I am sorry, but what the fuck? CIA's DMARC record is set to none. For those who do not know, DMARC is a thing that prevents people from sending emails from your email address. This basically means that anyone could (although illegally, and logs would be kept on CIA's servers) send emails from, for example, [email protected]. Are they trying to trap & catch criminals? Or did they just... forget to set it back to reject spoofed emails?
So I wanted to look into how many other US .gov domains have bad DMARC records or none at all. I got a full list of all US .gov domains (https://github.com/cisagov/dotgov-data/blob/main/current-full.csv), and built a python script to separate the text from the domain, then scanned the domains for DMARC records, and then if they are set to none (let spoofed emails through) or null (no DMARC record) to add them to a list. There are 1024 .gov domains with bad DMARC records. There could be even more, as my script only checked if p=reject. If, for example, a domain had p=reject but sp=none, or it had pct lower than 100, that domain would also be vulnerable. This means that you could send spoofed emails from 1024 .gov domains. This list includes security agencies, cities, states, federal agencies, programs, initiatives, and a lot more. Here is the list for those that want to laugh at the US government gist.github.com/MeLikeFish/e0a772b751ba84cba3cd6e9a9c7bd1bd
Update:
The CIA fixed their DMARC records. Now spoofed emails go to spam.
So, the US definitely isn’t the only one. For example, the Czech state police and the justice system also has invalid dmarc records.
This seems to be a wide spread issue with most systems, entities, or governments, that never felt the need to contract a pentester to test their systems. The fact that google, Microsoft, and most domain providers never say anything about the invalid DMARC records also doesn’t help the problem.














