t been tampered with, DMARC steps in to validate the alignment—ensuring the "From" domain matches the domain used in SPF and DKIM. If not, the email fails.

Policy Application: From "None" to "Reject"

Once alignment is checked, DMARC applies the domain’s policy. A "none" policy means no action—emails that fail are still delivered. A "quarantine" policy marks them as suspicious. A "reject" policy blocks them entirely. Most government domains enforce "reject" to stop spoofed messages cold.

For example, if a fake [email protected] email is sent from an unauthorized server, DMARC will detect the mismatch in alignment and block it before it reaches an inbox. This is especially critical for agencies handling sensitive data or public communications.

Organizations must monitor DMARC reports to detect anomalies or misconfigurations. The IETF's official DMARC specification outlines these processes for standardization across sectors.

Using tools like MailTester’s bulk verification lets agencies validate their domain’s email addresses, detect invalid or disposable domains, and clean lists before sending. This reduces the risk of misdelivered or spoofed messages.

What Domains Are Covered by BOD 18-01 DMARC Mandates?

BOD 18-01 applies to all official .gov and .mil domains used by U.S. federal agencies. These domains must implement DMARC policies with at least a "quarantine" or "reject" enforcement level by the deadline. Non-compliance risks exposure in public phishing reports and can lead to loss of trust, especially for agencies handling sensitive citizen data. The mandate aims to stop spoofing at scale.

Scope Beyond Federal Domains

While BOD 18-01 is federal-only, many state and local government entities have voluntarily adopted similar email security policies. This shift is driven by rising cyberattacks targeting public services—like phishing campaigns impersonating city hall or tax offices. When government email appears in a spoofing report, it undermines public confidence in digital interactions.

For example, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) maintains a public database of email domains that fail DMARC checks. Agencies with non-compliant domains may find their addresses listed here, creating visibility for attackers to exploit. CISA’s guidance on email authentication is available at cisa.gov.

Why Compliance Matters in Practice

DMARC is just one layer. A valid policy only works if aligned with SPF and DKIM. Without proper configuration, even a “reject” policy won’t stop spoofed messages. Let’s say a department sends from a valid .gov domain but doesn’t properly set up SPF. A threat actor can still forge emails that look real—especially if the domain is in a catch-all or has weak authentication.

You can verify the validity and security posture of any domain in your list using real-time checks. Tools like the MailTester API let you test individual addresses or validate entire senders' domains. Bulk verification helps ensure that your mailing lists only include active, secure domains—reducing risks from outdated or compromised addresses.

Even if your domain is compliant on paper, ongoing monitoring is key. A domain can fall out of compliance if DNS records are altered or if a third-party vendor handles email and doesn't respect authentication standards. Regular inbox testing via the inbox placement tool gives you real feedback on how your messages reach users—whether they land in inboxes or are flagged as spam.

Common Challenges in Achieving BOD 18-01 DMARC Compliance

You don’t need to guess where DMARC fails in government agencies. Legacy systems often can’t sign outbound emails correctly, causing valid messages to be rejected. Third-party vendors using agency domains without proper SPF/DKIM alignment create blind spots. And without continuous monitoring, misconfigurations go undetected—leaving agencies exposed to spoofing attacks that bypass defenses, even when policies are in place.

Limited Authentication in Legacy Infrastructure

Many federal agencies still rely on old email platforms that either skip authentication entirely or do it incorrectly. This means legitimate messages get flagged as suspicious because they lack proper DKIM signatures or SPF alignments. The result? A false negative that blocks real communication, especially when sending to partners or citizens who expect confirmation emails.

The issue isn’t just technical—it’s systemic. Outdated systems often weren’t built with modern sender policies in mind. Without upgrading, you’re stuck between security and delivery, and that tension undermines trust in official communications.

Vendor-Driven Misalignment and Visibility Gaps

Agencies often use third-party vendors for communications—like grant notifications, health alerts, or tax forms. But not all vendors configure SPF or DKIM correctly. When they send from a government domain, their lack of authentication creates a gap in DMARC’s validation path. Even if your policies are strict, those messages still get marked as unverified or rejected, harming your deliverability and reputation.

Even more serious: many agencies lack real-time visibility into these outbound flows. Without consistent reporting and logs, you can’t see which senders are violating standards until after an attack. That delay turns risk into breach, especially when spoofed emails are used in phishing campaigns targeting public staff or citizens.

DMARC isn’t just a policy—it’s a process of constant validation. As outlined in RFC 7483, proper enforcement requires not just configuration, but ongoing monitoring and correction. Many agencies miss this. The key isn't setting the policy; it's knowing whether it's being followed.

That’s why tools like MailTester’s real-time API help validate domain readiness and catch issues early. You can test thousands of sender addresses at scale, flagging those with weak or missing authentication—before they hit production or get flagged by recipients.

How to Verify Email Domains for BOD 18-01 Compliance

You can verify government and public sector email domains for BOD 18-01 compliance by validating each address in your agency’s contact lists in real time, identifying invalid, catch-all, or role-based addresses that pose spoofing risks, and ensuring only authenticated domains are used for official communications. This minimizes exposure to phishing, credential theft, and unauthorized access.

Step 1: Test Domains in Real Time with an Email Verification API

Let’s start with the foundation: you need to test every email address before it’s used. A real-time verification API checks if a domain is live, whether the mailbox accepts mail, and if it’s protected by SPF, DKIM, or DMARC. These are all required by BOD 18-01 to prevent spoofing.

APIs like MailTester’s Email Verification API can process thousands of addresses in minutes, returning clear verdicts: valid, invalid, catch-all, or risky. This stops fake or non-existent addresses from ever entering your sending workflow.

Step 2: Run Bulk Verification on Agency Contact Lists

Public sector agencies often manage large contact databases—vendors, partners, employees, or constituents. Using MailTester’s bulk verification tool, you can upload full lists and identify dead, misconfigured, or high-risk addresses in one go.

Bad data doesn’t just create bounces. It degrades sender reputation and may lead to domains being flagged by email providers. Consistent cleanup ensures only verified, deliverable addresses are used—critical for maintaining trust and compliance.

Step 3: Identify and Flag Catch-All and Role-Based Accounts

Catch-all domains accept any email, even misspelled ones. Role accounts (like info@, support@, admin@) can be exploited by attackers who guess common names. Both are high-risk for phishing and impersonation.

MailTester flags these as “risky” or “catch-all” during verification. These addresses should not be used for sensitive communications. For BOD 18-01, enforcing policies that limit reliance on shared or generic roles reduces attack surface.

For ongoing risk control, integrate verification into your onboarding and request workflows. This creates an operational feedback loop—no matter how old the data, you’re validating it at the point of use.

Authentication and verification aren’t one-time tasks—they’re continuous guardrails. BOD 18-01 doesn’t just ask for technical controls; it demands that agencies actively maintain their digital hygiene.

Use MailTester’s integrations with platforms like Mailchimp, HubSpot, and SendGrid to automate checks at the point of send. You can also test inbox placement on real user accounts to ensure your messages avoid spam folders.

Testing Inbox Placement Before Enforcing DMARC

Before enabling strict DMARC policies like p=reject, test how your emails land in real inboxes across Gmail, Outlook, Apple Mail, and others. Use inbox-placement tools to simulate delivery and catch issues like spam filtering, subject line triggers, or authentication misconfigurations before they break critical communications.

Run Real Inbox Tests Before Enforcement

  1. Use inbox-placement testing tools to validate deliverability. Before enforcing DMARC with p=reject, send test emails through platforms that simulate real-world inbox delivery. This confirms that legitimate emails from agencies, departments, or partner organizations actually land in inboxes—not spam folders or blocked entirely.
  2. Test across multiple providers and clients. Different inboxes treat the same email differently. Gmail may flag a high-volume message as promotional, while Outlook may reject it based on sender reputation or link formatting. Tools like MailTester’s inbox tester replicate these environments across major email providers, showing you exactly where and how your messages land.
  3. Review feedback loop data and engagement signals. Monitor feedback loops (FBLs) from major providers and track aggregate metrics such as open rates, spam complaints, and bounce behavior. If complaint rates are high or opens are low, something is amiss—either in content, sender reputation, or authentication. Fix these before locking down your domain.
  4. Validate your sender reputation and IP health. A strong DMARC policy can’t rescue a poor reputation. Ensure your sending IP hasn’t been flagged by DNSBLs. Tools like MxToolbox or Spamhaus help check blacklisting status and reputation scores before full enforcement.
  5. Validate authentication setup across SPF, DKIM, and DMARC. Misconfigurations here often lead to delivery failure. Use RFC-compliant validation methods to confirm that each record is properly set and that alignment is consistent between SPF, DKIM, and DMARC. A single broken link in this chain can trigger rejection.

Use Real-World Data to Guide Policy Shifts

Let your testing results—not assumptions—determine when to move from p=none to p=quarantine or p=reject. You can run these tests in bulk using the MailTester Inbox Tester for high-volume campaigns or integration workflows. The platform delivers real-time insights across 10+ email clients, simulating real sender conditions.

For ongoing verification, integrate MailTester’s email verification API into your onboarding or content approval process. This ensures that every outbound message originates from a valid, active address—reducing risk and building sender trust over time.

Start with a free test of 100 email addresses at MailTester’s pricing page, then expand as needed. You’re not just securing a domain—you’re ensuring that public services remain visible, trusted, and deliverable.

Why Catch-All Domains and Role Accounts Threaten Public Sector Email Security

Catch-all domains and role accounts like admin@ or info@ create dangerous blind spots. They accept all incoming emails—even those spoofed to appear official—making it easy for attackers to impersonate government staff. Meanwhile, unmonitored role accounts are prime targets for spear phishing and business email compromise (BEC), where attackers exploit weak oversight to gain access to sensitive data or funds. You can't secure what you can't verify—and these accounts are often invisible to standard validation tools.

Catch-All Domains: The Invisible Backdoor

Catch-all domains don’t reject emails sent to invalid addresses. That sounds convenient, but it’s a security liability. Attackers can send emails to fake addresses like [email protected] or [email protected] and still deliver them—because the domain accepts anything.

That opens the door for spoofing. An attacker can craft a message that looks like it came from a legitimate public servant, using a trusted domain. According to IRS guidance on phishing threats, such spoofing is a common tactic in BEC campaigns targeting government entities.

Role Accounts: The Forgotten Access Points

Role accounts like support@, admin@, or info@ are standard across government websites and portals. But they’re rarely monitored, password-protected, or tied to specific individuals. If an attacker learns the password via social engineering—maybe through a compromised vendor or a weak password reset form—they gain a foothold.

These accounts are often used in spear phishing attacks because they’re recognizable and frequently trusted. An email from [email protected] might look legitimate to staff, even if it’s actually sent by an attacker harvesting credentials. Without email verification, it’s hard to know if these addresses are valid—or worse, whether they’re being used for malicious purposes.

Let’s be clear: you can’t defend what you can’t identify. Validating email addresses at scale—especially role accounts and catch-all domains—is essential. MailTester’s bulk verification helps you identify invalid, risky, or catch-all addresses in your lists before they become entry points. You can also test inbox placement with our inbox tester, or integrate directly via our real-time verification API. With 98.9% accuracy, you get answers, not guesses.

Use Real-Time Verification to Clean Public Sector Email Lists

You can prevent failed deliveries, protect sender reputation, and meet government email security mandates by integrating real-time verification into your public sector workflows. Every address is checked instantly against SMTP, MX, and domain policies during onboarding or list cleanup—ensuring only valid, deliverable emails are used. This reduces bounce rates, avoids accidental exposure of invalid or disposable domains, and supports compliance with policies that demand data integrity.

Integrate Verification at the Source

  • Use MailTester's real-time verification API to check every email as it enters your system—before it reaches HubSpot, SendGrid, or your internal CRM.
  • Automate checks during form submissions, onboarding flows, or list imports to catch invalid, catch-all, or disposable domains before they cause delivery failure.
  • Integrate with platforms like SendGrid or HubSpot to validate addresses at scale—preventing spam triggers and maintaining consistent inbox placement.

Keep Your Lists Lean and Compliant

  • Filter out any address marked as "catch-all" or "risky." These often point to systems that accept any email—common in public sector domains but rarely intended for real messaging, increasing bounce or spam risk.
  • Remove invalid or non-existent addresses immediately; studies show even 0.5% invalid emails can degrade sender reputation over time.
  • Regularly audit and verify your lists with bulk verification to meet government data hygiene standards, especially for systems handling sensitive citizen communications.
  • Use inbox placement testing to confirm your message actually lands in the primary inbox—beyond just delivery, especially important for public notices and official communications.

Government and public sector organizations are held to higher standards for data accuracy and security. Email verification isn’t just a deliverability tool—it’s a compliance enabler. By verifying every address in real-time, you reduce risk, avoid wasted sends, and ensure outreach reaches intended recipients without triggering spam filters or violating domain policies. The result? Higher engagement, stronger reputation, and reduced exposure of public data to non-existent systems.

“Email list hygiene is a foundational component of digital trust in public services.” — APAC Email Standards Initiative

With MailTester, you don’t need to choose between speed and accuracy. You get both—verified delivery, real-time checks, and the ability to maintain compliant, clean lists with no expiry on purchased credits.

How MailTester Supports Government Email Security and BOD 18-01 Compliance

You can use MailTester to verify email addresses with 98.9% accuracy across bulk lists and real-time checks, ensuring only valid, non-disposable, non-role accounts receive government communications. This reduces bounce rates, prevents spoofing risks, and helps meet BOD 18-01 requirements for authenticated, trusted delivery. By confirming deliverability before enforcing DMARC, you prevent legitimate emails from being blocked due to poor sender reputation.

Key Capabilities for Compliance and Security

  • Validate email addresses at scale with bulk verification, reducing bounce rates and improving sender reputation — a key factor in DMARC enforcement and inbox placement.
  • Use our real-time verification API to scrub inputs at point of capture, preventing invalid or role-based addresses (like admin@ or info@) from entering your system.
  • Test inbox placement before going live with large campaigns to confirm your messages reach inboxes, not spam folders — critical for public trust and compliance audits. Use inbox placement testing to simulate delivery across major providers.
  • Integrate with platforms widely used by public agencies — Mailchimp, SendGrid, HubSpot, and Klaviyo — via our built-in integrations, maintaining security hygiene across your communication stack.
  • Verify domain ownership and configuration through real email delivery tests, helping you detect misconfigured SPF, DKIM, or DMARC settings that could trigger rejection or bypass security policies.

Why This Matters for BOD 18-01

BOD 18-01 requires federal departments to enforce DMARC policies, but enforcing it without validating addresses risks blocking legitimate communication. MailTester fills that gap: it ensures only real, valid recipients exist before you crank up security. This reduces the risk of emails failing to deliver due to misconfigured policies or bad sender reputation.

According to CISA's guidance on BOD 18-01, agencies must implement email authentication to defend against phishing, spoofing, and data exfiltration. MailTester supports this by validating addresses in real-world conditions, not just syntax.

For example, role-based accounts like [email protected] aren't just risky — they're often catch-alls or unmonitored. Catch-alls can be exploited for abuse, and their existence complicates DMARC alignment. MailTester flags these clearly.

With 98.9% accuracy across 100 million+ validations, MailTester gives you confidence in your list hygiene — a foundation for any secure, compliant email program.

Start with 100 free verifications at our pricing page, and see how accurate verification improves your security posture before enforcement.

What Happens If a Public Sector Domain Fails DMARC Enforcement?

If a government or public sector domain fails DMARC enforcement, its emails risk being blocked by major providers like Gmail, Outlook, and Yahoo due to policy mismatches. Attackers can then impersonate official addresses using spam traps or malicious domains, eroding public trust. CISA may flag the domain in its public cybersecurity reports, leading to increased scrutiny and potential regulatory action. This isn’t hypothetical—weak email security is a known vector for phishing and data breaches in public services.

Spam and Impersonation Risks Grow Fast

Without DMARC enforcement, bad actors can send emails that appear to come from your official domain. Gmail and Outlook use DMARC to validate sender authenticity; if your domain lacks a valid policy, those providers may block your messages or mark them as spam. That means real communications—from benefit notifications to official alerts—never reach citizens.

More dangerously, spammers often seed spam traps using compromised or spoofed government domains. If your domain doesn’t enforce DMARC rigorously, it’s a prime target. A single misconfigured email can trigger a phishing campaign that looks official. This isn’t just a technical fail—it undermines citizen confidence in digital government services.

CISA and Public Accountability

CISA’s Known Exploited Vulnerabilities (KEV) list and its ongoing reporting on organizational security posture includes email domain risks. Domains that don’t enforce DMARC with a strict policy (like `p=reject`) are seen as high risk. When public agencies fall short, CISA may publish findings or issue advisories that increase audit pressure.

It’s not just about compliance—it’s about credibility. If a city, state, or federal office can’t protect its email infrastructure, citizens may doubt the legitimacy of all official correspondence. That’s why many public sector IT teams now treat DMARC enforcement as a baseline security control.

A real-world check: you can test how your domain performs in today’s inboxes, even before rollout. Use MailTester’s inbox placement tester to simulate delivery across Gmail, Outlook, and Yahoo with real-time feedback.

For ongoing verification across large email lists—especially during employee onboarding or campaign launches—bulk validation helps catch bad addresses early. Try MailTester’s bulk verification to identify outdated, catch-all, or invalid entries that could expose your domain to spoofing risks.

Achieve BOD 18-01 Compliance with Proactive Verification and Monitoring

Government and public sector email domains must be verified systematically to ensure sender legitimacy and prevent spoofing. Every domain used for official communications should be validated as part of a compliant email infrastructure.

Key Actions to Maintain Compliance

  • Verify all sender domains in use across federal, state, and local agencies.
  • Test inbox placement regularly to confirm messages reach recipients and aren’t filtered as spam.
  • Monitor feedback loops and blocklists to detect and resolve delivery issues early.
  • Perform routine list cleaning using high-accuracy tools to reduce bounces and protect sender reputation.

Consistent verification and monitoring reduce the risk of spoofing, ensure inbox placement, and maintain trust with stakeholders. These steps are not optional — they are foundational for compliance with BOD 18-01 and for securing government communications.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

What is BOD 18-01 DMARC?

BOD 18-01 is a CISA directive requiring U.S. federal agencies to implement DMARC with a 'p=reject' policy to prevent email spoofing.

Which domains must comply with BOD 18-01?

All .gov and .mil domains used by U.S. federal agencies must enforce DMARC policies as mandated by CISA.

Can I use MailTester to test DMARC policies?

MailTester doesn't test DMARC policy enforcement directly but verifies the legitimacy of addresses involved in email flows.

How does MailTester help with government email security?

It verifies addresses for validity, catch-all status, and risk, helping agencies maintain clean, secure email lists and improve deliverability.

What is a catch-all email address?

A catch-all address accepts all incoming mail sent to any non-existent address on a domain, increasing the risk of phishing and spoofing.

Why is inbox placement testing important before enforcing DMARC?

To ensure legitimate emails from public agencies still reach inboxes when DMARC policies are enforced with 'p=reject'.

How accurate is MailTester's email verification?

MailTester delivers 98.9% accuracy in verifying email addresses across bulk lists and real-time checks.

Do purchased MailTester credits expire?

No, purchased verification credits never expire, providing long-term value for ongoing list hygiene.

Can MailTester integrate with SendGrid and HubSpot?

Yes, MailTester integrates with SendGrid, HubSpot, Mailchimp, and Klaviyo to automate list verification and improve deliverability.

What is DMARC alignment?

DMARC alignment checks match the domain in the 'From' header with those in SPF and DKIM to confirm sender authenticity.

Are role accounts a security risk in public sector emails?

Yes, role accounts like admin@ or info@ are frequently exploited in phishing attacks due to poor monitoring and weak access controls.

What happens if a government email is marked as spoofed?

It may be blocked by email providers, leading to lost communication, damaged public trust, and possible CISA reporting.