Protective markings break the moment mail reaches a handset
The desktop enforces the marking. The phone treats it as text in a subject line. That asymmetry is why so many agencies still classify their mobile mail down.
Most agencies have protective markings under control on the desktop. There is an add-in in Outlook, a user cannot send without applying a marking, the gateway reads the header, and the handling rules follow the classification.
Then the same mailbox is opened on a phone, and effectively none of that applies.
What the handset actually does with a marking
To a stock mobile mail client, a protective marking is a string. It appears in the subject line, or it sits in a header the client does not parse, and either way the client has no handling rules attached to it.
Concretely, on an unmodified fleet a user can:
- Forward a marked message to a personal address, because the client has no concept of a classification-based forwarding rule
- Save an attachment into a consumer cloud, because the share sheet is generic
- Reply to a marked message with no marking at all, because nothing validates on compose
- Leave the attachment in a cache that survives the message being deleted
None of that is a misconfiguration. It is the default behaviour of a mail client that was never built to enforce the Australian Government’s Email Protective Marking Standard.
The workaround everyone reaches for
Faced with that, agencies do one of three things, and all three cost something.
Restrict mobile mail entirely. Effective, and it removes the reason the fleet exists. Executives get their mail read to them over the phone, or they use a workaround nobody has documented.
Classify the mobile stream down. Mobile only receives OFFICIAL, with anything above it held back. This is defensible and it is also a permanent tax: the people who most need to be across sensitive material are the people least often at a desk.
Accept the gap quietly. More common than either of the above, and usually discovered during an assessment rather than a decision.
What enforcement on the device requires
The EPMS is specific. A conformant implementation has to handle the classification itself, plus caveats, access markers, information management markers, expiry and the notes field — and under the 2025.1 revision it has to read the X-Protective-Marking header, not just the [SEC=…] string in the subject.
Parsing is the easy half. The half that matters is doing something with the result:
Validate on compose. A user cannot send an unmarked message. The marking is applied and checked before the message leaves the device, which is the only point at which enforcement is cheap.
Bind handling rules to the classification. Above a threshold you define, a message is readable but not forwardable, not copyable and not exportable. The content stays available; the ability to make it portable does not.
Control attachments separately. Attachment handling restricted by classification, with no persistent cache on the device — which is what removes the lost-handset problem, because there is nothing on the device to recover.
Log the handling events. Not for its own sake. An assessor asking whether markings are honoured on mobile needs evidence, and an exportable audit trail into your SIEM is the answer that ends the conversation.
This is what MailGate does, and it is why we built it — the capability did not exist on the handset, and the alternatives all involved telling people they could not have their mail.
Where the marking usually gets lost anyway
Even with enforcement in place, markings degrade at boundaries. Worth checking in any environment:
- Mail relays and appliances that rewrite headers. Some security gateways normalise or strip non-standard headers, and
X-Protective-Markingis non-standard as far as they are concerned. - Reply chains from external parties. A marked message that leaves the environment and comes back has whatever marking the other side applied, or none.
- Automated mail. Notifications from line-of-business systems are frequently unmarked, and they are frequently the ones carrying record content.
- Mobile signatures. A signature appended after the marking validation is a small thing that fails an inspection.
The short version
Protective markings are an end-to-end control, and an end-to-end control has to hold at the weakest client. On most fleets that client is a phone, and on most fleets it enforces nothing.
Either the handset understands the marking, or the marking is a convention rather than a control.
More on MailGate, and on how we approach mobile security.