wiredepth
Run a check

Which government brands can be spoofed in email?

Government domains are the most-impersonated brands globally - tax-refund scams, package-customs scams, immigration scams. The big national agencies have generally moved to DMARC enforcement; the long tail of agencies, sub-departments, and state / municipal sites lags behind.

Spoofable

1 (6%)

No DMARC, or DMARC at p=none. Anyone can send from these domains.

Partial protection

1 (6%)

DMARC at p=quarantine, or p=reject with pct<100. Spoofed mail may slip through.

Not practically spoofable

16 (89%)

DMARC p=reject pct=100 + SPF -all or DKIM. Spoofed mail rejected at SMTP.

BrandDomainVerdict
CRA (Canada)canada.caSpoofableSee the math →
US Treasurytreasury.govMaybeSee the math →
Australian Taxation Officeato.gov.auProtectedSee the math →
CDCcdc.govProtectedSee the math →
CISAcisa.govProtectedSee the math →
DHSdhs.govProtectedSee the math →
European Commissionec.europa.euProtectedSee the math →
FBIfbi.govProtectedSee the math →
FCCfcc.govProtectedSee the math →
FTCftc.govProtectedSee the math →
Federal Reservefederalreserve.govProtectedSee the math →
GOV.UKgov.ukProtectedSee the math →
HM Revenue & Customshmrc.gov.ukProtectedSee the math →
IRSirs.govProtectedSee the math →
NASAnasa.govProtectedSee the math →
SECsec.govProtectedSee the math →
USPSusps.comProtectedSee the math →
White Housewhitehouse.govProtectedSee the math →

Other categories

What does "spoofable" actually mean?

A domain is spoofable when a third party can send mail FROM addresses at that domain (e.g. [email protected]) and have it land in inboxes. The mechanism that prevents this is DMARC enforcement combined with SPF and DKIM. Without all three, receivers have no policy to apply against unauthorised senders.

Want the same check on your own domain? Run the free Spoofability check.

This category last scored: .