Security News > 2020 > March > Number of spoof attempts on domains drops to "near zero" within months of DMARC enforcement
In a new study on DMARC usage and success, email cybersecurity company Vailmail found that spoof attempts drop to nearly zero "Within a few months after that domain moves to DMARC enforcement." There has been a steady increase in organizations using Domain-based Message Authentication, Reporting, and Conformance as a security measure against domain spoofing but enforcement continues to be the main struggle for most enterprises.
Nearly 80 percent of US federal government domains have DMARC records and of those 93%. These high numbers are due mostly to a Department of Homeland Security directive in 2017 mandating DMARC at enforcement for most executive branch domains by January 2018.
Banks, financial services companies and billion-dollar companies also had relatively high numbers of primary domains with DMARC records, with most hovering around 50%. But with enforcement, these industries lagged behind with percentages between 20% and 35%. SEE: How some presidential campaigns use DMARC to protect their domains from being spoofed.
"But publishing a DMARC record is just the first step - enforcement must be reached before a domain is protected, and trust can be restored to email. There's an additional downside to not getting to enforcement: Our research demonstrates that domains without DMARC policies at enforcement are spoofed nearly four times more often compared to domains with DMARC at enforcement. This is because fraudsters give up trying to spoof a domain once they realize it doesn't work, and move on to easier targets."
The report added that in addition to near total decreases in the rate of fraudulent activity for domains within a few months of getting enforcement, Tweney found that domains without DMARC enforcement were spoofed 3.93 times more often compared with domains at DMARC enforcement.