Fake Email Threatens Media Companies Just As Much As Fake News

Media companies face a uniquely difficult landscape. Over the past decade, they’ve had to adapt to rapidly changing media technologies, while battling declining advertising revenues and shrinking subscription lists. For some companies, it’s hard enough to keep the lights on, let alone secure their IT systems.

So it’s not surprising most media organizations have overlooked a key aspect of their cybersecurity infrastructure: Email authentication.

That’s a particular problem in the era of “fake news” claims, because it leaves media companies open to fraud. In short: It’s far too easy for outsiders to send fake email that appears to come from these companies.

ValiMail analyzed the primary domains for 610 media companies with revenues of at least $50 million annually. Using data that is publicly available through the Domain Name System (DNS), we checked for the existence of DMARC (Domain-based Message Authentication, Reporting, & Conformance) and SPF (Sender Policy Framework) records. We then analyzed these records for completeness, correctness, and effectiveness.

The conclusion: Media companies lag substantially behind other industries in their implementation of DMARC. Only 78 out of 610 companies had published a DMARC record at all. Of those, just 17 had set it to a policy of enforcement, which directs receiving mails servers to delete or quarantine messages that fail authentication.

Pie chart showing 87.2% with no DMARC, 2.5% with invalid DMARC, 7.5% with valid DMARC, not enforced, and 2.8% protected by DMARC

This is a success rate at getting to enforcement (as a percentage of all companies attempting DMARC) of 21.8 percent. But the overall rate of DMARC enforcement in the industry is just 2.8 percent.

In other words, 97.2 percent of media companies worldwide remain vulnerable to impersonation or “spoofing” by email fraudsters using their domain names illicitly.

For more detail, check out our full report: After Fake News, Here Comes Fake Email. It has a wealth of detail on how media companies worldwide are doing with respect to email authentication, which types of companies are doing better, and which countries are showing leadership.

Dylan Tweney is the VP of research and communications for Valimail. Formerly, Dylan was the founder of Tweney Media, a content-driven communications agency, whose clients included Samsung, Korn Ferry International, Upwork, YL Ventures, Bloomberg Beta, and Valimail.

Previous to that, he was the editor-in-chief of VentureBeat (2011-2015) and a senior editor at Wired (2007-2011).