Three billion emails sent in 2020 showed signs of sender fraud

The use of DMARC, which helps prevent phishing attacks, is on the rise, says report

email symbols over a man's hands

Three billion emails last year showed signs of spoofing activity, according to a report released today. 

The Email Fraud Landscape Spring 2021 report from email security company Valimail found that intruders are still targeting email domains that don't use a common protocol called Domain-based Message Authentication, Reporting, and Conformance (DMARC). DMARC is a tool to help organizations protect themselves against email spoofing.

DMARC is an email authentication protocol that lets a domain owner confirm that their email is legitimate with a recipient. That prevents domain spoofing, in which an attacker pretends to send an email from someone's domain. Domain spoofing is a common technique in phishing campaigns, where an attacker will impersonate a victim by sending emails in their name.

Domains without DMARC protection are 4.75 times more likely to be spoofing targets than domains with DMARC enabled, the report added.

Valimail analyzed data from DMARC aggregate reports that it collected on behalf of its customers last year. The analysis showed that at least 1% of global email traffic contains suspicious sender activity that’s probably fraudulent. That amounts to three billion messages, the company estimated.

On the plus side, the number of emails likely to be spoofed is falling. In 2017, around 5% of all emails showed suspicious activity, although that was due to an unusually high-volume campaign that hit media organizations that year, the company said. Suspicious activity fell to just over 2% in 2019.

This decrease is due in part to the number of domains using DMARC, Valimail said. In January 2017, around 125,000 domains used the protocol. By January 2020, that had risen to almost 1 million, and it continues to increase. The figure currently stands at 1.28 million domains.

Related Resource

Remote workforce security report

Key challenges, security threats, and investment priorities of organisations during the pandemic

remote workforce security report - whitepaper from OktaDownload now

Simply enabling DMARC is only a partial solution, warns the report, pointing out that only 14.8% of domains with DMARC are protected from spoofing by an enforcement policy. An enforcement policy dictates what a recipient should do with an incoming email purportedly from a domain but doesn't pass the necessary DMARC authentication checks. Larger for-profit and government organizations are more likely to take advantage of this, with 43.4% of them using policy-based enforcement.

The US federal government is the best performer when it comes to DMARC usage, with three-quarters of its domains using it and 78% using an associated policy. That's due to a 2017 directive from the Department of Homeland security mandating enforcement for all executive-branch domains other than those connected to intelligence and defense. Conversely, global media companies and US health care firms have the lowest protection rates.

While it’s a powerful anti-phishing tool, DMARC doesn't protect against all types of domain fraud. The use of “cousin” domain spoofing, when attackers create domains that look like legitimate ones, is still rife and targets organizations, including the FBI.

Featured Resources

Modern governance: The how-to guide

Equipping organisations with the right tools for business resilience

Free Download

Cloud operational excellence

Everything you need to know about optimising your cloud operations

Watch now

A buyer’s guide to board management software

Improve your board’s performance

The real world business value of Oracle autonomous data warehouse

Lead with a 417% five-year ROI

Download now

Recommended

Education and government most at risk from email threats
phishing

Education and government most at risk from email threats

26 Nov 2021
Hackers use Linux backdoor on compromised e-commerce sites with software skimmer
malware

Hackers use Linux backdoor on compromised e-commerce sites with software skimmer

19 Nov 2021
Iranian hackers ramp up attacks against IT services sector
hacking

Iranian hackers ramp up attacks against IT services sector

19 Nov 2021
TikTok phishing campaign tried to scam over 125 influencer accounts
social media

TikTok phishing campaign tried to scam over 125 influencer accounts

18 Nov 2021

Most Popular

Dell XPS 15 (2021) review: The best just got better
Laptops

Dell XPS 15 (2021) review: The best just got better

14 Jan 2022
Sony pulls out of MWC 2022
Business operations

Sony pulls out of MWC 2022

14 Jan 2022
UK businesses urged to join four-day working week trial
Business operations

UK businesses urged to join four-day working week trial

17 Jan 2022