Fraudulent Emails Bypassing Authentication Surge - New Spoofing Tactics Exploiting DMARC Flaws

The Evolution of Phishing: From Impersonation to Custom Domains

Traditionally, most phishing emails impersonated legitimate companies like Amazon or Apple by using their domains without authorization. However, after Japan's Ministry of Internal Affairs and Communications requested major telecom carriers to implement DMARC (Domain-based Message Authentication, Reporting & Conformance) in September 2025, attackers fundamentally changed their strategy.

When impersonating real company domains, emails face stricter DMARC policies and are more likely to be rejected. Attackers responded by registering their own custom domains and configuring them to pass legitimate authentication checks.

Why "Authenticated" No Longer Means Safe

If attackers configure their custom domains with proper SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) authentication records, their emails will pass DMARC verification. The statistics show a dramatic shift: in December 2025, only about 17.8% of phishing emails using custom domains passed DMARC. By July 2026, this jumped to 94.7%, August to 94.2%, and September to 98.9%.

Critically, DMARC only verifies whether an email is "properly authenticated" — it does not verify whether the sender is trustworthy. A scammer's domain, when properly configured by its owner, will pass DMARC checks. Recipients can no longer assume that authenticated emails are safe.

Sophisticated Tactics Used by Attackers

Attackers use multiple methods in combination to increase success rates:

Parent Domain Exploitation Impersonating related services (e.g., using a domain resembling Amazon Pay instead of Amazon) reduces recipient suspicion.

SPF-Only Validation Attackers may configure SPF to pass while failing DMARC, attempting to bypass some email filters.

Spoofing Recipient Domains Support scam emails often send from addresses appearing to belong to the recipient, creating false familiarity.

How to Identify Phishing: Don't Rely Solely on Sender Information

Use multiple verification methods:

Character Analysis Scammers replace Latin characters with visually similar Cyrillic ones (e.g., "a" with "а"). When suspicious, copy the domain and search for it to verify legitimacy.

Brand Logo Verification Check whether the sender's logo appears in your email client. BIMI (Brand Indicators for Message Identification) displays authenticated company logos. Gmail, Apple iCloud Mail, and au Mail support this feature.

Examine Links and Attachments Unexpected attachments, unusual links, or password prompts are major red flags.

Direct Verification Instead of clicking email links, visit the official website directly or call the company using a publicly listed phone number.

A Multi-Layered Defense Strategy

Email authentication and attack tactics are in constant competition. Effective defense requires coordinated efforts across multiple levels:

What Businesses Should Do Set DMARC policy to "reject" to ensure emails from fake domains are definitively blocked. Implement BIMI to authenticate legitimate mail with company logos.

What Email Services Should Do Enforce DMARC policies consistently, rejecting or quarantining emails that fail authentication.

What Recipients Should Do Use password managers and passkeys (biometric-based authentication) to avoid entering credentials on fraudulent login pages.

How to Report Phishing

If you receive phishing emails:

• Anti-Phishing Council: Reports lead to investigation and response
• National Consumer Affairs Center (NCAC): General fraud consultation hotline (188)
• National Police Agency Cybercrime Countermeasures Project: Criminal offense reporting
• IPA (Information-technology Promotion Agency): Information security consultation

Phishing defense requires both technological safeguards and human vigilance. Individual awareness contributes directly to collective security.