Only seven out of 21 US presidential candidates have implemented DMARC on their domains' email, a basic security feature that could have prevented the DNC hack
Just one-third of the 2020 U.S. presidential candidates are using an email security feature that could prevent a similar attack …
Context & Ripple Effects
This finding lands after two years of documented failure on the same control: Democratic campaigns were still struggling with basic email security in late 2018, the White House was caught out of compliance with a DHS directive on sender verification in April 2018 (outgoing White House emails failed DMARC checks), and even CIA, NSA and DOD domains missed the DHS deadline that October (federal agencies had yet to implement DMARC across all their domains).
The gap persists into the 2020 cycle despite measurable progress at the top of the party: a May 2019 [[a:942041|SecurityScorecard report found the DNC had improved since the 2016 hacks but still lagged behind the RNC]]. With one-third of presidential campaigns now using DMARC, the pattern suggests security hygiene follows headlines rather than directives.
First-order effects
- Fourteen of 21 presidential campaigns remain spoofable right now: attackers can forge email from their domains to donors, volunteers and reporters with no authentication check to stop it.
- The campaigns that did deploy DMARC gain a defensible trust position they can point to, while laggards face renewed pressure from security researchers publishing these audits each cycle.
Second-order effects
- Campaign vendors and consultants managing candidate domains get pulled into the remediation work, shifting email-security responsibility from campaigns themselves to the firms that run their infrastructure.
- Downstream targets absorb the risk: state parties, county election offices and voter-contact operations inherit forged-email exposure when national campaigns leave their domains unauthenticated, as the Texas county malware attack later showed for local election infrastructure.
Third-order effects
- If repeated audits keep showing voluntary compliance failing across campaigns, agencies, and the executive branch alike, the likely endpoint is mandatory enforcement — binding requirements rather than DHS directives — for political and government email domains.
- Email authentication becomes a standing audit category for political organizations, with third-party security scoring of campaigns normalizing between election cycles as it already has for the parties.
The trend: Political email security in the US is converging on authenticated-by-default infrastructure, but adoption continues to lag years behind each headline hack until mandates or audits force compliance.