What is the Secure Government Email (SGE) Framework?

It is New Zealand’s government-wide set of email-security controls that require SPF, DKIM, DMARC, TLS 1.2+, MTA-STS, and DLP across all public-sector domains.

Why does the framework require DMARC p=reject?

A reject policy tells receiving servers to discard any message that fails authentication, eliminating spoofed phishing attempts before they reach users.

How can I check my domain’s current email-security posture?

Use Palisade’s free email security score tool to see real-time SPF, DKIM, and DMARC status. 👉 https://www.palisade.email/tools/email-security-score

What happens if my agency does not meet the October 2025 deadline?

AoGSD will flag the domain, and the agency will need to remediate quickly or risk being cut off from inter-agency communication.

Do I need a new email gateway to comply?

Not necessarily. The SGE framework focuses on authentication and encryption; existing secure email gateways can be retained if they support the required standards. For deeper guidance on implementing email authentication, see our email authentication best practices guide.

Why must NZ government domains adopt new email standards?

New Zealand’s Digital Government has released the Secure Government Email (SGE) Framework, a modern set of technical controls that replace the legacy SEEMail gateway and bring open-standard authentication to every public-sector inbox. New Zealand email security framework The framework mandates a suite of controls that any agency handling restricted, sensitive, or confidential information must implement. Although the initial focus is on high-classification bodies, the guidance strongly encourages every government domain to comply.

Who is affected?

While the most stringent requirements target agencies that manage classified data, the ripple effect reaches all public-sector entities because secure communication must be interoperable across the entire ecosystem.

RequirementMandatory forWhy it matters to everyoneProtect confidential, sensitive, and restricted emailAgencies handling classified dataAll partners must exchange messages securely.DMARC with p=reject for every email-enabled domainClassified-data agencies and any domain they use to send mailAttackers spoof any brand; enforcement protects the whole ecosystem.Retirement of SEEMail in 2026Current SEEMail usersThe SGE framework becomes the baseline for all government domains.

The bottom line: compliance starts with high-classification agencies, but by October 2025 every public-sector domain should meet SGE standards.

Core technical controls (plain language)

1. Authenticate the sender

SPF: Publish a DNS record that lists every authorized sending service and end it with -all to block the rest. 👉 https://www.palisade.email/tools/email-security-score
DKIM: Cryptographically sign every outbound message. 👉 https://www.palisade.email/tools/email-security-score
DMARC: Align SPF and DKIM, enable reporting, and set the policy to p=reject so fraudulent mail never reaches inboxes. 👉 https://www.palisade.email/tools/email-security-score

2. Encrypt the channel

Enforce TLS 1.2 or higher for all mail transport.
Deploy MTA-STS + TLS-RPT to require encryption in transit and receive downgrade-attack alerts.

3. Protect the content

Implement Data-Loss Prevention (DLP) to block outbound messages that contain data above the sender’s clearance level.

Implementation timeline

June 2025: SGE v1.0 published – guidance available as a PDF.
October 2025: All applicable agencies should have aligned external domains with SGE.
2026: Legacy SEEMail gateway retires; non-compliant agencies risk isolation.

Consequences of non-compliance

The All-of-Government Service Delivery (AoGSD) team will monitor DMARC, SPF, and MTA-STS records (DKIM soon) and flag any domain that falls short. Agencies will be required to demonstrate compliance and remediate promptly.

At a glance

Quick Takeaways

Adopt SPF, DKIM, and DMARC p=reject to stop email spoofing.
Enforce TLS 1.2 or higher and enable MTA-STS for transport-level encryption.
Deploy DLP to safeguard sensitive data in outbound mail.
Start monitoring your domain’s authentication status now – Palisade offers a free checker.
Plan for automation; manual updates to DNS records are error-prone and can exceed lookup limits.
Target enforcement early; p=none provides no protection.
Prepare for the 2026 SEEMail retirement by modernizing your email stack today.