Skip to content
EditalMD

9 in 10 Brazilian city halls and state governments do not block fake email sent in their name: what suppliers should check

Public DNS for 2,912 Brazilian domains, read on 20 October 2026, shows that 91% of city halls and state governments and 86% of federal government domains do not tell receivers to reject fake email in their name. Suppliers should check what arrives by email at the official source.

EditalMD · Published · Reviewed

What was measured

CommsHarbor's Brazil email security report read the public DNS of 2,912 Brazilian domains that receive email on 20 October 2026. It asks one question: does the domain publish a DMARC policy set to reject, which tells the receiving provider to refuse fake messages?

Overall, 87% do not. In the public sector the picture is this:

  • State governments (553 domains): 91% do not reject fake email, and 46% have no DMARC at all.
  • City halls (1,657 domains): 91% do not reject. 34% have no DMARC and 30% only monitor.
  • Federal government (100 domains): 86% do not reject. 52% send fake email to spam but do not refuse it. Only 14% reject.

Why this matters for suppliers

Public agencies send calls, document requests, contract notices and bills by email. When an agency's domain does not tell receivers to reject fake email, a message with the agency's own address can reach a supplier's inbox carrying a payment request, a link to update a registration or an attachment posing as a tender notice.

Tender notices and their annexes are published on PNCP, as required by article 54 of Law 14,133/2021, and on the agency's procurement system. That is where a supplier confirms what arrived by email.

A short routine

  • Check any call, tender change or deadline that arrives by email on PNCP or on the agency's procurement system.
  • Do not pay a bill or tax slip received only by email without confirming the amount on the agency's portal or official phone line.
  • Do not log in to a procurement system from an email link. Type the address.
  • Test your own company domain too. If it does not reject fake email, someone can send bids, appeals or bills to the agency in your name.

How to fix it

The fix is in the domain's DNS: align SPF and DKIM, then publish DMARC with p=reject. CommsHarbor's free check reads SPF, DKIM and DMARC for any domain, no sign-up. The link is in the sources, together with the full report.

Method

The sample has 3,080 domains, from a list dated 20 October 2026, built from the Receita Federal open company registry (email of each active head office) and the CVM register of listed companies. Free email providers and accounting firms are left out. Only the 2,912 domains that receive email, with an MX record, count.

For each domain the MX, SPF and DMARC records were read from public DNS. The classification follows the published DMARC policy: no DMARC, monitor only (p=none), spam folder (p=quarantine) or reject (p=reject). The groups overlap and must not be added up. No domain is published, only totals per group. The reading repeats once a month.