DMARC ROI Calculator
{
"description": {
"text": "Quantify the benefits of DMARC implementation: savings, compliance gains, and risk reduction, calculated for your organisation.",
"title": "Know What Email Authentication Is Worth"
},
"form": {
"button": "Generate Report",
"fields": {
"country": {
"hint": "",
"label": "Country",
"options": [
{ "label": "Afghanistan", "value": "AF", "visible": false, "currency": "؋" },
{ "label": "Albania", "value": "AL", "visible": false, "currency": "L" },
{ "label": "Algeria", "value": "DZ", "visible": false, "currency": "د.ج" },
{ "label": "American Samoa", "value": "AS", "visible": false, "currency": "$" },
{ "label": "Andorra", "value": "AD", "visible": false, "currency": "€" },
{ "label": "Angola", "value": "AO", "visible": false, "currency": "Kz" },
{ "label": "Anguilla", "value": "AI", "visible": false, "currency": "$" },
{ "label": "Antarctica", "value": "AQ", "visible": false, "currency": "N/A" },
{ "label": "Antigua and Barbuda", "value": "AG", "visible": false, "currency": "$" },
{ "label": "Argentina", "value": "AR", "visible": false, "currency": "$" },
{ "label": "Armenia", "value": "AM", "visible": false, "currency": "֏" },
{ "label": "Aruba", "value": "AW", "visible": false, "currency": "ƒ" },
{ "label": "Australia", "value": "AU", "visible": false, "currency": "$" },
{ "label": "Austria", "value": "AT", "visible": false, "currency": "€" },
{ "label": "Azerbaijan", "value": "AZ", "visible": false, "currency": "₼" },
{ "label": "Bahamas", "value": "BS", "visible": false, "currency": "$" },
{ "label": "Bahrain", "value": "BH", "visible": false, "currency": ".د.ب" },
{ "label": "Bangladesh", "value": "BD", "visible": false, "currency": "৳" },
{ "label": "Barbados", "value": "BB", "visible": false, "currency": "$" },
{ "label": "Belarus", "value": "BY", "visible": false, "currency": "Br" },
{ "label": "Belgium", "value": "BE", "visible": false, "currency": "€" },
{ "label": "Belize", "value": "BZ", "visible": false, "currency": "$" },
{ "label": "Benin", "value": "BJ", "visible": false, "currency": "CFA" },
{ "label": "Bermuda", "value": "BM", "visible": false, "currency": "$" },
{ "label": "Bhutan", "value": "BT", "visible": false, "currency": "Nu." },
{ "label": "Bolivia", "value": "BO", "visible": false, "currency": "Bs." },
{ "label": "Bosnia and Herzegovina", "value": "BA", "visible": false, "currency": "KM" },
{ "label": "Botswana", "value": "BW", "visible": false, "currency": "P" },
{ "label": "Brazil", "value": "BR", "visible": false, "currency": "R$" },
{ "label": "Brunei", "value": "BN", "visible": false, "currency": "$" },
{ "label": "Bulgaria", "value": "BG", "visible": false, "currency": "лв" },
{ "label": "Burkina Faso", "value": "BF", "visible": false, "currency": "CFA" },
{ "label": "Burundi", "value": "BI", "visible": false, "currency": "Fr" },
{ "label": "Cabo Verde", "value": "CV", "visible": false, "currency": "Esc" },
{ "label": "Cambodia", "value": "KH", "visible": false, "currency": "៛" },
{ "label": "Cameroon", "value": "CM", "visible": false, "currency": "CFA" },
{ "label": "Canada", "value": "CA", "visible": false, "currency": "$" },
{
"label": "Central African Republic",
"value": "CF",
"visible": false,
"currency": "CFA"
},
{ "label": "Chad", "value": "TD", "visible": false, "currency": "CFA" },
{ "label": "Chile", "value": "CL", "visible": false, "currency": "$" },
{ "label": "China", "value": "CN", "visible": false, "currency": "¥" },
{ "label": "Colombia", "value": "CO", "visible": false, "currency": "$" },
{ "label": "Comoros", "value": "KM", "visible": false, "currency": "Fr" },
{ "label": "Congo", "value": "CG", "visible": false, "currency": "CFA" },
{ "label": "Costa Rica", "value": "CR", "visible": false, "currency": "₡" },
{ "label": "Croatia", "value": "HR", "visible": false, "currency": "€" },
{ "label": "Cuba", "value": "CU", "visible": false, "currency": "$" },
{ "label": "Cyprus", "value": "CY", "visible": false, "currency": "€" },
{ "label": "Czech Republic", "value": "CZ", "visible": false, "currency": "Kč" },
{ "label": "Denmark", "value": "DK", "visible": false, "currency": "kr" },
{ "label": "Djibouti", "value": "DJ", "visible": false, "currency": "Fr" },
{ "label": "Dominica", "value": "DM", "visible": false, "currency": "$" },
{ "label": "Dominican Republic", "value": "DO", "visible": false, "currency": "$" },
{ "label": "Ecuador", "value": "EC", "visible": false, "currency": "$" },
{ "label": "Egypt", "value": "EG", "visible": false, "currency": "E£" },
{ "label": "El Salvador", "value": "SV", "visible": false, "currency": "$" },
{ "label": "Equatorial Guinea", "value": "GQ", "visible": false, "currency": "CFA" },
{ "label": "Eritrea", "value": "ER", "visible": false, "currency": "Nfk" },
{ "label": "Estonia", "value": "EE", "visible": false, "currency": "€" },
{ "label": "Eswatini", "value": "SZ", "visible": false, "currency": "L" },
{ "label": "Ethiopia", "value": "ET", "visible": false, "currency": "Br" },
{ "label": "Fiji", "value": "FJ", "visible": false, "currency": "$" },
{ "label": "Finland", "value": "FI", "visible": false, "currency": "€" },
{ "label": "France", "value": "FR", "visible": false, "currency": "€" },
{ "label": "Gabon", "value": "GA", "visible": false, "currency": "CFA" },
{ "label": "Gambia", "value": "GM", "visible": false, "currency": "D" },
{ "label": "Georgia", "value": "GE", "visible": false, "currency": "₾" },
{ "label": "Germany", "value": "DE", "visible": false, "currency": "€" },
{ "label": "Ghana", "value": "GH", "visible": false, "currency": "₵" },
{ "label": "Greece", "value": "GR", "visible": false, "currency": "€" },
{ "label": "Grenada", "value": "GD", "visible": false, "currency": "$" },
{ "label": "Guatemala", "value": "GT", "visible": false, "currency": "Q" },
{ "label": "Guinea", "value": "GN", "visible": false, "currency": "FG" },
{ "label": "Guyana", "value": "GY", "visible": false, "currency": "$" },
{ "label": "Haiti", "value": "HT", "visible": false, "currency": "G" },
{ "label": "Honduras", "value": "HN", "visible": false, "currency": "L" },
{ "label": "Hungary", "value": "HU", "visible": false, "currency": "Ft" },
{ "label": "Iceland", "value": "IS", "visible": false, "currency": "kr" },
{ "label": "India", "value": "IN", "visible": false, "currency": "₹" },
{ "label": "Indonesia", "value": "ID", "visible": false, "currency": "Rp" },
{ "label": "Iran", "value": "IR", "visible": false, "currency": "﷼" },
{ "label": "Iraq", "value": "IQ", "visible": false, "currency": "ع.د" },
{ "label": "Ireland", "value": "IE", "visible": true, "currency": "€" },
{ "label": "Israel", "value": "IL", "visible": false, "currency": "₪" },
{ "label": "Italy", "value": "IT", "visible": false, "currency": "€" },
{ "label": "Jamaica", "value": "JM", "visible": false, "currency": "$" },
{ "label": "Japan", "value": "JP", "visible": false, "currency": "¥" },
{ "label": "Jordan", "value": "JO", "visible": false, "currency": "د.ا" },
{ "label": "Kazakhstan", "value": "KZ", "visible": false, "currency": "₸" },
{ "label": "Kenya", "value": "KE", "visible": false, "currency": "KSh" },
{ "label": "Kiribati", "value": "KI", "visible": false, "currency": "$" },
{ "label": "Kuwait", "value": "KW", "visible": false, "currency": "د.ك" },
{ "label": "Kyrgyzstan", "value": "KG", "visible": false, "currency": "с" },
{ "label": "Laos", "value": "LA", "visible": false, "currency": "₭" },
{ "label": "Latvia", "value": "LV", "visible": false, "currency": "€" },
{ "label": "Lebanon", "value": "LB", "visible": false, "currency": "ل.ل" },
{ "label": "Lesotho", "value": "LS", "visible": false, "currency": "L" },
{ "label": "Liberia", "value": "LR", "visible": false, "currency": "$" },
{ "label": "Libya", "value": "LY", "visible": false, "currency": "ل.د" },
{ "label": "Liechtenstein", "value": "LI", "visible": false, "currency": "CHF" },
{ "label": "Lithuania", "value": "LT", "visible": false, "currency": "€" },
{ "label": "Luxembourg", "value": "LU", "visible": false, "currency": "€" },
{ "label": "Madagascar", "value": "MG", "visible": false, "currency": "Ar" },
{ "label": "Malawi", "value": "MW", "visible": false, "currency": "MK" },
{ "label": "Malaysia", "value": "MY", "visible": false, "currency": "RM" },
{ "label": "Maldives", "value": "MV", "visible": false, "currency": "Rf" },
{ "label": "Mali", "value": "ML", "visible": false, "currency": "CFA" },
{ "label": "Malta", "value": "MT", "visible": false, "currency": "€" },
{ "label": "Marshall Islands", "value": "MH", "visible": false, "currency": "$" },
{ "label": "Mauritania", "value": "MR", "visible": false, "currency": "UM" },
{ "label": "Mauritius", "value": "MU", "visible": false, "currency": "₨" },
{ "label": "Mexico", "value": "MX", "visible": false, "currency": "$" },
{ "label": "Micronesia", "value": "FM", "visible": false, "currency": "$" },
{ "label": "Moldova", "value": "MD", "visible": false, "currency": "L" },
{ "label": "Monaco", "value": "MC", "visible": false, "currency": "€" },
{ "label": "Mongolia", "value": "MN", "visible": false, "currency": "₮" },
{ "label": "Montenegro", "value": "ME", "visible": false, "currency": "€" },
{ "label": "Morocco", "value": "MA", "visible": false, "currency": "د.م." },
{ "label": "Mozambique", "value": "MZ", "visible": false, "currency": "MT" },
{ "label": "Myanmar", "value": "MM", "visible": false, "currency": "Ks" },
{ "label": "Namibia", "value": "NA", "visible": false, "currency": "$" },
{ "label": "Nauru", "value": "NR", "visible": false, "currency": "$" },
{ "label": "Nepal", "value": "NP", "visible": false, "currency": "₨" },
{ "label": "Netherlands", "value": "NL", "visible": false, "currency": "€" },
{ "label": "New Zealand", "value": "NZ", "visible": false, "currency": "$" },
{ "label": "Nicaragua", "value": "NI", "visible": false, "currency": "C$" },
{ "label": "Niger", "value": "NE", "visible": false, "currency": "CFA" },
{ "label": "Nigeria", "value": "NG", "visible": false, "currency": "₦" },
{ "label": "North Korea", "value": "KP", "visible": false, "currency": "₩" },
{ "label": "North Macedonia", "value": "MK", "visible": false, "currency": "ден" },
{ "label": "Norway", "value": "NO", "visible": false, "currency": "kr" },
{ "label": "Oman", "value": "OM", "visible": false, "currency": "ر.ع." },
{ "label": "Pakistan", "value": "PK", "visible": false, "currency": "₨" },
{ "label": "Palau", "value": "PW", "visible": false, "currency": "$" },
{ "label": "Panama", "value": "PA", "visible": false, "currency": "$" },
{ "label": "Papua New Guinea", "value": "PG", "visible": false, "currency": "K" },
{ "label": "Paraguay", "value": "PY", "visible": false, "currency": "₲" },
{ "label": "Peru", "value": "PE", "visible": false, "currency": "S/" },
{ "label": "Philippines", "value": "PH", "visible": false, "currency": "₱" },
{ "label": "Poland", "value": "PL", "visible": false, "currency": "zł" },
{ "label": "Portugal", "value": "PT", "visible": false, "currency": "€" },
{ "label": "Qatar", "value": "QA", "visible": false, "currency": "ر.ق" },
{ "label": "Romania", "value": "RO", "visible": false, "currency": "lei" },
{ "label": "Russia", "value": "RU", "visible": false, "currency": "₽" },
{ "label": "Rwanda", "value": "RW", "visible": false, "currency": "Fr" },
{ "label": "Saint Kitts and Nevis", "value": "KN", "visible": false, "currency": "$" },
{ "label": "Saint Lucia", "value": "LC", "visible": false, "currency": "$" },
{
"label": "Saint Vincent and the Grenadines",
"value": "VC",
"visible": false,
"currency": "$"
},
{ "label": "Samoa", "value": "WS", "visible": false, "currency": "WS$" },
{ "label": "San Marino", "value": "SM", "visible": false, "currency": "€" },
{ "label": "Sao Tome and Principe", "value": "ST", "visible": false, "currency": "Db" },
{ "label": "Saudi Arabia", "value": "SA", "visible": false, "currency": "ر.س" },
{ "label": "Senegal", "value": "SN", "visible": false, "currency": "CFA" },
{ "label": "Serbia", "value": "RS", "visible": false, "currency": "дин" },
{ "label": "Seychelles", "value": "SC", "visible": false, "currency": "₨" },
{ "label": "Sierra Leone", "value": "SL", "visible": false, "currency": "Le" },
{ "label": "Singapore", "value": "SG", "visible": false, "currency": "$" },
{ "label": "Slovakia", "value": "SK", "visible": false, "currency": "€" },
{ "label": "Slovenia", "value": "SI", "visible": false, "currency": "€" },
{ "label": "Solomon Islands", "value": "SB", "visible": false, "currency": "$" },
{ "label": "Somalia", "value": "SO", "visible": false, "currency": "Sh" },
{ "label": "South Africa", "value": "ZA", "visible": false, "currency": "R" },
{ "label": "South Korea", "value": "KR", "visible": false, "currency": "₩" },
{ "label": "South Sudan", "value": "SS", "visible": false, "currency": "£" },
{ "label": "Spain", "value": "ES", "visible": false, "currency": "€" },
{ "label": "Sri Lanka", "value": "LK", "visible": false, "currency": "₨" },
{ "label": "Sudan", "value": "SD", "visible": false, "currency": "£" },
{ "label": "Suriname", "value": "SR", "visible": false, "currency": "$" },
{ "label": "Sweden", "value": "SE", "visible": false, "currency": "kr" },
{ "label": "Switzerland", "value": "CH", "visible": false, "currency": "CHF" },
{ "label": "Syria", "value": "SY", "visible": false, "currency": "£" },
{ "label": "Taiwan", "value": "TW", "visible": false, "currency": "$" },
{ "label": "Tajikistan", "value": "TJ", "visible": false, "currency": "ЅМ" },
{ "label": "Tanzania", "value": "TZ", "visible": false, "currency": "Sh" },
{ "label": "Thailand", "value": "TH", "visible": false, "currency": "฿" },
{ "label": "Timor-Leste", "value": "TL", "visible": false, "currency": "$" },
{ "label": "Togo", "value": "TG", "visible": false, "currency": "CFA" },
{ "label": "Tonga", "value": "TO", "visible": false, "currency": "T$" },
{ "label": "Trinidad and Tobago", "value": "TT", "visible": false, "currency": "$" },
{ "label": "Tunisia", "value": "TN", "visible": false, "currency": "د.ت" },
{ "label": "Turkey", "value": "TR", "visible": false, "currency": "₺" },
{ "label": "Turkmenistan", "value": "TM", "visible": false, "currency": "m" },
{ "label": "Tuvalu", "value": "TV", "visible": false, "currency": "$" },
{ "label": "Uganda", "value": "UG", "visible": false, "currency": "Sh" },
{ "label": "Ukraine", "value": "UA", "visible": false, "currency": "₴" },
{ "label": "United Arab Emirates", "value": "AE", "visible": false, "currency": "د.إ" },
{ "label": "United Kingdom", "value": "GB", "visible": true, "currency": "£" },
{ "label": "United States", "value": "US", "visible": false, "currency": "$" },
{ "label": "Uruguay", "value": "UY", "visible": false, "currency": "$" },
{ "label": "Uzbekistan", "value": "UZ", "visible": false, "currency": "so'm" },
{ "label": "Vanuatu", "value": "VU", "visible": false, "currency": "Vt" },
{ "label": "Vatican City", "value": "VA", "visible": false, "currency": "€" },
{ "label": "Venezuela", "value": "VE", "visible": false, "currency": "Bs." },
{ "label": "Vietnam", "value": "VN", "visible": false, "currency": "₫" },
{ "label": "Yemen", "value": "YE", "visible": false, "currency": "﷼" },
{ "label": "Zambia", "value": "ZM", "visible": false, "currency": "ZK" },
{ "label": "Zimbabwe", "value": "ZW", "visible": false, "currency": "$" }
],
"placeholder": "Select your country",
"required": "Country is required."
},
"domain": {
"hint": "Example: dmarcian.com",
"label": "Primary Domain",
"placeholder": "Enter domain name",
"required": "Primary domain is required.",
"pattern": "Please enter a valid domain."
},
"industry": {
"hint": "",
"label": "Industry Type",
"options": [
"Healthcare",
"Financial",
"Industrial",
"Energy",
"Technology",
"Pharmaceuticals",
"Services",
"Entertainment",
"Media",
"Hospitality",
"Transportation",
"Education",
"Research",
"Communications",
"Consumer",
"Retail",
"Public",
"Other"
],
"placeholder": "Select your primary industry",
"required": "Industry is required."
},
"role": {
"hint": "Select your professional role",
"label": "Professional Role",
"options": [
{
"index": 0,
"label": "Executive Summary",
"text": "",
"value": "Executive Summary"
},
{
"index": 1,
"label": "Risk Manager",
"text": "",
"value": "Risk Manager"
},
{
"index": 2,
"label": "Information Security",
"text": "",
"value": "Information Security"
}
],
"placeholder": "",
"required": "Professional role is required."
}
},
"title": "DMARC ROI Parameters"
},
"links": {
"Executive Summary": "Access Executive Summary Version",
"Information Security": "Access Information Security Version",
"Risk Manager": "Access Risk Management Version"
},
"results": {
"introduction": {
"compliance": {
"date": "(as of `date`)",
"dmarc": {
"cta": {
"button": "Sign Up",
"text": "Start a dmarcian trial at no cost to understand your email activity and begin protecting your domain."
},
"name": "DMARC",
"states": {
"issue": {
"text": [],
"title": "`domain` is attempting to deploy DMARC but is experiencing technical issues."
},
"no_record": {
"text": [
"Without DMARC, inbox providers have less assurance that email using `domain` is authorised.",
"This can negatively affect inbox placement and signal to threat actors that the domain is easier to impersonate and exploit."
],
"title": "`domain` does not have a DMARC record"
},
"with_reject": {
"text": [],
"title": "`domain` is using DMARC to legitimise and protect `domain` email."
},
"without_reject": {
"text": [
"When the operators of `domain` have finished deploying DMARC, the DMARC policy will change to p=reject."
],
"title": "`domain` is deploying DMARC but is not yet able to assert that all legitimate `domain` emails are DMARC compliant."
}
}
},
"legend": {
"dkim": "The second technology used by DMARC to associate `domain` with email is `DKIM` (DomainKeys Identified Mail). DKIM insight is beyond the scope of this report.",
"spf": "`Sender Policy Framework (SPF)` is one of two technologies used by DMARC to associate `domain` with email. Email operators use SPF to identify themselves and their email-sending infrastructure."
},
"spf": {
"cta": {
"button": "Sign Up",
"text": "Sign up for free and use our SPF tool to check if your record exceeds DNS lookup limits, which can cause SPF failures and leave your domain vulnerable."
},
"name": "SPF",
"states": {
"issue": {
"text": [
"The authenticity of `domain` email and those who try to deliver it must be assumed."
],
"title": "`domain` SPF record contains issues that undermine SPF's ability to reliably legitimise `domain`'s email."
},
"no_spf": {
"text": [
"Without SPF, receiving mail systems cannot verify which services are authorised to send email for `domain`. This can affect delivery and increase impersonation risk, eroding brand trust.",
"Start a dmarcian trial at no cost to identify authorised senders and strengthen domain protection."
],
"title": "`domain` does not publish an SPF record"
},
"ok_spf": {
"text": [
"When combined with DMARC-supplied data, SPF records can be safely maintained to narrowly limit the infrastructure that is allowed to send on behalf of `domain`."
],
"title": "`domain`'s SPF record is syntactically correct."
}
}
}
},
"sections": [
{
"half": false,
"text": {
"Executive Summary": "Email remains the #1 attack method in online crime.",
"Information Security": "Despite ongoing investment in traditional email security.",
"Risk Manager": "Despite ongoing investment in perimeter {industry} email security."
},
"title": {
"Executive Summary": "Email can be upgraded to make it more reliable, trustworthy, and effective.",
"Information Security": "Email remains the #1 attack surface in online crime.",
"Risk Manager": "Risk analysis places email as #1 attack vector."
}
},
{
"half": true,
"text": {
"Executive Summary": "This new model allows email to be delivered with strong proof that email comes from the organisation, and that fake email pretending to be from the organisation is blocked.",
"Information Security": "Contrary to Zero Trust principles, the traditional model assumes good email is what remains after filters have removed all of the bad email.",
"Risk Manager": "The new model gives organisations explicit authority over who is allowed to send email using the organisation's internet domains."
},
"title": {
"Executive Summary": "The upgrade is called DMARC, a technical control based on internet domains that enables a new email security model.",
"Information Security": "A new email security model applies Zero Trust principles to address the systemic inadequacies of the traditional email model.",
"Risk Manager": "A new email security model is available to mitigate cyber risk that continues to evade traditional email defenses."
}
},
{
"half": true,
"text": {
"Executive Summary": "When deployed correctly, DMARC allows organisations to tell the world that the organisation takes online trust and safety seriously.",
"Information Security": "When properly structured, the deployment of DMARC within an organisation can be used to align business processes with information security best practices, meet compliance needs, and set the groundwork for additional InfoSec policies to be integrated across an organisation.",
"Risk Manager": "When properly structured, the deployment of DMARC within an organisation can install real cyber risk controls, meet compliance needs, and set the groundwork for additional cyber risk mitigation processes throughout the organisation."
},
"title": {
"Executive Summary": "The result is more reliable email delivery (less spam), credibility (fewer deceptive emails) and meeting common cybersecurity regulatory requirements (less exposure).",
"Information Security": "The foundation of the new model is a standards-based technical capability called DMARC.",
"Risk Manager": "The foundation of the new model is a standards-based technical capability called DMARC."
}
}
],
"title": "Introduction"
},
"metadata": {
"date": "Report generated on `date`",
"download": "Download a PDF version of the report",
"subtitle": "Upgrading Email with Domain-based Message Authentication, Reporting, and Conformance (DMARC)"
},
"proof": {
"legend": "Explicit DMARC mention",
"sections": [
{
"data": [
{
"explicit": false,
"impact": "",
"link": "",
"title": "PCI DSS (Payment Card Industry Data Security Standard)",
"value": "PCI standards focus on securing global payment data and supporting education, awareness, and implementation. Their DMARC guidance helps protect cardholder data and reduce fraud and identity theft."
},
{
"explicit": false,
"impact": "",
"link": "",
"title": "Google/Yahoo requirements",
"value": "In February 2024, Google and Yahoo began rolling out requirements for bulk senders (5,000+ emails/day) to improve authentication and reduce spam and spoofing."
},
{
"explicit": false,
"impact": "",
"link": "",
"title": "Microsoft requires DMARC and its supporting technologies of SPF and DKIM for large senders",
"value": "Starting May 5, 2025, Microsoft requires high-volume senders (5,000+ emails/day) to use SPF, DKIM, and DMARC for delivery to Outlook, Hotmail, and Live. Failing messages may be sent to spam or rejected (550 5.7.15), helping reduce phishing and spoofing."
},
{
"explicit": false,
"impact": "",
"link": "",
"title": "iCloud Mail bulk email requirements",
"value": "iCloud Mail caps bulk sending at 1,000 recipients per day and 500 per message. Senders should use SPF, DKIM, and DMARC, keep spam rates low, include one-click unsubscribes, and email only opted-in users to avoid rejection."
},
{
"explicit": false,
"impact": "",
"link": "",
"title": "fTLD (financial Top Level Domain)",
"value": "fTLD Registry Services requires strict DMARC enforcement for .bank and .insurance domains, including Public Suffix Domain (PSD) DMARC to protect the entire TLD. Compliance also includes SPF, DKIM, and DNSSEC to prevent phishing and spoofing."
}
],
"half": true,
"text": "",
"title": "Industry Requirements"
},
{
"data": {
"au": [
{
"explicit": false,
"impact": "",
"link": "https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/email-hardening/how-combat-fake-emails",
"title": "How to Combat Fake Emails (cyber.gov.au)",
"value": "Contains advice for security practitioners and mail server operators on how they should configure their systems to prevent their domains from being used as the source of fake emails."
},
{
"explicit": false,
"impact": "",
"link": "https://www.cyber.gov.au/resources-business-and-government/maintaining-devices-and-systems/system-hardening-and-administration/email-hardening/malicious-email-mitigation-strategies",
"title": "Malicious Email Mitigation Strategies (cyber.gov.au)",
"value": "The Australian Signals Directorate (ASD) developed information to provide mitigation strategies for the security risks posed by socially engineered malicious emails."
},
{
"explicit": false,
"impact": "",
"link": "https://www.cyber.gov.au/resources-business-and-government/essential-cybersecurity/strategies-mitigate-cybersecurity-incidents/strategies-mitigate-cybersecurity-incidents-mitigation-details",
"title": "Strategies to Mitigate Cybersecurity Incidents (cyber.gov.au)",
"value": "The Australian Signals Directorate (ASD) published guidance to help organisations mitigate cyber security incidents, specifically 'business email compromise' and 'block spoofed emails' using DMARC."
},
{
"explicit": false,
"impact": "",
"link": "https://www.cyber.gov.au/sites/default/files/2024-06/20.%20ISM%20-%20Guidelines%20for%20Email%20%28June%202024%29.pdf",
"title": "Information Security Manual - Guidelines for Email (cyber.gov.au)",
"value": "As part of the Australian Signals Directorate (ASD) Information Security Manual, DMARC, SPF, and DKIM are recommended to protect information and operational technology systems from cyber threats."
}
],
"ca": [
{
"explicit": false,
"impact": "",
"link": "https://www.cyber.gc.ca/en/guidance/implementation-guidance-email-domain-protection",
"title": "Implementation guidance: email domain protection (cyber.gc.ca)",
"value": "The Canadian Centre for Cyber Security recommends implementing DMARC, SPF and DKIM to reduce a threat actor’s chance of carrying out successful malicious email campaigns."
}
],
"cz": [
{
"explicit": false,
"impact": "",
"link": "https://nukib.gov.cz/download/uredni_deska/2021-10-08_OchranneOpatreni_final_ENG.pdf",
"title": "Cybersecurity Act (nukib.gov.cz)",
"value": "The Czech Republic's National Cyber and Information Security Agency released requirements for regulated organisations that include DMARC with a policy set to p=quarantine or p=reject."
}
],
"dk": [
{
"explicit": false,
"impact": "",
"link": "https://www.sikkerdigital.dk/myndighed/tekniske-tiltag/tekniske-minimumskrav",
"title": "Minimum technical requirements for government authorities (sikkerdigital.dk)",
"value": "Danish government agencies are required to publish DMARC records with a p=reject policy to protect people from email spoofing."
}
],
"eu": [
{
"explicit": false,
"impact": "",
"link": "https://cert.europa.eu/static/WhitePapers/Updated-CERT-EU_Security_Whitepaper_DMARC_17-001_v1_2.pdf",
"title": "DMARC — Defeating E-Mail Abuse (cert.europa.eu)",
"value": "The Computer Emergency Response Team for the European Union (CERT-EU) provides this white paper to help mitigate email abuse by implementing DMARC."
},
{
"explicit": false,
"impact": "",
"link": "https://ec.europa.eu/internet-standards/email.html",
"title": "Email communication security standards (ec.europa.eu)",
"value": "Part of the EU Internet Standards Deployment Monitoring website, the European Commission recommends SPF, DKIM, and DMARC—foundational email security controls to ensure the integrity of email communications."
},
{
"explicit": false,
"impact": "",
"link": "https://www.eco.de/wp-content/uploads/2017/05/eco_best_practices_for_email_marketing.pdf",
"title": "Best Practices for Email Marketing (eco.de)",
"value": "The Association of the Internet Industry (eco) recommends deploying DMARC with a p=reject policy to prevent fraudulent messages from being delivered."
}
],
"fr": [
{
"explicit": false,
"impact": "",
"link": "https://messervices.cyber.gouv.fr/documents-guides/guideline-for-a-healthy-information-system-in-42-measures_v2.pdf",
"title": "Guideline For A Healthy Information System (cyber.gouv.fr)",
"value": "The National Cybersecurity Agency of France publishes 42 security measures including DMARC to protect your email."
},
{
"explicit": false,
"impact": "",
"isHTML": true,
"link": "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2023-CTI-009.pdf",
"title": "Campagnes d’attaques du mode opératoire APT28 depuis 2021 (cert.ssi.gouv.fr)",
"value": "France's ANSSI analysed chains of compromise of the APT28 attack and published DMARC as defensive recommendation against phishing emails."
}
],
"de": [
{
"explicit": false,
"impact": "",
"link": "https://www.allianz-fuer-cybersicherheit.de/SharedDocs/Downloads/Webs/ACS/DE/BSI-CS/BSI-CS_098.pdf?__blob=publicationFile&v=1",
"title": "E-Mail-Sicherheit - Handlungsempfehlungen für Internet-Service-Provider (allianz-fuer-cybersicherheit.de)",
"value": "Germany's BSI-CS 098 recommends ISPs to include DMARC-based authentication checks while processing email to reduce the malware and spam problem."
},
{
"explicit": false,
"impact": "",
"link": "https://www.allianz-fuer-cybersicherheit.de/SharedDocs/Downloads/Webs/ACS/DE/BSI-CS/BSI-CS_155.pdf?__blob=publicationFile&v=5",
"title": "Upgrade für die E-Mail-Sicherheit Handlungsempfehlungen für moderne E-Mail-Infrastrukturen in Unternehmen (allianz-fuer-cybersicherheit.de)",
"value": "Germany's BSI-CS 155 recommends implementing DMARC to strengthen protection against attacks that spoof the identity of trusted sender domains (e.g., spoofing and phishing)."
},
{
"explicit": false,
"impact": "",
"link": "https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TR03182/BSI-TR-03182.pdf?__blob=publicationFile&v=6",
"title": "BSI TR-03182 Email Authentication (bsi.bund.de)",
"value": "Germany's BSI TR-03182 describes DMARC deployment and processing as a MUST requirement to meet BSI TR-03182 proof of compliance."
}
],
"in": [
{
"explicit": false,
"impact": "",
"link": "https://www.medianama.com/wp-content/uploads/2026/04/IRDAI-Information-Cyber-Security-Guidelines-2026.pdf",
"title": "Information and Cyber Security Guidelines (irdai.gov.in)",
"value": "Policy 2.21 Section 3.1 of IRDAI's 2026 Guidelines require DMARC to address Email Security to lower the chance of spoofed or modified emails from valid domains."
},
{
"explicit": false,
"impact": "",
"link": "https://www.rbi.org.in/scripts/SearchResults.aspx?search=DMARC",
"title": "Reserve Bank of India (Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026 (rbi.org.in)",
"value": "Credit Information Companies, all India Financial Institutions, Urban Co-Operative Banks, Payments Banks, Small Finance Banks, and Commercial Banks are required to deploy DMARC and impress upon its vendors, partners, and other relevant third parties, to implement similar solution securing their mail systems to mitigate email spoofing."
}
],
"ie": [
{
"explicit": false,
"impact": "",
"link": "https://ncsc.gov.ie/pdfs/Cyber_Security_Baseline_Standards_Rev_1_2022_Final.pdf",
"title": "Public Sector Cyber Security Baseline Standards (ncsc.gov.ie)",
"value": "Ireland's National Cyber Security Centre recommends SPF, DKIM, and DMARC as cybersecurity baseline standards to help prevent fraudulent email."
},
{
"explicit": false,
"impact": "",
"link": "https://ncsc.gov.ie/pdfs/NCSC_BEC_Guidance.pdf",
"title": "Protecting Against Business Email Compromise and Payment Fraud (ncsc.gov.ie)",
"value": "Ireland's National Cyber Security Centre publised guidance on preventing BEC attacks, and notes DMARC meets CyFun Clause PR.PT-4."
},
{
"explicit": false,
"impact": "",
"link": "https://ncsc.gov.ie/pdfs/NCSC_Office_365_Secure_Configuration_Framework.pdf",
"title": "Office 365 Secure Configuration Framework (ncsc.gov.ie)",
"value": "Ireland's National Cyber Security Centre (NCSC) developed guidance for Office 365 services. DMARC is mentioned in 7. Standard Controls, 8. Advanced Controls to enhance protection against phishing/spoofing."
},
{
"explicit": false,
"impact": "",
"link": "https://ncsc.gov.ie/pdfs/Cyber_Vitals_Checklist.pdf",
"title": "Cyber Vitals Checklist (ncsc.gov.ie)",
"value": "The cyber vitals checklist has been produced by the NCSC to ensure that organisations can check that their critical cyber controls are implemented and working correctly, including DMARC."
}
],
"it": [
{
"explicit": false,
"impact": "",
"link": "https://www.acn.gov.it/portale/w/framework-di-autenticazione-per-la-posta-elettronica",
"title": "Framework di Autenticazione per la Posta Elettronica (acn.gov.it)",
"value": "The National Cybersecurity Agency of Italy recommends using DMARC to dramatically reduce the risk associated with phishing and spoofing."
}
],
"jp": [
{
"explicit": false,
"impact": "",
"link": "https://www.cyber.go.jp/pdf/policy/general/guider8_6_02.pdf",
"title": "Guidelines for the Formulation of Countermeasure Standards by Government Agencies and Other Entities (cyber.go.jp)",
"value": "Japan's National Cybersecurity Office publishs guidance to include DMARC at p=quarantine or p=reject policy, noting that the p=none policy duration should be as short as possible."
}
],
"nl": [
{
"explicit": false,
"impact": "",
"link": "https://www.communicatierijk.nl/vakkennis/rijkswebsites/verplichte-richtlijnen/dmarc",
"title": "Mandatory Guidelines - DMARC (communicatierijk.nl)",
"value": "The Netherlands government publishes a list of mandatory standards which includes DMARC."
}
],
"no": [
{
"explicit": false,
"impact": "",
"link": "https://nsm.no/getfile.php/1313972-1717589707/NSM/Filer/Dokumenter/Veiledere/NSM%20ICT%20Security%20Principles%20v2.1.pdf",
"title": "NSM ICT Security Principles version 2.1 (nsm.no)",
"value": "The Norwegian National Security Authority publishes guidance to implement DMARC to verify the sender address of incoming emails to protect email clients."
}
],
"nz": [
{
"explicit": false,
"impact": "",
"link": "https://www.nzism.gcsb.govt.nz/ism-document/#Chapter-15182:~:text=15.2.%20Email%20Infrastructure",
"title": "New Zealand Information Security Manual (gcsb.govt.nz)",
"value": "The New Zealand Information Security Manual details processes and controls essential for the protection of all New Zealand Government information and systems. Section 15.2 Email Infrastructure describes the use of DMARC to avoid agency domains being used fraudulently."
}
],
"pk": [
{
"explicit": false,
"impact": "",
"link": "https://pkcert.gov.pk/advisory/25/34.pdf",
"title": "NCA-34.061725 – Security Measures to Prevent Cyber Threats originating from Email Misconfigurations (pkcert.gov.pk)",
"value": "Pakistan's National CERT Advisory NCA-34.061725 suggests all organisations to mandate the use of DMARC."
}
],
"pl": [
{
"explicit": false,
"impact": "",
"link": "https://www.gov.pl/web/baza-wiedzy/ustawa-o-zwalczaniu-naduzyc-w-komunikacji-elektronicznej--nowe-obowiazki-dla-dostawcow-poczty-elektronicznej-i-instytucji-publicznych",
"title": "Act on Combating Abuse in Electronic Communications (gov.pl)",
"value": "Public entities are obliged to use email using SPF, DKIM, and DMARC mechanisms to verify the sender of the message."
}
],
"pt": [
{
"explicit": false,
"impact": "",
"link": "https://www.cncs.gov.pt/en/technical-recommendation-01/2020/",
"title": "Technical Recommendation of the National Cybersecurity Centre: Protection of \"Parked\" Domains (cncs.gov.pt)",
"value": "This document describes a set of best practices (including DMARC) that should be adopted with domains (and subdomains) that are \"parked\" (also known as parked domains), and that are not used for sending e-mails."
},
{
"explicit": false,
"impact": "",
"link": "https://www.cncs.gov.pt/pt/recomendacao-tecnica-01/2019/",
"title": "Technical Recommendation from the National Cybersecurity Center: SPF, DKIM, and DMARC (cncs.gov.pt)",
"value": "The National Cybersecurity Center (CNCS) recommends that all public and private organisations with an online presence adopt the SPF, DKIM, and DMARC standards."
}
],
"rw": [
{
"explicit": false,
"impact": "",
"link": "https://cyber.gov.rw/index.php?eID=dumpFile&t=f&f=406&token=2f731a446c3024c0ca26d562642a8adc13e96d78",
"title": "Minimum Cybersecurity Standards for the Financial Sector (cyber.gov.rw)",
"value": "Minimum cybersecurity requirements (including DMARC) for financial sector institutions as well as financial sector institutions’ mission critical infrastructure and ICT systems in Rwanda are described, to be implemented by July 2024."
},
{
"explicit": false,
"impact": "",
"link": "https://cyber.gov.rw/index.php?eID=dumpFile&t=f&f=411&token=86d6479fc55900e43c9b205843bd8bb85db55f9f",
"title": "Minimum Cybersecurity Standards for Public Institutions (cyber.gov.rw)",
"value": "Minimum cybersecurity requirements including DMARC for public institutions as well as public institutions’ mission critical infrastructure and ICT systems are to be implemented by July 2024."
},
{
"explicit": false,
"impact": "",
"link": "https://cyber.gov.rw/index.php?eID=dumpFile&t=f&f=411&token=86d6479fc55900e43c9b205843bd8bb85db55f9f",
"title": "Minimum Cybersecurity Standards for Essential Service Providers (cyber.gov.rw)",
"value": "Minimum cybersecurity requirements including DMARC for ESPs as well as ESPs’ mission critical infrastructure and ICT systems are to be implemented by July 2024."
}
],
"sg": [
{
"explicit": false,
"impact": "",
"link": "https://ihp.csa.gov.sg/",
"title": "CSA Internet Hygiene Portal (ihp.csa.gov.sg)",
"value": "The internet hygiene rating is based on the average adoption of internet security best practices and include DMARC to enhances email security by preventing email spoofing."
},
{
"explicit": false,
"impact": "",
"link": "https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2024-017/",
"title": "CSA Advisory on Extortion Emails (csa.gov.sg)",
"value": "The Cyber Security Agency of Singapore published an advisory to provide awareness regarding extortion emails, and deploy DMARC."
},
{
"explicit": false,
"impact": "",
"link": "https://www.csa.gov.sg/alerts-and-advisories/advisories/ad-2022-003/",
"title": "CSA Advisory Protect your Organisation from Business Email Compromise",
"value": "The Cyber Security Agency of Singapore published an advisory and playbook regarding BEC to implement DMARC."
}
],
"ae": [
{
"explicit": false,
"impact": "",
"link": "https://rulebook.centralbank.ae/en/rulebook/article-13-technology-risk-and-information-security",
"title": "CBUAE Rulebook Article (13) Technology Risk and Information Security (centralbank.ae)",
"value": "The Central Bank of the UAE requires licensed financial institutions to prevent digital impersonation and fraud. The framework outlines expectations across governance, monitoring, prevention, and response, which are addressed through controls such as DMARC."
}
],
"uk": [
{
"explicit": false,
"impact": "",
"link": "https://www.ncsc.gov.uk/guidance/phishing",
"title": "Phishing attacks: defending your organisation (ncsc.gov.uk)",
"value": "The UK's National Cyber Security Centre recommends DMARC to improve resilience against phishing attacks while minimising disruption to user productivity."
},
{
"explicit": false,
"impact": "",
"link": "https://www.ncsc.gov.uk/collection/email-security-and-anti-spoofing",
"title": "Email security and anti-spoofing: A guide for IT managers and systems administrators (ncsc.gov.uk)",
"value": "The UK's National Cyber Security Centre released this guidance to help secure email systems by configuring SPF, DKIM, and DMARC."
},
{
"explicit": false,
"impact": "",
"link": "https://www.gov.uk/government/publications/email-security-standards/domain-based-message-authentication-reporting-and-conformance-dmarc",
"title": "Using DMARC in your organisation (ncsc.gov.uk)",
"value": "UK's National Cyber Security Centre guidance revolves around how SPF, DKIM, and DMARC are email standards that protect people from cybercrime, reduce customer support costs, improve trust, and provide visibility into domain use."
},
{
"explicit": false,
"impact": "",
"link": "https://www.gov.uk/guidance/set-up-government-email-services-securely",
"title": "Set up government email services securely (gov.uk)",
"value": "The UK's guidance on how to configure email services using encryption and anti-spoofing. DMARC is listed to prevent spoofing and phishing."
}
],
"us": [
{
"explicit": false,
"impact": "",
"link": "https://www.epa.gov/system/files/documents/2024-08/epa-guidance-on-improving-cybersecurity-at-drinking-water-and-wastewater-systems-1.pdf",
"title": "EPA Guidance on Improving Cybersecurity at Drinking Water and Wastewater Systems (epa.gov)",
"value": "Environmental Protection Agency (EPA) guidance includes use of email security controls to reduce email-based threats such as spoofing, phishing, and interception and includes DMARC in the glossary."
},
{
"explicit": false,
"impact": "",
"link": "https://405d.hhs.gov/Documents/tech-vol2-508.pdf#page=18",
"title": "Cybersecurity Practices for Medium and Large Healthcare Organisations (hhs.gov)",
"value": "DMARC is included as part of Email Protection Controls."
},
{
"explicit": false,
"impact": "",
"link": "https://www.cisa.gov/news-events/directives/bod-18-01-enhance-email-and-web-security",
"title": "BOD 18-01: Enhance Email and Web Security (cisa.gov)",
"value": "The Department of Homeland Security’s Binding Operational Directive 18-01, \"Enhance Email and Web Security\", requires the use of DMARC among federal, executive branch, departments, and agencies to safeguard federal information systems."
},
{
"explicit": false,
"impact": "",
"link": "https://dmarcian.com/cisa-bod-25-01-dmarc-requirements-microsoft-google/",
"title": "Understanding CISA BOD 25-01 DMARC Requirements for Microsoft 365 and Google Workspace (cisa.gov)",
"value": "Nested in the Secure Cloud Business Applications (SCuBA) project, “Binding Operational Directive (BOD) 25-01: Implementing Secure Practices for Cloud Services Required Configurations” provides baselines for configuring Microsoft 365 and Google Workspace in the United States’ Federal Civilian Executive Branch (FCEB). Those baselines include DMARC."
},
{
"explicit": false,
"impact": "",
"link": "https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-177r1.pdf",
"title": "NIST Special Publication 800-177 - Trustworthy Email (nist.gov)",
"value": "This document gives recommendations and guidelines for enhancing trust in email, including DMARC."
},
{
"explicit": false,
"impact": "",
"link": "https://www.cisa.gov/sites/default/files/2023-03/CISA_CPG_REPORT_v1.0.1_FINAL.pdf",
"title": "Cross-Sector Cybersecurity Performance Goals (cisa.gov)",
"value": "DMARC is included in the Email Security section of the Performance Goals' list of most important cybersecurity practices."
},
{
"explicit": false,
"impact": "",
"link": "https://www.cisa.gov/sites/default/files/2025-03/StopRansomware-Guide%20508.pdf",
"title": "#StopRansomware Guide (cisa.gov)",
"value": "The StopRansomware Guide recommends DMARC to address the subject of Initial Access Vector: Phishing."
},
{
"explicit": false,
"impact": "",
"link": "https://www.cisa.gov/sites/default/files/publications/CISAInsights-Cyber-EnhanceEmailandWebSecurity_S508C.pdf",
"title": "CISA INSIGHTS: Enhance Email & Web Security (cisa.gov)",
"value": "The Cybersecurity and Infrastructure Security Agency (CISA) encourages its State, Local, Tribal and Territorial (SLTT) government partners, as well as private entities, to use this guide to learn more about this threat and associated mitigation activities, including deployment of DMARC."
},
{
"explicit": false,
"impact": "",
"link": "https://www.cisa.gov/sites/default/files/publications/CISA_MS-ISAC_Ransomware%20Guide_S508C.pdf",
"title": "MS-ISAC Ransomware Guide (cisa.gov)",
"value": "To lower the chance of spoofed or modified emails from valid domains, the Ransomware Guide recommends deployment of DMARC."
},
{
"explicit": false,
"impact": "",
"link": "https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf",
"title": "Phishing Guidance: Stopping The Attack Cycle At Phase One (cisa.gov)",
"value": "Guidance recommends all organisations to mitigate spoofing through enabling DMARC."
},
{
"explicit": false,
"impact": "",
"link": "https://www.ic3.gov/CSA/2024/240502.pdf",
"title": "Joint Cybersecurity Advisory regarding exploit of weak DMARC policies (ic3.gov)",
"value": "The advisory notes North Korean actors can exploit targets that do not have DMARC in place."
},
{
"explicit": false,
"impact": "",
"link": "https://csf.tools/reference/critical-security-controls/v8-1/csc-9/csc-9-5/",
"title": "CIS Critical Security Controls 9.5: Implement DMARC (csf.tools)",
"value": "To lower the chance of spoofed or modified emails from valid domains, implement DMARC policy and verification."
}
],
"international": [
{
"explicit": false,
"impact": "",
"link": "https://dmarcian.com/yahoo-and-google-dmarc-required/",
"title": "Gmail and Yahoo DMARC Requirements",
"value": "Bulk senders must have DMARC in place to deliver mail into Google or Yahoo."
},
{
"explicit": false,
"impact": "",
"link": "https://dmarcian.com/pci-recommends-dmarc/",
"title": "PCI DSS v4.0.1 Requires DMARC",
"value": "DMARC is required as part of the Payment Card Industry Data Security Standard v4.0.1."
},
{
"explicit": false,
"impact": "",
"link": "https://dmarcian.com/ftld-dmarc-psd/",
"title": "DMARC policies for Top-Level Domains .BANK and .INSURANCE",
"value": "The first non-governmental TLDs to utilise DMARC to protect top level domains, fTLD’s requirement aims to help protect domains from phishing and improve email deliverability."
},
{
"explicit": false,
"impact": "",
"link": "https://dmarcian.com/microsoft-enforces-spf-dkim-dmarc/",
"title": "Microsoft Enforces SPF, DKIM, DMARC for High-Volume Senders",
"value": "Bulk senders must have DMARC in place to deliver mail into Microsoft infrastructure."
},
{
"explicit": false,
"impact": "",
"link": "https://support.apple.com/en-us/102322",
"title": "iCloud DMARC Requirements",
"value": "Bulk senders must have DMARC in place to deliver mail into iCould Mail infrastructure."
}
]
},
"half": true,
"text": "",
"title": "{country} Compliance Requirements"
},
{
"data": [
{
"explicit": true,
"impact": "",
"link": "",
"title": "",
"value": "Center for Internet Security Critical Security Controls Version 8.1"
},
{
"explicit": true,
"impact": "",
"link": "",
"title": "",
"value": "Network and Information Systems 2 (NIS2) Directive"
},
{
"explicit": false,
"impact": "",
"link": "",
"title": "",
"value": "ISO/IEC 27001:2022"
},
{
"explicit": false,
"impact": "",
"link": "",
"title": "",
"value": "National Institute of Standards and Technology (NIST)"
},
{
"explicit": false,
"impact": "",
"link": "",
"title": "",
"value": "PCI DSS v.4.0.1 – Payment Card Industry Data Security Standard"
},
{
"explicit": false,
"impact": "",
"link": "",
"title": "",
"value": "General Data Protection Regulation (GDPR)"
},
{
"explicit": false,
"impact": "",
"link": "",
"title": "",
"value": "DORA (Digital Operational Resilience Act)"
}
],
"half": false,
"text": "Cybersecurity frameworks play a key role in describing how an organisation should behave to secure data and protect people from cybercrime. Some frameworks explicitly mention DMARC, while others recommend high-level guidance such as \"safeguarding users from phishing\" where DMARC plays a central role:",
"title": "Cybersecurity Frameworks"
}
],
"summary": {
"Executive Summary": "The need for DMARC is recognised when technology providers, governments, and cybersecurity frameworks publish regulations and guidance to implement DMARC.",
"Information Security": "The need for DMARC is recognised when cybersecurity frameworks, technology providers, and governments publish regulations and guidance to implement DMARC.",
"Risk Manager": "The need for DMARC is recognised when governments, cybersecurity frameworks, and technology providers publish regulations and guidance to implement DMARC."
},
"title": "Meet Requirements With DMARC"
},
"reports": {
"chart": {
"data": [
{
"marker": {
"fillColor": "var(--color-green-44D658)"
},
"name": "Healthcare",
"value": 7.42
},
{
"marker": {
"fillColor": "var(--color-light-green-E5FF81)"
},
"name": "Financial",
"value": 5.56
},
{
"marker": {
"fillColor": "var(--color-green-44D658)"
},
"name": "Industrial",
"value": 5
},
{
"marker": {
"fillColor": "var(--color-light-green-B8FF8D)"
},
"name": "Energy",
"value": 4.83
},
{
"marker": {
"fillColor": "var(--color-light-green-B8FF8D)"
},
"name": "Technology",
"value": 4.79
},
{
"marker": {
"fillColor": "var(--color-light-green-E5FF81)"
},
"name": "Pharmaceuticals",
"value": 4.61
},
{
"marker": {
"fillColor": "var(--color-green-4BEA61)"
},
"name": "Services",
"value": 4.56
},
{
"marker": {
"fillColor": "var(--color-green-4BEA61)"
},
"name": "Entertainment",
"value": 4.43
},
{
"marker": {
"fillColor": "var(--color-green-4BEA61)"
},
"name": "Media",
"value": 4.22
},
{
"marker": {
"fillColor": "var(--color-light-green-E5FF81)"
},
"name": "Hospitality",
"value": 4.03
},
{
"marker": {
"fillColor": "var(--color-light-green-E5FF81)"
},
"name": "Transportation",
"value": 3.98
},
{
"marker": {
"fillColor": "var(--color-light-green-B8FF8D)"
},
"name": "Education",
"value": 3.8
},
{
"marker": {
"fillColor": "var(--color-light-green-E5FF81)"
},
"name": "Research",
"value": 3.79
},
{
"marker": {
"fillColor": "var(--color-light-green-E5FF81)"
},
"name": "Communications",
"value": 3.75
},
{
"marker": {
"fillColor": "var(--color-light-green-E5FF81)"
},
"name": "Consumer",
"value": 3.72
},
{
"marker": {
"fillColor": "var(--color-light-green-B8FF8D)"
},
"name": "Retail",
"value": 3.54
},
{
"marker": {
"fillColor": "var(--color-light-green-E5FF81)"
},
"name": "Public",
"value": 2.86
},
{
"marker": {
"fillColor": "var(--color-light-green-B8FF8D)"
},
"name": "Other",
"value": 4.41
}
],
"subtitle": "IBM Cost of Data Breach | 2025 Report",
"text": {
"default": [
"The range of the two averages `({averages})` shows that data breach incidents have a severe impact on an organisation. Larger organisations may see larger monetary losses, but smaller organisations often face losses that threaten the very existence of the organisation.",
"From the insurance perspective, the NetDiligence report shares data on both the average and the maximum incident cost of cybersecurity events broken down by industry and further split between companies with $2 billion or more in revenue.",
"Within the `{industry} industry`, the average total incident cost is ${smeAverage}, with a maximum reported cost of ${smeMax}. For companies seeing greater than USD $2B in revenue, the average cost is ${largeAverage} and the maximum reported cost is ${largeMax}."
],
"other": [
"The range of the two averages `({averages})` shows that data breach incidents have a severe impact on an organisation. Larger organisations may see larger monetary losses, but smaller organisations often face losses that threaten the very existence of the organisation.",
"From the insurance perspective, the NetDiligence report shares data on both the average and the maximum incident cost of cybersecurity events broken down by industry and further split between companies with $2 billion or more in revenue.",
"Among organisations outside the listed industry categories, the average total incident cost is ${smeAverage}, with a maximum reported cost of ${smeMax}. For companies seeing greater than USD $2B in revenue, the average cost is ${largeAverage} and the maximum reported cost is ${largeMax}."
]
},
"title": "Average breach cost among industries",
"values": {
"Healthcare": {
"sme": {
"average": "566K",
"max": "105M"
},
"large": {
"average": "17.9M",
"max": "165M"
}
},
"Financial": {
"sme": {
"average": "329K",
"max": "11.5M"
},
"large": {
"average": "1.7M",
"max": "50M"
}
},
"Industrial": {
"sme": {
"average": "395K",
"max": "108M"
},
"large": {
"average": "8.5M",
"max": "55M"
}
},
"Energy": {
"sme": {
"average": "431K",
"max": "15M"
},
"large": {
"average": "1.9M",
"max": "5M"
}
},
"Technology": {
"sme": {
"average": "876K",
"max": "26M"
},
"large": {
"average": "8.2M",
"max": "60M"
}
},
"Pharmaceuticals": {
"sme": {
"average": "62K",
"max": "5.2M"
},
"large": {
"average": "7.4M",
"max": "65.8M"
}
},
"Services": {
"sme": {
"average": "271K",
"max": "30M"
},
"large": {
"average": "3.3M",
"max": "13.2M"
}
},
"Entertainment": {
"sme": {
"average": "318K",
"max": "2.6M"
},
"large": {
"average": "7.4M",
"max": "65.8M"
}
},
"Media": {
"sme": {
"average": "722K",
"max": "11M"
},
"large": {
"average": "7.4M",
"max": "65.8M"
}
},
"Hospitality": {
"sme": {
"average": "182K",
"max": "3.2M"
},
"large": {
"average": "268M",
"max": "268M"
}
},
"Transportation": {
"sme": {
"average": "531K",
"max": "15M"
},
"large": {
"average": "351K",
"max": "598K"
}
},
"Education": {
"sme": {
"average": "172K",
"max": "12M"
},
"large": {
"average": "1.1M",
"max": "2.4M"
}
},
"Research": {
"sme": {
"average": "62K",
"max": "5.2M"
},
"large": {
"average": "7.4M",
"max": "65.8M"
}
},
"Communications": {
"sme": {
"average": "1.6M",
"max": "8.7M"
},
"large": {
"average": "503.3M",
"max": "503.3M"
}
},
"Consumer": {
"sme": {
"average": "62K",
"max": "5.2M"
},
"large": {
"average": "7.4M",
"max": "65.8M"
}
},
"Retail": {
"sme": {
"average": "219K",
"max": "7.5M"
},
"large": {
"average": "12.1M",
"max": "111M"
}
},
"Public": {
"sme": {
"average": "180K",
"max": "4M"
},
"large": {
"average": "2.8M",
"max": "5.5M"
}
},
"Other": {
"sme": {
"average": "62K",
"max": "5.2M"
},
"large": {
"average": "7.4M",
"max": "65.8M"
}
}
}
},
"data": [
{
"half": true,
"link": "https://www.ibm.com/reports/data-breach",
"text": "IBM's annual `Cost of a Data Breach Report` describes cybersecurity threats and their financial impact on organisations."
},
{
"half": true,
"link": "https://netdiligence.com/cyber-insurance-claims-study/",
"text": "NetDiligence's annual `Cyber Claims Study` analyses a rolling five-year average of cybersecurity insurance claims."
},
{
"half": false,
"link": "",
"text": "Together, these two reports illustrate how an organisation can expect to become a victim of cybercrime and how email plays a critical role in cybersecurity, including what to expect if a proactive organisation happens to maintain adequate cybersecurity insurance."
}
],
"disclaimer": {
"content": [
[
"We use USD to maintain consistency with the IBM and NetDiligence reports and to avoid unnecessary complexity.",
"Industrial, Services, Public, and Communications sectors map to NetDiligence categories of Manufacturing, Professional Services, Public Entity, and Telecommunications."
],
[
"We substituted NetDiligence's \"Other\" category for Pharmaceuticals, Research, Consumer, and the \"Large\" numbers for Entertainment and Media.",
"IBM’s missing \"Other\" category uses the average of all other IBM report categories.",
"For methodology questions or localised report requests, contact [email protected]."
]
],
"title": "Notes"
},
"footer": "The magnitude of these financial losses illustrates that action is warranted to mitigate the email attack vector by adopting the modern `DMARC-based email security model`. The cost of action is truly a case of `\"an ounce of prevention is worth a pound of cure\"` — or in this case, a few tons.",
"numbers": [
{
"text": "The `NetDiligence report` shows the global average cost of a data breach per victim to be",
"value": 4.44,
"values": {}
},
{
"text": "The average cost per victim within the `{industry}` industry is",
"value": "",
"values": {
"Healthcare": 7.42,
"Financial": 5.56,
"Industrial": 5,
"Energy": 4.83,
"Technology": 4.79,
"Pharmaceuticals": 4.61,
"Services": 4.56,
"Entertainment": 4.43,
"Media": 4.22,
"Hospitality": 4.03,
"Transportation": 3.98,
"Education": 3.8,
"Research": 3.79,
"Communications": 3.75,
"Consumer": 3.72,
"Retail": 3.54,
"Public": 2.86,
"Other": 4.41
}
}
],
"subtitle": "Two annual industry reports provide up-to-date insights into the damage caused by rampant email fraud:",
"title": "Pain of Inaction"
},
"subtitles": {
"Executive Summary": "Upgrading Email with Domain-based Message Authentication, Reporting, and Conformance (DMARC)",
"Information Security": "Bringing Zero Trust to Email with Domain-based Message Authentication, Reporting, and Conformance (DMARC)",
"Risk Manager": "Cyber Risk Mitigation of Email with Domain-based Message Authentication, Reporting, and Conformance (DMARC)"
},
"titles": {
"Executive Summary": "Executive Summary",
"Information Security": "Information Security",
"Risk Manager": "Risk Management"
}
},
"survey": {
"link": "https://surveys.hotjar.com/39792b98-acf2-4f48-afb9-ca658e52fe69",
"text": "Rate Your Experience"
},
"generalCTA": {
"emea": {
"text": [
"As global email security standards tighten, EMEA businesses need localised compliance tools they can trust. dmarcian provides dedicated, long-term DMARC management featuring native EU data hosting and billing, multilingual support, and local currency payments.",
"Explore our `EMEA resource page`, `start a trial`, or email `[email protected]` for a custom consultation."
],
"links": [
"https://dmarcian.com/dmarc-emea-email-security/",
"https://eu.dmarcian.com/accounts/register/",
"mailto:[email protected]"
]
},
"international": {
"text": [
"As global email security standards tighten, businesses need compliance tools they can trust. dmarcian provides dedicated, long-term DMARC management to upgrade email practices, meet security needs, and fulfill regulatory obligations.",
"Start a trial or email [email protected] for a custom consultation."
],
"links": ["https://dmarcian.com/accounts/register/", "mailto:[email protected]"]
}
}
}