Three billion emails sent in 2020 showed signs of sender fraud

The use of DMARC, which helps prevent phishing attacks, is on the rise, says report

email symbols over a man's hands

Three billion emails last year showed signs of spoofing activity, according to a report released today. 

The Email Fraud Landscape Spring 2021 report from email security company Valimail found that intruders are still targeting email domains that don't use a common protocol called Domain-based Message Authentication, Reporting, and Conformance (DMARC). DMARC is a tool to help organizations protect themselves against email spoofing.

DMARC is an email authentication protocol that lets a domain owner confirm that their email is legitimate with a recipient. That prevents domain spoofing, in which an attacker pretends to send an email from someone's domain. Domain spoofing is a common technique in phishing campaigns, where an attacker will impersonate a victim by sending emails in their name.

Domains without DMARC protection are 4.75 times more likely to be spoofing targets than domains with DMARC enabled, the report added.

Valimail analyzed data from DMARC aggregate reports that it collected on behalf of its customers last year. The analysis showed that at least 1% of global email traffic contains suspicious sender activity that’s probably fraudulent. That amounts to three billion messages, the company estimated.

On the plus side, the number of emails likely to be spoofed is falling. In 2017, around 5% of all emails showed suspicious activity, although that was due to an unusually high-volume campaign that hit media organizations that year, the company said. Suspicious activity fell to just over 2% in 2019.

This decrease is due in part to the number of domains using DMARC, Valimail said. In January 2017, around 125,000 domains used the protocol. By January 2020, that had risen to almost 1 million, and it continues to increase. The figure currently stands at 1.28 million domains.

Related Resource

Remote workforce security report

Key challenges, security threats, and investment priorities of organisations during the pandemic

remote workforce security report - whitepaper from OktaDownload now

Simply enabling DMARC is only a partial solution, warns the report, pointing out that only 14.8% of domains with DMARC are protected from spoofing by an enforcement policy. An enforcement policy dictates what a recipient should do with an incoming email purportedly from a domain but doesn't pass the necessary DMARC authentication checks. Larger for-profit and government organizations are more likely to take advantage of this, with 43.4% of them using policy-based enforcement.

The US federal government is the best performer when it comes to DMARC usage, with three-quarters of its domains using it and 78% using an associated policy. That's due to a 2017 directive from the Department of Homeland security mandating enforcement for all executive-branch domains other than those connected to intelligence and defense. Conversely, global media companies and US health care firms have the lowest protection rates.

While it’s a powerful anti-phishing tool, DMARC doesn't protect against all types of domain fraud. The use of “cousin” domain spoofing, when attackers create domains that look like legitimate ones, is still rife and targets organizations, including the FBI.

Featured Resources

Choosing a collaboration platform

Eight questions every IT leader should ask

Download now

Performance benchmark: PostgreSQL/ MongoDB

Helping developers choose a database

Download now

Customer service vs. customer experience

Three-step guide to modern customer experience

Download now

Taking a proactive approach to cyber security

A complete guide to penetration testing

Download now

Recommended

eBay, Apple, Microsoft, Facebook, and Google were phishers’ top targets in 2020
phishing

eBay, Apple, Microsoft, Facebook, and Google were phishers’ top targets in 2020

20 Apr 2021
HackBoss malware is using Telegram to steal cryptocurrency from other hackers
cryptocurrencies

HackBoss malware is using Telegram to steal cryptocurrency from other hackers

16 Apr 2021
Biden looks to shore up the electrical grid’s cyber security
Security

Biden looks to shore up the electrical grid’s cyber security

15 Apr 2021

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

8 Apr 2021
UK exploring plans to launch its own digital currency
digital currency

UK exploring plans to launch its own digital currency

19 Apr 2021