\chapter{Introduction}
Every day, billions of emails are sent around the world, facilitating business transactions and personal communications. Most people assume that when they receive an email from a bank, a colleague, or a trusted company, the sender is who they claim to be. Unfortunately, this assumption is often wrong.


\section{The threat of email spoofing}
Email spoofing is the practice of disguising an email to make it appear as if it comes from someone else. This has become one of the most prevalent and damaging forms of cybercrime. Criminals use spoofed emails to trick victims into revealing passwords, transferring money, clicking malicious links, or downloading malware. These attacks cost businesses and individuals billions of dollars annually and can damage organizational reputations.
According to the FBI's Internet Crime Complaint Center (IC3), Business Email Compromise attacks resulted in losses exceeding \$2.7 billion in 2024 alone \cite{IC3gov}. Organizations face not only direct financial losses but also regulatory penalties, erosion of customer trust and operational disruptions.

The common mechanisms used to protect email are usually: spam filters, blacklists, and reputation-based systems. However, they do not really protect from email spoofing and business email compromise attacks, which are still very effective. 
The main purpose of these mechanisms is to find unsolicited bulk emails or known malicious patterns, but they do not to check if the sender is who they say they are. Modern spoofing and BEC attacks frequently lack malicious attachments or URLs, relying instead on social engineering and impersonation techniques that exploit inherent weaknesses of the SMTP protocol.  
As a result, spoofed emails often appear legitimate and bypass content-based and reputation-based filtering mechanisms, reaching recipients’ inboxes without triggering security alerts.

 
\section{DMARC as a solution for domain authentication}
In order to address the structural limitations of traditional email security mechanisms, domain-based authentication protocols (such as DMARC) have been introduced.

Domain-based Message Authentication, Reporting, and Conformance (DMARC) is an email security protocol that helps organizations protect their domain name from being misused to send fraudulent emails. DMARC is built on other systems, called SPF and DKIM, which already help verify if an email is genuinely sent from an authorized source.

In practical terms, DMARC allows organizations to publish a set of rules ("policy") that tells email providers what to do if they receive a suspicious email or fail security checks (e.g., whether to deliver it, move it to spam, or block it altogether). Furthermore, DMARC requires email providers to send regular reports to the organization, helping them to see if anyone is trying to misuse their domain and letting them monitor which emails are being sent on their behalf.

In general, DMARC strengthens trust in email communication by ensuring that legitimate emails are more likely to be delivered, while malicious or fake emails are detected and stopped before reaching the recipient. This makes DMARC an essential tool not only for cybersecurity professionals, but also for organizations that want to protect their reputation and contacts from fraud \cite{dmarcRFC}.


The significance of adopting this protocol is illustrated by the following images (Figure \ref{fig:dmarcusage}).
The figure on the left represents the percentage of DMARC usage in the EU in 2023. The countries with the highest support rates were Austria, Belgium, the Netherlands, and the Czech Republic, with rates exceeding 70\%. Italy followed closely behind, with approximately 60\% of the population in support.

The figure on the right presents the support rate for the year 2025. A marked increase in the utilization of DMARC has been observed. Indeed, the overwhelming majority of EU countries have demonstrated support rates in excess of 80\%, with certain nations attaining rates of up to 100\%.
\begin{figure}[h!]
\centering
\begin{subfigure}{0.49\textwidth}
\centering
\includegraphics[width =\textwidth]{dmarc2023usage.pdf}
\end{subfigure}
\begin{subfigure}{0.49\textwidth}
\centering
\includegraphics[width =\textwidth]{dmarc2025usage.pdf}
\end{subfigure}
\caption{DMARC 2023 and 2025 Support Rate (source: \href{https://ec.europa.eu/internet-standards/email.html}{ec.europa.eu})}
\label{fig:dmarcusage}
\end{figure}



\section{Scope and objectives}
The technical objective of this work was the design and the analysis of a DMARC verification tool, that is capable of: record syntax validation, assessing policy enforcement levels, identifying misconfigurations, and supporting forensic interpretation of email authentication data.

Beyond technical validation, this thesis explores the role of DMARC configuration as forensic evidence in legal disputes related to email fraud. Furthermore, the examination of how authentication records may support attribution and liability assessment is analyzed.

The contribution of this thesis lies in the integration of technical DMARC analysis with forensic and legal perspectives, thus providing a practical framework for assessing both security posture and potential domain owner responsibility.



\section{Research questions (Email spoofing: motivation, risks, examples)}
The practice of email spoofing poses a persistent and escalating threat in the context of contemporary digital communications. This threat is predicated on the exploitation of fundamental vulnerabilities inherent in protocols that were designed in an era preceding the advent of widespread security concerns. The ease with which malicious actors can forge sender identities creates substantial risks for organizations and individuals. However, despite DMARC's demonstrated effectiveness in preventing domain impersonation, adoption rates remain concerningly low. Global statistics reveal that only 18.2\% of the top 10 million domains have implemented DMARC records, and merely 7.6\% of domains with DMARC have progressed to enforcement-level policies ("\textit{p=quarantine}" or "\textit{p=reject}") \cite{dmarcadoption}.
The support rate percentage of "\textit{p=strict}" policy divided by country remains at a relatively low level, as illustrated in the Figure \ref{fig:dmarcstrict}. The mean support rate percentage hovers around 30-40\%, with Italy exhibiting a below-average rate of 25\%. This predicament is particularly salient for the numerous companies that are susceptible to spoofing attacks without implementing countermeasures.

\begin{figure}[h]
    \centering
    \includegraphics[width=0.4\linewidth]{dmarc2025STRICTusage.pdf}
    \caption{DMARC Strict Policy Support Rate - Q3 2025}
    \label{fig:dmarcstrict}
\end{figure}

The impact of a successful email spoofing attack is best illustrated through real-world incidents, where attackers exploit weaknesses in email authentication and organizational trust mechanisms. 
Between April and May 2025, a bioscience company based in India suffered a fraud incident. Attackers impersonated a U.S.-based executive by falsifying the sender's email address and registering a domain name almost the same as the legitimate supplier. Through this impersonation, the Indian company was deceived into transferring \faInr$33.5$ ($\approx$ \texteuro$400.000$) to a fraudulent bank account. Thanks to the intervention of law enforcement authorities, a significant portion of the money was then recovered. \cite{indianFraud}

Many years before, in 2016, the Austrian aerospace company \textit{FACC} was hit by a cyber fraud that costed around \texteuro$42$ millions. Attackers acted by posing as the CEO of the company in an email. This fraudulent email asked an employee to transfer money for a fake project. The company did not disclose the manner in which the CEO violated his security duties; however, it was stated that, of the \texteuro$42$ million that was lost, only \texteuro$11$ million was able to be blocked from being fraudulently transferred. \cite{austrianFraud}

These cases highlight how the absence of of effective email authentication mechanisms can lead to substancial financial losses, despite the avilability of well-established technical countermeasures.


Organizations cite multiple barriers to DMARC enforcement, such as complexity of fragmented email infrastructures involving numerous third-party services, fear of blocking legitimate communications, lack of internal expertise.

This thesis will investigate how DMARC and supporting authentication technologies can effectively prevent email spoofing while examining the technical, organizational, and legal factors that either facilitate or impede comprehensive implementation.

Central research questions include: 
\begin{itemize}
	\item What technical and operational approaches most effectively detect and prevent email spoofing? 
	\item What legal frameworks establish domain owner responsibilities for email authentication? 
	\item What forensic methodologies enable attribution of spoofed emails?
\end{itemize}




\section{Thesis structure}

\begin{itemize}
    \item Chapter 2 - Background: this section aims to provide the basic background knowledge needed to understand the main topic of this thesis work. It begins with an overview of Email fundamentals necessary to contextualize the problem, then SPF, DKIM and DMARC are explored in order to understand how they work together and how they should then be correctly configured.
    
    \item Chapter 3 - State of the Art: in this section, the state-of-the-art for DMARC implementation and configuration is analyzed.

    \item Chapter 4 - Legal Responsibility of Domain Owners: this section analyzes the legal accountability for domain owners and the risks they may face in case of violation.

    \item Chapter 5 - Insights of existing DMARC checker and Forensic tools: in this chapter, a first analysis of already commercial existing tools is executed.
    
    \item Chapter 6 - DMARC Forensic tool technical analysis, this section provides a deeper technical analysis of the tool published by Prof. Dal Checco, considering what features can be added, leading to the design of the domain analyzer tool later developed.
    
    \item Chapter 7 - Impersonation Risk assessment tool: in this chapter the first practical contribution is presented, providing examples and results.
    
    \item Chapter 8 - Experimental Email testbed for DMARC enforcement and forensic evidence collection: in this section is presented the second practical contribution, an experimental laboratory which simulates the effectiveness of domain-based authentication protocols in a controlled email environment.
    
    \item Chapter 9 - Conclusion: this final chapter summarises the obtained results and provides some analysis and ideas for future features integrations.
\end{itemize}
