Three billion emails sent in 2020 showed signs of sender fraud

The use of DMARC, which helps prevent phishing attacks, is on the rise, says report

email symbols over a man's hands

Three billion emails last year showed signs of spoofing activity, according to a report released today. 

The Email Fraud Landscape Spring 2021 report from email security company Valimail found that intruders are still targeting email domains that don't use a common protocol called Domain-based Message Authentication, Reporting, and Conformance (DMARC). DMARC is a tool to help organizations protect themselves against email spoofing.

DMARC is an email authentication protocol that lets a domain owner confirm that their email is legitimate with a recipient. That prevents domain spoofing, in which an attacker pretends to send an email from someone's domain. Domain spoofing is a common technique in phishing campaigns, where an attacker will impersonate a victim by sending emails in their name.

Domains without DMARC protection are 4.75 times more likely to be spoofing targets than domains with DMARC enabled, the report added.

Valimail analyzed data from DMARC aggregate reports that it collected on behalf of its customers last year. The analysis showed that at least 1% of global email traffic contains suspicious sender activity that’s probably fraudulent. That amounts to three billion messages, the company estimated.

On the plus side, the number of emails likely to be spoofed is falling. In 2017, around 5% of all emails showed suspicious activity, although that was due to an unusually high-volume campaign that hit media organizations that year, the company said. Suspicious activity fell to just over 2% in 2019.

This decrease is due in part to the number of domains using DMARC, Valimail said. In January 2017, around 125,000 domains used the protocol. By January 2020, that had risen to almost 1 million, and it continues to increase. The figure currently stands at 1.28 million domains.

Related Resource

Remote workforce security report

Key challenges, security threats, and investment priorities of organisations during the pandemic

remote workforce security report - whitepaper from OktaDownload now

Simply enabling DMARC is only a partial solution, warns the report, pointing out that only 14.8% of domains with DMARC are protected from spoofing by an enforcement policy. An enforcement policy dictates what a recipient should do with an incoming email purportedly from a domain but doesn't pass the necessary DMARC authentication checks. Larger for-profit and government organizations are more likely to take advantage of this, with 43.4% of them using policy-based enforcement.

The US federal government is the best performer when it comes to DMARC usage, with three-quarters of its domains using it and 78% using an associated policy. That's due to a 2017 directive from the Department of Homeland security mandating enforcement for all executive-branch domains other than those connected to intelligence and defense. Conversely, global media companies and US health care firms have the lowest protection rates.

While it’s a powerful anti-phishing tool, DMARC doesn't protect against all types of domain fraud. The use of “cousin” domain spoofing, when attackers create domains that look like legitimate ones, is still rife and targets organizations, including the FBI.

Featured Resources

2021 Thales access management index: Global edition

The challenges of trusted access in a cloud-first world

Free download

Transforming higher education for the digital era

The future is yours

Free download

Building a cloud-native, hybrid-multi cloud infrastructure

Get ready for hybrid-multi cloud databases, AI, and machine learning workloads

Free download

The next biggest shopping destination is the cloud

Know why retail businesses must move to the cloud

Free Download

Recommended

Marsh McLennan reveals its cyber risk analytics center
risk management

Marsh McLennan reveals its cyber risk analytics center

15 Oct 2021
MirrorBlast phishing campaign targets financial companies
phishing

MirrorBlast phishing campaign targets financial companies

15 Oct 2021
Kaspersky exposes MysterySnail zero-day exploit in Windows
zero-day exploit

Kaspersky exposes MysterySnail zero-day exploit in Windows

13 Oct 2021
Supply chain breaches impacted 97% of firms in the past year
supply chain management (SCM)

Supply chain breaches impacted 97% of firms in the past year

12 Oct 2021

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans
Laptops

Apple MacBook Pro 15in vs Dell XPS 15: Clash of the titans

11 Oct 2021
Veritas Backup Exec 21.3 review: Covers every angle
backup software

Veritas Backup Exec 21.3 review: Covers every angle

14 Oct 2021