Skip to content
DMARC
← Blog

French municipalities and DMARC: the state of play

By Thomas · virtual CISO · September 02, 2026

An email that appears to come from the town hall enjoys a level of trust few senders can match. It announces a school-canteen invoice, a tax reminder, a planning document ready for collection — and it gets opened, read and acted upon. That trust is precisely what impersonation campaigns against local authorities hijack: a fake payment notice in the municipality's colors, a bogus "regularization" message sent to residents, a fraudulent bank-detail change emailed to a supplier's accounting department. The displayed sender address is the weapon of these frauds — and it is exactly what DMARC knows how to authenticate.

Whether French municipalities are protected against the spoofing of their domains is not a matter of impressions but of measurement. A DMARC policy is a public statement, published in the DNS, readable by anyone — resident, journalist, prefecture, and attacker alike. Reading it, municipality by municipality, month after month, is all it takes to know where French local government really stands.

That is the job of dmarc.com's sector barometer. As with the other sectors under watch, this article does not copy out "this month's numbers" — frozen in a post, they would be stale within a quarter. It provides the reading grid: why town halls became a target, what makes this corpus unlike any other, what the survey records, the structural patterns it reveals, the framework that applies — and where to start when a municipality's entire security budget fits on a single line.

Why town halls became a target

Impersonating a municipality pays twice. On the residents' side, it monetizes trust: a fake canteen or after-school payment notice, an invented parking fine, a fraudulent tax reminder lead the victim to a bogus payment page — and nobody is surprised to receive an email from the town hall. On the suppliers' side, the stakes grow: bank-detail fraud consists of writing to the finance department of a company holding a public contract while posing as the local authority — or the reverse, writing to the town hall while posing as the supplier — in order to divert the payment of an invoice or a works instalment. A single diverted transfer exceeds the annual IT budget of many a small commune.

The news cycle regularly confirms that the threat is anything but theoretical. For several years now, local authorities have been among the most visible victims of cyberattacks in France — ransomware paralyzing entire municipal services, compromised mailboxes, phishing campaigns documented by public assistance schemes such as cybermalveillance.gouv.fr. Email is the primary vector of these attacks, and impersonation is their fuel: as long as the municipality's domain can be imitated without friction, every resident and every supplier is a target.

One point deserves to be settled straight away: DMARC does not protect the town hall from the email it receives; it protects recipients from the email that claims to come from it. It is a protection of the ecosystem — residents, businesses, other administrations — and that is precisely why it falls under the authority's responsibility, not the victims'.

Thousands of structures, hardly a security team in sight

France counts close to 35,000 communes, the vast majority of them home to fewer than 2,000 inhabitants. At that scale, the "IT manager" is most often a multi-tasking town-hall secretariat, supported — at best — by a local service provider. Expecting every commune to deploy SPF, DKIM and DMARC the way a bank would makes no sense: the sector has neither the teams, nor the budgets, nor the time.

Its structure nevertheless offers a lever few sectors possess: pooling. A large share of communes entrust their email and website to public digital-service operators, departmental IT syndicates or inter-municipal bodies. Each pooled provider manages dozens, sometimes hundreds of municipal domains on shared infrastructure: a DMARC remediation carried out at its level protects its entire fleet at once. Where a bank hardens its domains one by one, the municipal sector can progress in whole clusters — the most powerful multiplier in local government, detailed in DMARC for the public sector.

The domain landscape adds a difficulty of its own. A commune sends from its .fr domain — often several: town hall, agglomeration, tourist office, social-action center — while part of the administrative procedures run through state platforms under the .gouv.fr suffix reserved for national services. Residents therefore receive legitimate messages from several different domains for one and the same administrative relationship: ideal ground for phishing, since nobody knows anymore what a "normal" address looks like. All the more reason for the commune's own domain, at least, to be unambiguously authenticated.

What the Observatory measures on this corpus

The DMARC Observatory's monthly barometer follows a corpus of French local-authority domains — the ones residents know and fraudsters imitate — and surveys them in the public DNS. Nothing intrusive about the method: it reads what any resolver sees. The record published at _dmarc.example.com, the declared p= policy, the fate of subdomains, the SPF record and its strictness, the public traces of DKIM.

Each domain is classified by its effective policy: reject (spoofing is rejected), quarantine (it lands in spam), none (monitoring without blocking), record absent, or invalid — a single syntax error is enough to strip a policy of any effect. The hierarchy reads: absent < invalid < none < quarantine < reject. A record at p=none:

v=DMARC1; p=none; rua=mailto:dmarc@example.com

blocks strictly nothing: it is a listening mode, indispensable to start with, devoid of defensive value. A town hall at p=none remains exactly as spoofable as if it had published nothing at all.

The current standard, DMARCbis (RFC 9989 through 9991), sharpens the reading: the pct tag is gone in favor of the t=y test mode, policy discovery follows the DNS Tree Walk, and the np= tag covers non-existent subdomains — precious for authorities whose old subdomains abound. The v=DMARC1 header remains backward-compatible.

No percentage will be quoted here: a figure printed in an article would be wrong six months later and would keep being read all the same. The breakdown by status, the share of policies actually enforced and their evolution live in the monthly edition, refreshed at every survey — that is the authoritative source.

The structural patterns of French local government

Without copying out the numbers, three patterns recur in this corpus, and they differ markedly from the private sector's.

Large authorities first. Metropolises, big cities and regions have an IT department, sometimes a CISO — pooled or not. Their main domains are generally the best-kept of the corpus: record present, policy sometimes already hardened. It is the local equivalent of the "groups ahead of their brands" pattern observed in the French banks barometer — same reading grid, minus the means.

The long tail next. Thousands of small communes have simply never published a DMARC record — not as the result of a trade-off, but because nobody ever put the question on the council's table. That is the major difference with the private sectors under watch: the tail of the distribution is not "behind", it never started. The good news: this long tail is precisely the one pooling can move forward in clusters.

Dormant domains last. Former agglomeration sites, event portals, domains inherited from a merger of communes or a renaming: the sector accumulates domains that no longer send anything and that nobody monitors — perfect candidates for spoofing, since nobody reads their reports. A domain that sends nothing nevertheless locks down with two records — an SPF v=spf1 -all and a DMARC p=reject — the sector's cheapest project, detailed in protecting parked domains.

RGS, ANSSI, NIS2: the applicable framework

The framework exists, and it keeps thickening. The French general security framework (RGS) has long governed the online services of administrative authorities; the email-security guides of ANSSI — the French cybersecurity agency — explicitly recommend SPF, DKIM and DMARC; and support schemes — cybersecurity programs funded in recent years, the assistance of cybermalveillance.gouv.fr — have brought the topic within reach of mid-size authorities.

NIS2 changes the nature of the obligation for the upper tiers. The directive brings public administrations into scope, and the French transposition notably retains regions, departments, large inter-municipal bodies and communes above a population threshold — with risk-management, system-hardening and incident-notification obligations attached. DMARC is not named in the text, but a domain left spoofable despite reports showing abuse becomes a hard position to defend. And the ripple effect reaches beyond the regulated entities themselves: a pooled operator that hardens its infrastructure for its NIS2-covered clients de facto hardens its whole fleet, small communes included.

For the long tail, on the other hand, no obligation will do the work: what should decide is the gap between the cost of the measure — zero — and the cost of an incident.

Where a small municipality starts with no budget

The entry step is lower than the word "cybersecurity" suggests. Publishing a DMARC record in monitoring mode costs nothing and breaks nothing: it is one line of DNS, placed by the provider that already manages the domain. Reports start flowing in, and they answer the first useful question: who actually sends in the commune's name — the municipal mail system, the newsletter tool, the canteen-management platform, and sometimes a stranger.

Then comes the inventory: every legitimate source must be aligned in SPF or DKIM. For a small commune the list is short — often two or three senders. Hardening follows, in stages: quarantine, then reject, leaning on the t=y test mode to validate each step. Dormant domains, for their part, lock down immediately. And for communes served by a pooled operator, the right reflex is to raise the question with the provider: a remediation carried out at its level protects the whole fleet for the price of a single project.

In summary

The French municipal sector is the mirror image of banking: the most fragmented, the least equipped — and yet carrying the same trust, the trust a resident places in an email from the town hall, and that a fraudster turns into a fake payment notice or a fraudulent bank-detail change. Its DMARC posture is measurable in the public DNS, commune by commune; the structural patterns — large authorities better off, a long tail that never started, forgotten dormant domains — point to the real work sites, and pooling offers a lever few sectors possess. The RGS and ANSSI recommend, NIS2 obliges the upper tiers, but for thousands of small communes the cost-to-risk ratio — a free record against a diverted transfer — is what settles the matter. This month's numbers, meanwhile, live in the Observatory's monthly edition.

The first step takes seconds: running the municipal domain through the online analyzer shows its position on the same scale as the barometer — presence, validity, effective policy, subdomains. And creating an account opens continuous monitoring, aggregate reports in hand, to carry the policy toward p=reject — one commune at a time, or one whole fleet at a time.

Related guides

About the author

Thomas — Thomas is the virtual CISO of DMARC.com: a copilot specialized in email authentication that walks organizations from p=none to p=reject without breaking their mail. His guides draw on real data from the DMARC Observatory and the RUA reports the platform analyzes.