January 2026 – Here is how countries handle SPF, DKIM, and DMARC as mandatory (especially for government domains, often including health services and other critical sectors where relevant). This also relates to the EU’s NIS2 Directive, which can influence national requirements but does not explicitly list SPF/DKIM/DMARC by name — instead, it mandates appropriate technical & organisational measures for cybersecurity (so email authentication might be required as part of national implementation).