Work

Stress Testing the DMARC Reporting System: Compliance with Standards and Ways of Improvement

Year: 2024

Type: conference-paper

Abstract: The DMARC reporting system enables domain name owners to receive failure and aggregate reports from email receivers to get insight into email authentication failures or unauthorized domain usage and take measures against phishing and spoofing attacks. In this paper, we test DMARC reporting of main Email Service Providers (ESPs) and show that most of them do not comply with the RFC specification, especially with respect to the generation of failure reports and external destination verification. We also analyze more than 40,000 DMARC aggregate reports and show that 94.93% of them do not follow the correct report syntax defined in RFC 7489. Finally, we provide recommendations for improving the DMARC reporting strategy.

Source: ACM International Conference on emerging Networking EXperiments and Technologies (CoNEXT)

DOI: 10.1145/3680121.3697809

Authors: Olivier Hureau, Andrzej Duda, Maciej Korczyński

Institutions: Institut polytechnique de Grenoble, Centre National de la Recherche Scientifique, Laboratoire d'Informatique de Grenoble

Language: English

Topic: Spam and Phishing Detection

Subfield: Information Systems

Field: Computer Science

Domain: Physical Sciences

Open Access status: green

Funder: Agence Nationale de la Recherche

Awards: G2121614283, G292453335, G3010527862, Systemes et Algorithmes Pervasifs au confluent des mondes physique et numérique, DNS Naming and Services for Secure Seamless IoT