Stress Testing the DMARC Reporting System: Compliance with Standards and Ways of Improvement

The DMARC reporting system enables domain name owners to receive failure and aggregate reports from email receivers to get insight into email authentication failures or unauthorized domain usage and take measures against phishing and spoofing attacks. In this paper, we test DMARC reporting of main Email Service Providers (ESPs) and show that most of them do not comply with the RFC specification, especially with respect to the generation of failure reports and external destination verification. We also analyze more than 40,000 DMARC aggregate reports and show that 94.93% of them do not follow the correct report syntax defined in RFC 7489. Finally, we provide recommendations for improving the DMARC reporting strategy.