One Year Later: Federal Mandate for Email Authentication Huge Success

Responding to BOD 18-01, agencies rally to complete the fastest sector-wide adoption of DMARC 

One year ago, the Department of Homeland Security announced its Binding Operational Directive 18-01, a mandate for all federal executive branch domains to implement stronger security standards. Specifically, BOD 18-01 required the adoption of HTTPS and DMARC, an email authentication standard that prevents domain spoofing.

When BOD 18-01 was announced in October 2017, Agari determined that only about 18 percent of federal domains had adopted DMARC, and less than ten percent had implemented a reject policy.

Today, that negative image has become a positive; 85% of federal domains have adopted DMARC and at least 74% have implemented a reject policy. You can see the results for yourself below:

Federal DMARC adoption rates as of 10/15/2018

Active Domains vs Defensive Domains

BOD 18-01 has clearly made a positive impact on the cybersecurity posture of the United States government. It’s really great to see such a dramatic increase in adoption in such a short time frame. This is the fastest and most complete adoption of the DMARC standard for any industry in history. Private enterprise is definitely lagging behind the public sector now, but we will explore those concerns in some future research.

One consideration to keep in mind is that among the 278 domains that are out of compliance with BOD 18-01, only 28 of them are defensive domains – which means that they are not actively sending email. That means that 90 percent of the domains that need to implement p=reject have an active email ecosystem. We predicted this could be a roadblock to compliance in our September update, which seems to have been the case.
 

Winners vs Laggards

In total, there were 46 federal executive branch agencies that reached full   of “p=reject.” Conversely, there were 57 federal executive branch agencies that still have no DMARC record or have not moved beyond the “p=none” monitoring policy. In both cases, the majority of these agencies were only managing one or two domains.

We should recognize the following agencies for reaching full implementation of a “p=reject” policy across many multiples of domains: Consumer Product Safety Commission, Federal Reserve Board of Governors, Federal Trade Commission, Office of Personnel Management and United States Postal Service.

Many of the larger agencies have also made tremendous progress, with adoption rates that helped raise the average, including Corporation for National & Community Service, Department of Education, Department of Energy, Department of Health and Human Services, Department of Homeland Security, Department of Housing and Urban Development, Department of Justice, Department of the Interior, Department of the Treasury, Department of Transportation, Environmental Protection Agency, General Services Administration and National Archives and Records Administration.

The full list of agency adoption rates follow.
 

Federal DMARC adoption rates by agency as of 10/15/2018

^[1] Note that over the course of the year, some agencies have decommissioned domains that are no longer in use, some of which may appear in this category.

^[2] Note that over the course of the year, some agencies have decommissioned domains that are no longer in use, some of which may appear in this category.