Digital Lebanon at Risk: Massive DMARC Security Gaps Discovered

Here’s a common misconception: “If a domain has a DMARC record, it’s impossible to spoof.” Well, hold onto your keyboards folks, because that’s not always true. Just like thinking you’re completely safe online because you use incognito mode, DMARC can also have its… quirks.🤓

What’s DMARC Anyway?  

DMARC (Domain-based Message Authentication, Reporting, and Conformance) is basically a public policy you publish for anyone receiving emails from your domain. Think of it as a sign hanging at your domain’s front door that says:

Hey, if you get an email claiming to be from us, here’s how to verify it’s legit, and here’s what to do if it’s not.

The Bouncer Analogy 👮  

Think of an email security system like a nightclub with three bouncers working together to keep out troublemakers. Each bouncer has a specific job, and DMARC is the head bouncer who makes the final call.

When an email arrives claiming to be from a company, it first encounters two bouncers at the door:

• SPF (Sender Policy Framework): checks if the email is coming from an authorized mail server.
• DKIM (DomainKeys Identified Mail): looks for a special digital signature to make sure the email wasn’t tampered with along the way.

Now here’s where DMARC (the head bouncer) comes in. DMARC doesn’t just repeat what the other two bouncers do. Instead, it:

1. Reviews what the other bouncers found: Did SPF approve it? Did DKIM approve it?
2. Performs its own critical check: Does the “From” address that appears in your inbox match the domain that actually sent the email?
   • Here’s the key thing: the “From” address you see in your inbox (the one that says who sent the email) is just a label that anyone can change. Actually, there is a real technical “From” address that shows where the email truly came from, which is not displayed to the email reader. DMARC makes sure these two match up, so scammers can’t just type From: [email protected] in emails they’re actually sending from hackerdomain.com and fool people.
3. Makes the final decision: based on the DMARC policy of the sender’s domain, the appropriate action is taken. For example, if the email claims to be from yourcompany.com, DMARC checks yourcompany.com’s DMARC policy and decides what to do with the email.
   • And this is where DMARC gets really powerful. When you set up DMARC, you’re essentially giving the head bouncer clear instructions: “If an email fails these checks, here’s what I want you to do with it.”

DMARC is advanced and does multiple deep checks, so if you want to know more you can visit RFC 7489

Anatomy of a DMARC Record  

Technically, a DMARC record is a set of instructions in your DNS settings published as a TXT record. It’s made up of multiple tags. Let’s break down these tags (and yes, they’re as exciting as reading software terms and conditions 😵‍💫, but way more important):

• v=DMARC1: The “Hello 👋, I’m DMARC” introduction. Informing the reader of this DNS record that this is the DMARC policy
• p=: The policy that should be applied to emails that fail DMARC (your bouncer’s instruction manual):
  • none: “Just take notes, but let them in”
  • quarantine: “Send them to the waiting room (spam folder)”
  • reject: “Sorry, not allowed”
• sp=: Like p=, but for emails sent subdomains
• pct=: The percentage of emails (0-100) that should have this policy applied when they fail DMARC authentication (anything less than 100 is like having a bouncer who only works part-time 😅)
• adkim= and aspf=: How strict should we be? “relaxed” or “strict” when it comes to DKIM and SPF alignment
• rua=mailto: and ruf=mailto:: Where to send the reports about rejected emails

Vulnerabilities: When DMARC Goes Wrong  

Remember our bouncers? Well, even the best security bouncer is useless if you give them the wrong instructions. Here are the DMARC misconfigurations that can leave your domain vulnerable:

• NO DMARC
• p or sp set to none (it’s like having a bouncer who lets everyone in without checking)
• pct isn’t 100 (a part-time bouncer)
• Repeated tags
• Wrong version
• v tag not immediately followed by p
• space between key and the = (example p =none)

DMARC Misconfigurations Hunting  

Let’s put our knowledge into practice with some real-world research. For this research, I focused on analyzing DMARC implementations across Lebanon’s digital landscape, specifically targeting the country’s most visited domains and prominent companies.

Using a custom script I developed (available on DarkDMARC GitHub Repo ), I conducted a comprehensive scan of the top 100 domains. The results were eye-opening 😱, to say the least!

The Findings  

Here’s the shocking finding. Only 21% of the analyzed domains had properly configured DMARC records. This means that 79% of Lebanon’s top-visited domains are potentially vulnerable to email spoofing attacks❗❗

To put this in perspective, imagine if only 21% of banks in a city had working security systems, and the rest just drew pictures of security cameras on their walls. Some didn’t even bother drawing. That’s essentially what we’re seeing in the Lebanese email security landscape.😶

Want to Learn More?  

For the really curious minds out there, check out RFC 7489.

Remember: Having a DMARC record is great, but having a properly configured one is even better. Don’t be that organization with a misconfigured DMARC. It’s like having a guard dog that rolls over for belly rubs from strangers.🐕

Happy hunting for those misconfigurations. They’re more common than you might think! Just remember to keep it ethical.