Findings show critical security gap: Millions adopt email authentication but 50% lack effective protection against spoofing
SAN FRANCISCO, Calif. – Valimail, the leading provider of email authentication and anti-impersonation solutions, today released its 2025 Disinformation and Malicious Email Report, revealing that email continues to be the most exploited attack vector for cybercriminals and disinformation campaigns, with artificial intelligence dramatically increasing the sophistication of these threats.
In an era marked widespread disinformation, trust in digital communications is eroding. Malicious actors are increasingly exploiting email to impersonate brands, launch phishing campaigns, and spread false information—often using sophisticated methods made simpler by emerging technologies. This environment calls for a layered approach to email protection.
Email authentication is the foundational, cost-effective defense that can significantly curb many of these malicious attempts at their source, providing future-proof protection that can scale. Additionally, DMARC uniquely protects outbound email to partners and clients thereby offering brand and compliance protection.
The report reveals considerable variation in email authentication implementations across industries:
- Online Retail leads with 94% of surveyed domains having implemented basic email authentication measures.
- Financial Services shows strong adoption (80%) but one-third of domains lack enforcement policies that actually prevent spoofing.
- Higher Education faces significant challenges with nearly two-thirds of domains unable to prevent impersonation attacks.
- Healthcare lags behind with just over one third having implemented the bare minimum, non-protective DMARC policy of p=none.
- Information Technology shows concerning gaps with nearly a third of surveyed domains lacking the ability to prevent the use of their domain name in spoofed email messages.
“In 2024, we witnessed some of the most sophisticated email-based attacks in history,” said Al Iverson, Industry Research and Community Engagement Lead at Valimail. “From North Korean targeting of vulnerable domains to widespread supply chain attacks on U.S. municipalities and general attacks on educational institutions, cybercriminals are exploiting weaknesses in email systems with increasing precision, eroding trust in digital communications.”
Several alarming trends are highlighted within the report, including:
- Rising threat sophistication: AI-generated emails more than ever now convincingly mimic legitimate communications, dramatically increasing the success rate of phishing and spoofing attacks.
- Cross-industry vulnerability: Every sector from financial services to healthcare, government, and education faces significant email-based threats, with varying levels of preparedness.
- Protection gap: While more than 7.2 million domains have implemented some form of email authentication, approximately half remain insufficiently protected against domain spoofing.
Despite these growing threats, the report shows that Domain-based Message Authentication, Reporting, and Conformance (DMARC) continues to be a highly effective approach that can authoritatively prevent the most pernicious spoofing attacks when properly implemented.
“What’s particularly concerning is that while many organizations have taken initial steps toward securing their email domains, a significant percentage have implemented overly permissive or non-protective policies,” added Valimail Co-Founder and CEO Alexander García-Tobar. “This creates a false sense of security while leaving these organizations vulnerable to impersonation attacks that can damage reputation, erode customer trust, and compromise sensitive information.”
Industry, government, and regulatory bodies worldwide are increasingly mandating DMARC compliance for industries handling sensitive data, such as finance and healthcare. Major email providers like Google, Yahoo and Microsoft require email senders to implement DMARC, improving deliverability and reputation for compliant organizations. Failing to comply with DMARC mandates can result in penalties, reduced deliverability, and reputational damage.
Valimail offers free resources for organizations to check their email security status through the Valimail DMARC Checker and provides DMARC reporting visibility through its Monitor solution.
The full “2025 Disinformation and Malicious Email Report” can be accessed at https://www.valimail.com/resources/reports/2025-disinformation-and-malicious-email-report-why-dmarc-remains-pivotal/.
About Valimail
Valimail is the global leader in Zero Trust email authentication and invented hosted DMARC in 2015 and DMARC-as-a-service in 2021. In use by 80,000 companies globally, the company’s full line of cloud-native solutions authenticate sender identity to stop phishing, protect brands, and ensure compliance. From neighborhood shops to the world’s largest brands, many organizations use these solutions to secure their emails. Valimail holds the most robust portfolio of 20 patents that unlock DMARC for businesses at scale and is the only DMARC solution to earn FedRAMP authorization. Valimail employees Chair and co-Chair many critical ecosystem bodies, such as the IETF DMARC Working Group, and the AuthIndicators Working Group developing BIMI. The premier DMARC partner for Microsoft 365 environments, Valimail also holds leadership positions on every key industry standards body, driving today’s email authentication policies and tomorrow’s cybersecurity advancements for everyone. For more information, please visit www.valimail.com.
