As reported by Security Affairs, a large-scale analysis of nearly 6,000 domains across 13 industry sectors has confirmed what many email security professionals have long suspected: government and healthcare organizations are consistently failing to implement baseline email authentication controls — leaving millions of citizens, patients, and staff exposed to phishing, spoofing, and business email compromise (BEC) attacks.

Key Takeaway: When a government agency or hospital fails to implement a proper DMARC policy (especially one set to p=reject or p=quarantine), it effectively hands threat actors an open license to impersonate that domain.

Why This Finding Carries Serious Weight

This isn't a novel vulnerability or a zero-day exploit. SPF, DMARC, DKIM, and MTA-STS are mature, well-documented standards with decades of collective development behind them. The fact that entire sectors — particularly those entrusted with sensitive personal, financial, and medical data — are still failing to deploy them at scale is not a technical problem. It's a governance and prioritization problem.

When a government agency or hospital fails to implement a proper DMARC policy (especially one set to p=reject or p=quarantine), it effectively hands threat actors an open license to impersonate that domain. Attackers can send emails that appear to originate from health.gov or citycouncil.org, and many receiving mail servers — and users — will have no technical reason to distrust them.

Shield53 Perspective: A missing or permissive DMARC record isn't a gap in your defenses — it's an active attack surface. Threat actors actively scan DNS records for weak or absent email authentication configurations, then weaponize those domains in targeted campaigns.

The Sector Risk Profile

Government and healthcare domains face a uniquely dangerous combination of factors:

The Sector Risk Profile
High institutional trust: Recipients are conditioned to act on emails from government health agencies, hospitals, and civic authorities — making spoofed messages highly effective.
Sensitive data targets: Healthcare records and government identity data are among the most valuable commodities on criminal marketplaces.
Legacy infrastructure: Both sectors are notorious for aging IT stacks that complicate email authentication rollouts — particularly DKIM, which requires coordination across mail transfer agents and DNS management.
Decentralized IT ownership: Large healthcare networks and municipal governments often have fragmented IT governance, with hundreds of sub-domains managed inconsistently.

Understanding the Four Pillars Being Neglected

SPF (Sender Policy Framework)
Specifies which mail servers are authorized to send on behalf of a domain. Absence allows any server to spoof the domain.
DKIM (DomainKeys Identified Mail)
Cryptographically signs outgoing mail, allowing receivers to verify message integrity and sender authenticity.
DMARC (Domain-based Message Authentication, Reporting & Conformance)
Ties SPF and DKIM together with a policy that instructs receiving servers what to do with unauthenticated mail. Without enforcement mode, DMARC provides visibility but no protection.
MTA-STS (Mail Transfer Agent Strict Transport Security)
Enforces TLS encryption for email in transit, preventing downgrade attacks and interception. The least commonly deployed of the four — and the least understood.

The Broader Implication: Systemic Under-Investment

What makes this analysis particularly concerning is its scale. These aren't isolated misconfigurations — they represent sector-wide patterns. This tells us that procurement and compliance frameworks in these industries are not yet mandating email authentication as a baseline requirement. While CISA's Binding Operational Directive 18-01 pushed U.S. federal agencies toward DMARC adoption years ago, compliance has been uneven, and state, local, and healthcare entities operate under no equivalent hard mandate.

Nation-state actors and financially motivated criminal groups — particularly those running healthcare-targeted BEC campaigns — are almost certainly already exploiting these gaps. The phishing emails spoofing hospital billing departments or public health agencies that reach inboxes daily are enabled, in part, by this systemic failure.

Shield53 Recommendations

For Security and IT Teams in Government & Healthcare

  • Audit every domain and subdomain you own immediately. Use free tools like MXToolbox, dmarcian, or dig to enumerate your DNS records and identify gaps in SPF, DKIM, DMARC, and MTA-STS coverage.
  • Deploy DMARC in monitor mode first (p=none), then escalate. Use reporting (RUA/RUF tags) to identify all legitimate mail streams before moving to p=quarantine and ultimately p=reject. Aim for enforcement within 90 days.
  • Ensure SPF records don't exceed DNS lookup limits (maximum 10 lookups). Overly complex SPF records frequently break authentication silently.
  • Rotate DKIM keys at least annually and ensure all sending platforms (CRMs, marketing tools, ticketing systems) are properly signing outbound mail.
  • Prioritize MTA-STS deployment for domains handling sensitive communications — particularly patient portals, benefits systems, and inter-agency mail.
  • Include email authentication standards in vendor and procurement requirements. Any third-party sending on your behalf must support DKIM signing and align with your DMARC policy.
  • Brief leadership and compliance teams. Email authentication gaps are increasingly a regulatory and liability exposure — particularly under HIPAA, where phishing-enabled breaches carry significant penalties.

For CISOs

This research should serve as a prompt to commission a formal email security assessment if one hasn't been conducted in the past 12 months. Email authentication is table-stakes hygiene — but the data shows it's still far from universal. The reputational and operational damage from a successful domain spoofing campaign targeting your patients or constituents can be severe and long-lasting.