82% of U.S. Campaign Domains Failed to Enforce DMARC

Eighty-two percent of 3,756 U.S. political campaign domains were not configured to enforce DMARC, according to research from DigiCert and Valimail conducted four weeks before the midterm elections.

DMARC lets domain owners tell receiving mail systems how to handle messages that fail authentication. The researchers found 43.6 percent of campaign domains had no DMARC record, while 38.4 percent used monitoring mode, which observes spoofing but does not instruct inboxes to reject or quarantine it.

Gubernatorial campaigns performed best, though only 31.6 percent enforced the standard. State legislative campaigns were lowest at 13.3 percent. Without enforcement, attackers can more easily send messages that appear to come from a candidate's domain.

DMARC is not a complete phishing defense and does not stop lookalike domains, but enforcement removes a common impersonation path. Campaigns should deploy SPF and DKIM correctly, move DMARC from monitoring to quarantine or reject, and watch for newly registered lookalikes.