80 percent of business email domains lack DMARC protections in place

250ok’s new Global DMARC Adoption report, found that over 80% of business email domains lack DMARC protection. After analyzing 25,700 domains in the education, e-commerce, legal, financial services, SaaS and nonprofit sectors, as well as the Fortune 500, U.S. government and China Hot 100 sectors. The findings showed that the majority lacked Domain-based Message Authentication, Reporting and Conformance (DMARC) policies; DMARC is considered the industry standard for email authentication to prevent attacks where adversaries are sending mails with spoofed addresses.

By enabling DMARC on an email domain, companies lower the odds of their domains being spoofed and used for phishing attacks.

“Given the information available on the risks associated with leaving your domain unprotected, it’s shocking the number of brands that still don’t understand the importance of DMARC,” said Matthew Vernhout, director of privacy at 250ok, in the report. “Until we reach a place where email receivers require proper authentication on all emails, including DMARC implementation, the onus is on brand leaders to keep their customers and employees safe from phishing.”

Global DMARC Adoption 2019 (21,075 domains)

When a DMARC policy is enabled is is designed to be incremental, it will likely start with a simple reporting only policy, that can be gradually increased to block or quarantine messages that fail a DMARC check from reaching the intended recipient.

In the early reporitng phase when DMARC is first implemented, a company will receive daily aggregate DMARC reports from email hosting providers showing the number of messages they’ve seen using their domains, how many messages passed or failed authentication and the authentication results of the mail.

Once the reporting phase is completed, the next step is quarantine where mail be routed to the spam/quarantine/junk folder. And for the most aggressive set-up under DMARC, domains can choose to use a reject policy, which will stop mail that fails authentication from even being accepted by the receiving email provider. Using DMARC along with our spam protection will help reduce the risk of business email compromise (BEC).

DMARC Adoption by Industry Sectors

Internet Retailers DMARC Adoption 2019 (3,033 domains)

Internet retailers are increasing adoption of DMARC on their domains with a general push for DMARC support from their email service providers.

FORTUNE 500 DMARC Adoption 2019 (1,780 domains)

Only 23 percent of companies in the Fortune 500 have some form of DMARC policy despite being the largest organizations in terms of revenue.

FORTUNE 500 DMARC Adoption 2019 (1,780 domains)

Only 23 percent of companies in the Fortune 500 have some form of DMARC policy despite being the largest organizations in terms of revenue.

LAW FIRMS DMARC Adoption 2019 (100 domains)

Law firms had the greatest increase in overall adoption from 2018 to 2019, with a 19 percent increase.

DMARC Adoption of Law Firms when compared to 2018

As one of the best performing sectors when it comes to DMARC adoption, the percentages below show how much it has increased from last year.

NONPROFIT ORGANIZATIONS DMARC Adoption 2019 (7,300 domains)

With 9 out 10 NPO domains failing to adopt DMARC for their email systems, this part of the market is mostly not embracing DMARC as a policy to combat email phishing and spoofing. The chart below looks at USA based NPO’s.

Comparing NPOs around the world

A look at NPOs from the UK, US, Canada and Australia that are not implementing a DMARC policy.

FINANCIAL SERVICES DMARC Adoption 2019 (2,186 domains)

A look of DMARC records at over 2000 of the top financial services in the United States found that over 70% of firms had no DMARC policy in place.