DMARC Implementation: Baby Steps

April 13, 2017

By Shehzad Mirza


GCA published statistics in February regarding the utilization of DMARC amongst the companies exhibiting at RSA Conference in San Francisco.  The results were alarming, and honestly, disappointing:

Only 15 percent of the 587 email domains (that were scanned) for companies exhibiting at the RSA Conference — one of the world’s largest gatherings of cyber security experts — use DMARC. Of the 90 RSA exhibiting organizations that do use DMARC, more than 66 percent use the DMARC policy of “none,” which only monitors for email domains, greatly reducing the effectiveness of DMARC.

As a result, GCA issued a call to action for the security community to implement DMARC and lead by example.

After approximately two months, GCA’s follow-up research indicates that the number of companies exhibiting at RSA Conference using DMARC increased by two percent, to 98 companies.  Of those 98, 69 percent are using the DMARC policy of “none,” which only monitors the email domains.  The DMARC policy of “none” is a starting point in confirming that the configuration is correct before moving to a higher DMARC policy level.  Additionally, four organizations moved from either no implementation or the DMARC policy of “none” to the mid-level DMARC policy of “quarantine.” Two organizations moved from the DMARC policy of “quarantine” to the highest level DMARC policy of “reject.”

While a slow start, the word has gotten out, and we hope that the adoption of DMARC will continue throughout the year within the cyber security community. We will continue to monitor progress and support where needed with additional education, awareness, resources, tools, and guidance.

About DMARC

DMARC (Domain­-based Message Authentication, Reporting & Conformance) is an open source, email authentication protocol, which includes a reporting function that allows senders and receivers to improve and monitor protection of the domain from fraudulent email. In short, it will give your organization an added layer of protection against phishing attacks.  Learn more at dmarc.globalcyberalliance.org or by attending one of our monthly DMARC webinars.

About The Global Cyber Alliance

The Global Cyber Alliance (GCA) is an international, cross-sector effort dedicated to confronting cyber risk and improving our connected world. It is a catalyst to bring communities of interest and affiliations together in an environment that sparks innovation with concrete, measurable achievements. While most efforts at addressing cyber risk have been industry, sector, or geographically specific, GCA partners across borders and sectors. GCA’s mantra “Do Something. Measure It.” is a direct reflection of its mission to eradicate systemic cyber risks.

GCA, a 501(c)3, was founded in September 2015 by the Manhattan District Attorney’s Office, the City of London Police and the Center for Internet Security. Learn more at www.globalcyberalliance.org.

The author, Shehzad Mirza, is the Deputy Director of Operations (NYC Office) at the Global Cyber Alliance. You can connect with Shehzad on LinkedIn.