Organizations Unite to Combat Email Phishing through DMARC.org
Fifteen companies, including PayPal, Google, Facebook, and Microsoft, have united to launch DMARC, a blueprint for a global counter attack on phishing, and a way to improve coordination between email providers and mail sender domain owners to combat spam.
DMARC, Domain-based Message Authentication, Reporting and Conformance, will be supported by DMARC.Org, a newly announced technical working group that has been developing the standards for the past 18 months.
The group says it has a draft specification that helps create a feedback loop between legitimate email senders and receivers to make it more challenging for phishers trying to send fraudulent email.
DMARC.org says that its specification addresses concerns that have traditionally deterred widespread deployment of an authenticated, trusted email ecosystem. Email receivers currently lack a reliable way to know the extent to which an email sender uses standards like SPF and DKIM for authenticating their messages. Because of this, email providers must rely on complex and imperfect measurements to distinguish legitimate unauthenticated messages from fraudulent phishing messages.
It also gives the legitimate owner of an Internet domain a way to request that illegitimate messages – spoofed spam, phishing – be put directly in the spam folder or rejected outright.
The group plans to gather data and input from field usage and then submit its DMARC specification to the The Internet Engineering Task Force (IETF) for standardization.
“Email phishing defrauds millions of people and companies every year, resulting in a loss of consumer confidence in email and the Internet as a whole,” said Brett McDowell, Chair of DMARC.org and Senior Manager of Customer Security Initiatives at PayPal. “Industry cooperation – combined with technology and consumer education – is crucial to fight phishing.”

For more than 10 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is the Director of several leading security industry conferences around the world.
More from Mike Lennon
- Watch Now: Threat Detection and Incident Response Virtual Summit
- Registration Now Open: 2023 ICS Cybersecurity Conference | Atlanta
- NetRise Adds $8 Million in Funding to Grow XIoT Security Platform
- Virtual Event Today: Zero Trust Strategies Summit
- Virtual Event Tomorrow: Zero Trust Strategies Summit
- Watch: How to Build Resilience Against Emerging Cyber Threats
- Video: How to Build Resilience Against Emerging Cyber Threats
- Webinar Today: Understanding Hidden Third-Party Identity Access Risks
Latest News
- Keep Aware Raises $2.4M to Eliminate Browser Blind Spots
- Google Workspace Gets Passkey Authentication
- Cybersecurity Startup Elba Raises €2.5 Million for Employee-Focused Product
- Zoom Expands Privacy Options for European Customers
- Several Major Organizations Confirm Being Impacted by MOVEit Attack
- Apple Unveils Upcoming Privacy and Security Features
- Verizon 2023 DBIR: Human Error Involved in Many Breaches, Ransomware Cost Surges
- Google Patches Third Chrome Zero-Day of 2023
