Three billion emails sent in 2020 showed signs of sender fraud

Three billion emails last year showed signs of spoofing activity, according to a report released today.

The Email Fraud Landscape Spring 2021 report from email security company Valimail found that intruders are still targeting email domains that don't use a common protocol called Domain-based Message Authentication, Reporting, and Conformance (DMARC). DMARC is a tool to help organizations protect themselves against email spoofing.

DMARC is an email authentication protocol that lets a domain owner confirm that their email is legitimate with a recipient. That prevents domain spoofing, in which an attacker pretends to send an email from someone's domain. Domain spoofing is a common technique in phishing campaigns, where an attacker will impersonate a victim by sending emails in their name.

Domains without DMARC protection are 4.75 times more likely to be spoofing targets than domains with DMARC enabled, the report added.

Valimail analyzed data from DMARC aggregate reports that it collected on behalf of its customers last year. The analysis showed that at least 1% of global email traffic contains suspicious sender activity that’s probably fraudulent. That amounts to three billion messages, the company estimated.

On the plus side, the number of emails likely to be spoofed is falling. In 2017, around 5% of all emails showed suspicious activity, although that was due to an unusually high-volume campaign that hit media organizations that year, the company said. Suspicious activity fell to just over 2% in 2019.

This decrease is due in part to the number of domains using DMARC, Valimail said. In January 2017, around 125,000 domains used the protocol. By January 2020, that had risen to almost 1 million, and it continues to increase. The figure currently stands at 1.28 million domains.

Simply enabling DMARC is only a partial solution, warns the report, pointing out that only 14.8% of domains with DMARC are protected from spoofing by an enforcement policy. An enforcement policy dictates what a recipient should do with an incoming email purportedly from a domain but doesn't pass the necessary DMARC authentication checks. Larger for-profit and government organizations are more likely to take advantage of this, with 43.4% of them using policy-based enforcement.

The US federal government is the best performer when it comes to DMARC usage, with three-quarters of its domains using it and 78% using an associated policy. That's due to a 2017 directive from the Department of Homeland security mandating enforcement for all executive-branch domains other than those connected to intelligence and defense. Conversely, global media companies and US health care firms have the lowest protection rates.

While it’s a powerful anti-phishing tool, DMARC doesn't protect against all types of domain fraud. The use of “cousin” domain spoofing, when attackers create domains that look like legitimate ones, is still rife and targets organizations, including the FBI.