{"id":30144,"date":"2022-09-26T11:56:49","date_gmt":"2022-09-26T11:56:49","guid":{"rendered":"https:\/\/easydmarc.com\/blog\/?p=30144"},"modified":"2023-09-27T10:24:01","modified_gmt":"2023-09-27T10:24:01","slug":"dmarc-and-educational-institutions-in-the-usa","status":"publish","type":"post","link":"https:\/\/easydmarc.com\/blog\/dmarc-and-educational-institutions-in-the-usa\/","title":{"rendered":"DMARC and Educational Institutions in the USA"},"content":{"rendered":"

Amid and post the worldwide pandemic, most industries have relied primarily on digital, and educational institutions in the USA are no exception. However, as much as these institutions are enjoying the benefits of online operations, they’re jeopardizing the security of students, staff, and other stakeholders. They exchange unsecured emails for communication, and hackers know how to exploit such security vulnerabilities.<\/span><\/p>\n

Per a <\/span>public service announcement<\/span> issued by the FBI, threat actors<\/a> have found ways to use institutions’ email domains to send fraudulent emails to students with a promise of employment. The emails contain information about fictitious positions, and victims are tricked into purchasing software before they start the “job.” The software may or may not contain malware, but those who fall for the trick, lose money.\u00a0<\/span><\/p>\n

This is only one example of how bad actors leverage university email addresses. However, there are ways to keep the domains free of phishing and spoofing attacks. Enter <\/span>EasyDMARC’s<\/span><\/a> expert team with their research about email security practices of educational institutions in the USA. Keep reading till the end to learn everything about what they found.\u00a0<\/span><\/p>\n

But before that, let’s briefly discuss the US education system.<\/span><\/p>\n

Education Institutions and Stages in the USA<\/b><\/h2>\n

Education in the USA is offered through private schools, public schools, and homeschooling. The overall standards are set and supervised by the state government. Compulsory education consists of three levels: elementary, middle (junior) school, and high school.<\/span><\/p>\n

Elementary school, also called primary school, is the first seven to nine years of formal education. Middle or junior schools are varying combinations of grade fifth to grade ninth. In this stage, students get more independence and study subjects like math, social studies, science, English language, arts, and sometimes other foreign languages. High school is the final stage of secondary education in the USA, most of which include grades ninth to twelfth. Typically, high school students fall under the age range of 14 to 19 years.<\/span><\/p>\n

Secondary education includes people with a high-school diploma going to colleges and universities for a specialization. To receive a bachelor’s degree (BA), an individual must go through four university years. As an option, students can spend their first two years at a community college and then transfer to a four-year college. Individuals who don’t want a BA can complete an associate degree, which they can acquire in two years.<\/span><\/p>\n

Graduate school allows for a master’s or a doctoral degree. It advances the students into the field of study and usually includes research or fieldwork.<\/span><\/p>\n

What is DMARC?<\/b><\/h2>\n

Everyone’s obsessed with cybersecurity these days. However, in most cases, it doesn’t show. There are a few reasons for this, but the heftiest one is that cybersecurity is hard to achieve. While everyone uses email as a communication method, it remains one of the most neglected areas of cybersecurity. DMARC spooks many business decision-makers. But let’s diffuse your fears.\u00a0<\/span><\/p>\n

DMARC, or Domain-Based Message Authentication, Reporting, and Conformance, is an email authentication protocol that uses SPF and DKIM to evaluate the authenticity of emails sent from your domain.\u00a0<\/span><\/p>\n

SPF or Sender Policy Framework enlists all hostnames and IP addresses permitted to send emails using a specific domain. Senders outside of that list are recognized as inauthentic. DKIM or DomainKeys Identified Mail uses digital signature encryption for email authentication. An encrypted signature goes to the recipient’s server along with an email to verify its authenticity.\u00a0<\/span><\/p>\n

Since DMARC is based on SPF and DKIM results, at least one of them has to be in place. You need to publish a DMARC record in the DNS to direct recipients’ servers to how to treat your emails as per the policies.\u00a0<\/span><\/p>\n

DMARC has three policies:<\/span><\/p>\n