Evaluating E-Mail Domain Protection System Adoption by Croatian Financial Institutions

This paper investigates the implementation and effectiveness of email authentication protocols: Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting & Conformance (DMARC) within Croatian financial institutions. Email-based threats, including phishing and spoofing, are particularly severe in financial sectors, making strong email authentication essential. This study offers a comprehensive evaluation of the adoption and configuration of these protocols across major financial domains, revealing both strengths and weaknesses in current practices. Our analysis found that SPF is the most widely adopted protocol, while DKIM and DMARC adoption rates vary, with few institutions enforcing a “reject” policy for unauthenticated emails. Additionally, common configuration errors, such as DNS misconfigurations and inconsistent key management, are prevalent, reducing the effectiveness of these protocols.