SHARED INTEL Q&A: 82% of campaign domains expose donors to email fraud before midterms

The FBI is warning voters to be wary of anyone asking for campaign money this fall.

Related: Sorting AI phone calls

In an Oct. 15 alert, the agency said scammers are using candidates’ names, logos and AI-generated voices and messages to solicit donations and steal personal information ahead of the Nov. 3 midterms. A day later, the FBI and CISA urged campaigns to lock down their email, including steps to limit domain spoofing.

Fresh DigiCert research shows how much ground remains. Its 2026 Election Trust Check examined 3,756 campaign domains in all 50 states. Only 18 percent enforce DMARC, the setting that tells email providers to reject or quarantine messages sent without permission.

Another 38 percent turned on monitoring and stopped there. They can see an impersonator at work. They can’t block one. The gap is as wide for both parties.

The danger is fraud against voters. Scammers can send email that appears to come straight from a real campaign’s domain, urging supporters to donate or update their personal details. The money and the data go to the crooks.

An old, solved problem

When a campaign asks for our money and our trust, the email itself should be trustworthy. The same goes for any organization that relies on its inbox.

Campaigns are simply the most visible case of a broader pattern. Organizations everywhere switch on DMARC monitoring, then stall before enforcement. Retailers and manufacturers have made the most progress. Even financial services, where trust is everything, still has ground to cover.

The irony is that this is an old, well-understood problem with a proven fix. AI hasn’t made it obsolete. It has made it cheaper to exploit, as convincing phishing becomes easy to produce at scale.

Old threats still open

Al Iverson has spent his career protecting the inbox, helping legitimate senders get through and keeping impersonators out. He’s Industry Research and Community Engagement Lead at Valimail, a DigiCert company, and writes the Spam Resource blog.

His view: AI and agentic threats deserve attention, but the “old” threats are still out there and broadly unsolved. Email remains the best communication medium on earth, and it deserves better protection.

Last Watchdog engaged Iverson to discuss why enforcement stalls, what it leaves exposed and what can still be fixed. Here’s that exchange, edited for clarity and length.

LW: What jumped out at you in the campaign-domain findings?

Iverson: I’m disappointed. DMARC is a valuable protection against phishing and spoofing. Earlier this year, our State of DMARC report looked at a dozen industries and found about 42% of domains at enforcement. Political campaigns are 24 points lower, at 18%. Some industries really get it. Retail and manufacturing are at 72% and 67%. Political email senders have a long way to go.

LW: The FBI and CISA just urged campaigns to adopt SPF and DKIM. Where does DMARC enforcement fit?

Iverson: Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) prove you’re who you say you are. They tie an authenticated identity to your domain. The third leg, and a very important one, is DMARC at enforcement. SPF and DKIM provide the positives. DMARC says what to do when mail fails those checks. It tells mailbox providers like Gmail, Yahoo and Microsoft, “Don’t trust or deliver this mail.”

LW: Why do so many organizations stop at monitoring?

Iverson: There’s a risk with DMARC that you’ll accidentally tell the world to block your legitimate email. To reach enforcement, you must be confident you’re authenticating every message you send, from every platform you use. That can be a scary hill to climb. Get it wrong, and enforcement blocks your own mail.

The fix is the right tools, monitoring and reporting. Get the data and the confidence that you’ve identified every legitimate source, from email service providers to CRMs. Ongoing monitoring then tells you if anything breaks.

LW: What does a monitoring-only domain leave open to voters?

Iverson: It tells mailbox providers: If you see a spoofed email, report it, but deliver it anyway. It’s the worst of all possible worlds. You can tell when email is spoofed, but you’re not asking anyone to keep it out of the inbox.

LW: Financial services is ahead of most sectors. What can others learn from it?

Iverson: Banks learned long ago to protect where the money is. A convincing fake bank email can trick someone into giving up credentials, with terrible financial consequences. Retailers and manufacturers realize this, too. Commerce happens in email, or email leads to commerce. When a candidate emails you, they’re very often asking for money. Protect email, and you’re protecting commerce, the money and the user.

Our data shows financial services at just under 60% enforcement, though at least 80% of those domains have some form of DMARC in place. That category includes more than banks, so I suspect banks on their own are a bit higher. Still, companies in almost every sector aren’t fully protecting their domains.

LW: How does AI change the risk of leaving this gap open?

Iverson: Phishing doesn’t only trick the unsophisticated. Bad guys are really good at crafting emails that fool smart people, too. Now they’re using AI to personalize malicious messages at scale, something they couldn’t easily do before.

This isn’t a knock on any particular LLM. However many guardrails the well-known AI systems have, and we need more, bad actors will find ways to bend them. That’s before counting local, open-source models that can be modified, feeding an underground ecosystem of malicious tools most people have never heard of.

LW: What can campaigns, or any organization, realistically do right now?

Iverson: Authenticate every email you send. No exceptions. Set up DMARC and get to enforcement quickly. If you need help, get it from us, others in the industry or volunteer groups like Defending Digital Campaigns.

If you manage digital messaging for a campaign and want help with DMARC reporting and enforcement, reach out to us at support@valimail.com. I’ll gladly take point on getting your monitoring in place, your email authenticated and your domain to enforcement.

Every major email platform publishes instructions for setting up DKIM. Microsoft 365 and Google Workspace are two good places to start.

LW: You say the “old” threats remain unsolved. What should board members take away?

Iverson: When I talk about online security, people are most concerned with “the new hotness.” Agentic AI attacking remote systems on its own. LLMs breaking out of their guardrails. Brand-new ways to scale attacks and find vulnerabilities.

Those threats are real. But they’re not the only ones.

Phishing and spoofing are the perfect example of old threats that remain unsolved. AI may accelerate them, but they’re far from new.

Internet email was built so anyone could send a message from anyone, to anyone, using any domain, through any server. Authentication came later, almost as an afterthought. It took years for mailbox providers to broadly support SPF, DKIM and DMARC. These are the things that protect email. Implement them. They work.

Pulitzer Prize-winning business journalist Byron V. Acohido is dedicated to fostering public awareness about how to make the Internet as private and secure as it ought to be.

(Editor’s note: This journalist-led report was produced with underwriting support from some of the featured companies, while Last Watchdog retained full editorial control. I use AI as a tool to help me gather evidence, test ideas and draft. I supply the direction, the critical thinking and the vigilance. I stand behind every claim and conclusion.)

The post SHARED INTEL Q&A: 82% of campaign domains expose donors to email fraud before midterms first appeared on The Last Watchdog.