Level finding. 43 of 196 community banks measured (21.9%, 95% Wilson CI [16.7, 28.2]) publish no enforcing DMARC policy and can therefore be impersonated by email to their own customers.
We drew 200 community banks at random from the regulator's public roster and measured the published email-authentication posture of each, using only public DNS and contacting no one. Of the 196 that were mail-active and on their own domain, about 1 in 5, 43 of 196 (21.9%, 95% Wilson CI [16.7, 28.2]), publish no enforcing DMARC policy, which means a message that did not originate with the bank can still reach a customer's inbox appearing to. Strict protection (p=reject) is present at 53.1% (104/196). SPF is published at 100.0% and DNSSEC is signed at 37.2%. The protocol, frame, seed and draw rule were fixed and frozen before any data was pulled, and the result is published as measured.
Community banks hold customer account and payment data, and their customers act on email that appears to come from the bank: a changed wire instruction, a security alert, a request to confirm details. Email authentication is the public, checkable control that decides whether a message claiming the bank's domain can be refused by the receiving mail server. A bank either publishes an enforcing DMARC policy, or impersonating mail can pass. This study measures which, across a random draw from the regulator's own roster.
Frame. Active FDIC-insured institutions with total assets of $250 million to $10 billion and a published website, located in the 50 states or DC, drawn from the FDIC BankFind Suite institutions dataset (data as of June 30, 2026).
Draw. Each eligible row was ordered by the SHA-256 hash of the seed (20261003) joined to its regulator key, and the first 200 were taken, once, without replacement. The rule is reproducible from the frozen frame file. No draw was replaced after an exclusion.
Measures. Passive public DNS only, read through two public resolver sets. No mail was sent and no bank was contacted. For each registrable domain we resolved DMARC at _dmarc (presence, policy, parseability; RFC 7489), SPF (presence, tri-state with indeterminate reads excluded rather than counted absent; RFC 7208), DNSSEC by the DNSKEY-at-apex definition (RFC 4033 et seq.), and MX as a mail-active check.
Operational definitions. Spoofable: no enforcing DMARC (record absent, p=none, or unparseable). Protected: p=quarantine or p=reject. Strictly protected: p=reject. Shares carry 95% Wilson score intervals. No significance test and no model are used.
Coverage. Of 200 drawn, 196 were measured. Excluded, and in no denominator: 4 for having no MX record (not mail-active).
43 of 196 community banks (21.9%, 95% CI [16.7, 28.2]) publish no enforcing DMARC policy. Of those, 3 publish no DMARC record at all and 40 publish a record at p=none. Any enforcing policy is present at 78.1% (153/196), and strict protection (p=reject) at 53.1% (104/196). Among enforcing records, 3 apply the policy to less than 100% of failing mail.
| Measure | k/n | Share | 95% CI |
|---|---|---|---|
| No enforcing DMARC (spoofable) | 43/196 | 21.9% | [16.7, 28.2] |
| Any enforcing policy | 153/196 | 78.1% | [71.8, 83.3] |
| p=reject | 104/196 | 53.1% | [46.1, 59.9] |
| SPF published | 196/196 | 100.0% | [98.1, 100.0] |
| DNSSEC signed | 73/196 | 37.2% | [30.8, 44.2] |
Two layers agreed. A from-scratch classifier, written separately from the measurement code, reproduced every count from the raw answers. A second resolution pass through a different resolver set agreed on every field for all 196 domains.
This study's interval overlaps credit unions, and does not overlap veterinary, insurance or advisers. The earlier studies used search-compiled frames of smaller businesses; this study and its two companions draw at random from regulator rosters, so the comparison is between different populations and methods of sampling, not a trend.
Published DNS is a proxy for deployed behavior: a domain without an enforcing policy may still filter inbound mail, and the measure concerns mail that claims the bank's domain, not mail the bank receives. DKIM is outside passive scope. The registrable domain derived from the website field is taken as the mail domain; a bank that sends from a different domain is measured on its website domain. Regulator data are as of the dates stated in the frame. "Community bank" here means the asset band above, not the FDIC Community Banking Study definition; savings institutions in the band are included.
A bank that has not yet moved to an enforcing policy can do so with a single DNS change, after a short monitoring period at p=none to confirm that its legitimate senders, including core-processor and statement vendors, align. The measurement above is exactly what any customer, or any attacker, can read from the outside.