Proofpoint, a top cybersecurity and compliance firm, has shared new findings highlighting a major concern among leading companies in the Asia Pacific region. Only 12% have adopted the highest level of email authentication, leaving many vulnerable to email-based attacks.

Phishing activity saw a sharp rise in 2024, with incidents spiking nearly 60% compared to the previous year. This surge emphasizes the urgent need for effective email authentication to combat fraud by preventing cyber criminals from impersonating trusted organizations.

The study reviewed the adoption of Domain-based Message Authentication, Reporting, and Conformance (DMARC) among Asia Pacific companies listed on the Forbes Global 2000. DMARC, an email security protocol, verifies sender identities to prevent fraudulent emails from reaching recipients. It offers three protection levels: monitor, quarantine, and reject. The “reject” setting is the most secure, blocking unverified emails entirely.

“Email remains a major risk across industries. It’s promising to see many companies in the Asia Pacific taking steps to protect their customers from email fraud,” said George Lee, Senior Vice President of Asia Pacific and Japan at Proofpoint. “However, the growing complexity, cost, and frequency of cyberattacks make it alarming that so many remain exposed. Strong cybersecurity measures are essential to protect against these threats and safeguard customer data.”

Proofpoint’s analysis revealed that DMARC adoption in Asia is generally lower than in the US and UK, leaving businesses and their customers at risk. While Australia leads the region in DMARC enforcement, countries like Japan, South Korea, and Thailand lag significantly, making them more susceptible to email fraud, such as phishing and business email compromise (BEC).

DMARC asia pacific

Here are key findings from Proofpoint’s DMARC study in the region:

Australia: 71% of leading companies use the “reject” setting, the recommended level. All companies analyzed have a DMARC record.
Singapore: 46.2% enforce DMARC at the “reject” level, but 23.1% lack any DMARC record, leaving them open to fraud.
India: 50% of top companies use the “reject” level, 30.9% use “quarantine,” and 11.8% have no DMARC record.
Japan: Just 7.4% enforce “reject” policies, while 65.6% remain at the “monitor” stage, which provides no active protection.
South Korea: No companies enforce “reject,” with only 1.8% using “quarantine” and 51.8% lacking a DMARC record altogether.
Thailand: 17.6% enforce “reject,” another 17.6% use “quarantine,” while 52.9% remain at the “monitor” level.
China: Only 4.2% use the strictest DMARC protection, and 71.8% have no DMARC record.

Pressure to Improve DMARC Adoption

Leading email providers such as Google, Yahoo, and Apple are taking action to force companies to adopt email authentication. In October 2023, these providers announced mandatory email authentication (including DMARC) for bulk senders targeting Gmail, Yahoo, and iCloud users. The goal is to significantly reduce spam and fraudulent emails.

CCompliance requirements like the Payment Card Industry Data Security Standard (PCI DSS) are also driving DMARC implementation for industries handling payment information for industries handling payment information. By March 2025, companies must use DMARC to protect customers’ credit card data or face potential penalties.

Best Practices for Email Security

Proofpoint offers the following advice for improving email security:

Set Up DMARC: Protect your domain from impersonation by implementing DMARC with the “reject” enforcement level. Seek expert help if necessary to ensure legitimate emails aren’t blocked.
Train Employees: Educate staff on recognizing and avoiding fake or suspicious emails that mimic coworkers, vendors, or customers.
Improve Password Security: Use strong passwords, enforce regular updates, and avoid reusing passwords across accounts.

The analysis, conducted in December 2024, used data from companies on the Forbes Global 2000 list.

Learn more about DMARC at Proofpoint’s DMARC resource.

About Proofpoint, Inc.

Proofpoint focuses on helping organizations protect their people, data, and operations against cyber threats. With a comprehensive suite of cloud-based solutions, Proofpoint serves companies worldwide, including 85% of the Fortune 100. For more details, visit www.proofpoint.com.