Ask the Community
Groups
Does DMARC block all types of phishing attacks? - Connect IT Community | Kaseya
<main> <article class="userContent"> <p>No. DMARC is only designed to protect against direct domain spoofing. If the owners/operators of <code class="code codeInline" spellcheck="false" tabindex="0"><a rel="nofollow" href="/home/leaving?allowTrusted=1&target=http%3A%2F%2Fexample.com">example.com</a></code> use DMARC to protect that domain, it would have no effect on <code class="code codeInline" spellcheck="false" tabindex="0"><a rel="nofollow" href="/home/leaving?allowTrusted=1&target=http%3A%2F%2Fotherdomain.com">otherdomain.com</a></code> or <code class="code codeInline" spellcheck="false" tabindex="0"><a rel="nofollow" href="/home/leaving?allowTrusted=1&target=http%3A%2F%2Fexample.net">example.net</a></code> (notice the ".net" vs. ".com").</p> <p>While impersonating a given domain is a common method used for phishing and other malicious activities, there are other attack vectors that DMARC does not address. For example, DMARC does not address cousin domain attacks (i.e. sending from a domain that looks like the target being abused - e.g. <code class="code codeInline" spellcheck="false" tabindex="0"><a rel="nofollow" href="/home/leaving?allowTrusted=1&target=http%3A%2F%2Fexampl3.com">exampl3.com</a></code> vs. <code class="code codeInline" spellcheck="false" tabindex="0"><a rel="nofollow" href="/home/leaving?allowTrusted=1&target=http%3A%2F%2Fexample.com">example.com</a></code>), or display name abuse (i.e. modifying the "From" field to look as if it comes from the target being abused).</p> </article> </main>