Introduction
Despite years of DMARC awareness, exact-domain spoofing remains one of the most common phishing techniques. The reason isn't technical — it's adoption. Most domains still aren't at enforcement, and attackers know which.
Why this topic matters
Brand-impersonation phishing relies on exact-domain spoofing working. Every domain at p=none or unconfigured is a target; every domain at p=reject isn't.
Why exact-spoofing still works
Three structural factors:
- Most domains aren't at enforcement. Recent surveys suggest <30% of domains globally are at
p=reject. The other 70%+ are exploitable. - Attackers target the unprotected. Brand-impersonation phishing specifically picks domains with weak DMARC.
- Reputation transfers. Sending fake mail from a recognized brand inherits the brand's trust signal.
What "still a major risk" means
For an attacker:
- Identify a target brand.
- Check DMARC posture (DNS lookup).
- If
p=noneor unconfigured, send brand-impersonation phishing. - Volume matters: a single campaign can target millions.
The attack costs $0 in infrastructure. The defender's cost — the rollout to p=reject — is bounded but real.
The asymmetry DMARC creates
At p=reject:
- Attacker cost to spoof your domain: infinite. Operationally impossible at major providers.
- Your cost to maintain: weekly report review.
Pre-p=reject:
- Attacker cost: $0.
- Your cost: incident response when the attack lands.
The asymmetry strongly favours rolling out.
Step-by-step approach
- Audit current DMARC posture.
- If at
p=none, set a date forp=reject. - Complete the rollout.
- Maintain steady-state monitoring.
Best practices
- Don't underestimate the threat. Brand-impersonation phishing is industrialized.
- Treat DMARC as fraud prevention. Frame for business stakeholders.
- Pair with BIMI for visible signaling.
- Train users on the residual threats DMARC doesn't address.
- Renew posture annually.
Recommended next step
If your domain is at p=none, every day is a day attackers can target you. Setting a date for p=reject is the start of closing the window.
FAQ
How widespread is exact-domain spoofing?
Majority of brand-impersonation phishing relies on it. APWG reports consistently.
Does the attacker need any special tools?
No. Standard SMTP is sufficient.
Why don't more domains deploy DMARC?
Mostly organizational inertia, not technical difficulty.
Will the attack vector decline as DMARC adoption rises?
Yes, gradually. Adoption is rising; the attack window is shrinking. But slowly.
What about IDN homograph attacks?
Not addressed by DMARC. Need brand-monitoring service.
Final thoughts
Exact-domain spoofing persists because most domains haven't deployed DMARC at enforcement. The asymmetry favors defenders who finish the rollout.
Don't be the brand that finds out the hard way.