Email Authentication Posture of Iraqi Higher Education: A Passive DNS Census of University and College Domains

Abstract Sender-authentication mechanisms for email (SPF, DKIM and DMARC) are the only widely deployed defence against exact-domain spoofing of institutional email and are named as baseline countermeasures in International Telecommunication Union (ITU) guidance, yet their deployment in the higher-education sectors of developing countries has not been measured at census scale. We present the first complete census of email-authentication posture for Iraqi higher education: all 103 federally recognised universities and colleges with a resolvable official domain (36 public, 67 private). Measurement was strictly passive: MX, SPF, DKIM (fixed selector dictionary), DMARC and DNSSEC records were retrieved through two independent public resolvers, every raw answer was stored and timestamped, and no packet was sent to any institutional host. The primary outcome is a binary spoofability criterion; a study-specific 0–9 posture score is a secondary summary. Of the 103 domains, 93 (90.3%) are spoofable, only 10 enforce a DMARC policy and only 2 reach the highest grade. The finding is robust: bounding all 15 excluded or unmeasured institutions gives 78.8–91.5%, and the verdict does not depend on DKIM discovery. Posture is strongly structured by mail-provider concentration rather than by the public/private distinction: 89.3% of institutions, including every public one, receive mail on a single provider, 91.3% of those tenants are spoofable, and one third publish SPF records that omit the provider — a systemic weakness that is equally a single remediation channel. DNSSEC is nominal (13 signed zones, none with a DS record). A documented incident shows the operational cost: an official message from a sampled institution, failing DMARC under a monitoring policy, was filtered as spam. We relate the findings to Iraq's Tier 4 standing in the ITU Global Cybersecurity Index 2024 (Technical Measures 9.6 of 20) and report the responsible-disclosure protocol under which per-institution results were delivered to the responsible ministry before publication, with a post-notification re-measurement planned as the longitudinal follow-up.