Phishing Risk – Domain Registrars

Email Fraud and Phishing is a huge risk for both consumers and businesses.  In 2019, the FBI estimated that people lost over $57M to email fraud and phishing attacks.  Fortunately, there are ways to protect yourself and your business.

Inbox Protection

For consumers and businesses, being vigilant in recognizing the potential for fraud and phishing via email is important.  The FTC has created good guidelines to help you recognize inbound email phishing and you can read more about recognizing phishing on MxToolbox’s Blog.  Unfortunately, people are pretty bad at recognizing phishing emails, so depending on your users to protect your business from phishing scams is not enough, you need technological assistance.

Inbox Provider Protection

Your email inbox provider is trying to protect you from fraud and phishing emails by using DMARC as a decision criteria for inbox placement.  DMARC does three important things for email senders:

  1. Obtain feedback on how much of your email is passing SPF, DKIM and DMARC checks
  2. Obtain forensic examples of failed emails
  3. Set a policy for how Inbox Providers handle email that fails DMARC checks

A sender using DMARC is therefore more likely to manage email delivery and less likely to be a source of spam, malware, fraud or phishing.   Senders can even instruct Inbox Providers to Reject email that fails DMARC compliance checks.  Inbox providers then protect their users from fraud and phishing by prioritizing DMARC compliant email.

Vendor Sender Protection

A Vendor that sets up and maintains DMARC and sends DMARC compliant email will protect its own brand from being used in fraud and phishing emails and protect the recipients of their email.  Therefore, it is important to check the DMARC status of any potential vendors.  

In this on-going series, MxToolbox will report upon the DMARC status of key service areas.  Today:

Domain Registrars – Do they protect their customers from fraud and phishing?

TLDR:  Some, not all. 

DMARC adoption by the top 30 domain registrars is currently ahead of the Alexa 1000 and the Fortune 500, but not complete.  With 30% of Domain Registrars not adopting DMARC yet, there is a lot of room for improvement.  In addition, only 21% of Domain Registrars have adopted strict Reject DMARC policies to protect their customers from fraud and phishing attempts using the registrars domain. 

The Risk

If a Domain Registrar has not adopted DMARC and more secure DMARC Reject policies, the risk of their domain being used in fraud and phishing emails is particularly high.  If a single email slips through your mental filter, a fraudster could gain your legitimate credentials to your domain registrar and make potentially fatal changes to your domain setup.  For example:

  • Redirecting traffic from your website to theirs
  • Setting up a phishing website in a subdomain of your own domain to gain your customers information
  • Changing your SPF record to include their IP addresses to further the email phishing scam
  • All of the above.

Domain Registrars are a critical component of e-commerce.  If they are not protecting themselves from being used in fraud and phishing attacks, they put their customer businesses at risk.

The Solution

There are a few simple ways to protect your business from fraud and phishing by vendors:

  • Check any vendor you do business with for a DMARC record.  
  • Prioritize vendors with DMARC policies set to Reject.
  • If you are tied to a vendor who has not adopted DMARC, it’s time to pressure them to do so.
  • Adopt DMARC for your own email communications.

How can you adopt DMARC?

Adopting DMARC is a multi-step process requires on-going management.

  1. Setup SPF record to include all your known senders
  2. Setup DKIM signatures at all your known senders
  3. Create a DMARC record to get feedback on your email
  4. Identify new legitimate sources of email from the DMARC reports and add them to your SPF and DKIM setups
  5. Identify fraud and phishing from DMARC reports and warn your users and email recipients.
  6. Gradually adopt restrictive policies once you have identified all legitimate sources of email using your domain name

Repeat steps 4 and 5 regularly as you may add and remove systems and vendors that send email on behalf of your domain.  In addition, DMARC reports can be difficult to read, particularly when you have a large volume of email.  Investing in a partner to help you on your DMARC journey is important. 

MxToolbox Delivery Center

To maintain the highest levels of email deliverability, businesses like yours need a proven Email Delivery management system like MxToolbox Delivery Center.  Delivery Center provides you with valuable insight into your email delivery posture and the ongoing maintenance necessary to maintain peak performance:

  • Manage SPF, DKIM, and DMARC (and BIMI) to improve compliance and reduce the threat of fraud and phishing using your domain.
  • Review daily volume and SPF, DKIM, and DMARC compliance rates to ensure the best email deliverability.
  • Implement Feedback Loops to gain unique information on how your recipients view your emails and when they mark you as spam.
  • Gradually move your DMARC policy to Reject to enable better inbox placement opportunities.
  • Manage the on-going requirements of maintaining high levels of email deliverability