Level finding. 49 of 197 credit unions measured (24.9%, 95% Wilson CI [19.4, 31.4]) publish no enforcing DMARC policy and can therefore be impersonated by email to their own members.
We drew 200 credit unions at random from the regulator's public roster and measured the published email-authentication posture of each, using only public DNS and contacting no one. Of the 197 that were mail-active and on their own domain, about 1 in 4, 49 of 197 (24.9%, 95% Wilson CI [19.4, 31.4]), publish no enforcing DMARC policy, which means a message that did not originate with the credit union can still reach a member's inbox appearing to. Strict protection (p=reject) is present at 32.0% (63/197). SPF is published at 100.0% and DNSSEC is signed at 19.3%. The protocol, frame, seed and draw rule were fixed and frozen before any data was pulled, and the result is published as measured.
Credit unions hold member account and payment data, and members act on email that appears to come from the credit union: a loan document, a fraud alert, a request to verify an account. Email authentication is the public, checkable control that decides whether a message claiming the credit union's domain can be refused by the receiving mail server. A credit union either publishes an enforcing DMARC policy, or impersonating mail can pass. This study measures which, across a random draw from the regulator's own roster.
Frame. Federally insured credit unions with total assets of $250 million to $10 billion and a published website, located in the 50 states or DC, drawn from the NCUA quarterly call-report files (data as of June 30, 2026).
Draw. Each eligible row was ordered by the SHA-256 hash of the seed (20261004) joined to its regulator key, and the first 200 were taken, once, without replacement. The rule is reproducible from the frozen frame file. No draw was replaced after an exclusion.
Measures. Passive public DNS only, read through two public resolver sets. No mail was sent and no credit union was contacted. For each registrable domain we resolved DMARC at _dmarc (presence, policy, parseability; RFC 7489), SPF (presence, tri-state with indeterminate reads excluded rather than counted absent; RFC 7208), DNSSEC by the DNSKEY-at-apex definition (RFC 4033 et seq.), and MX as a mail-active check.
Operational definitions. Spoofable: no enforcing DMARC (record absent, p=none, or unparseable). Protected: p=quarantine or p=reject. Strictly protected: p=reject. Shares carry 95% Wilson score intervals. No significance test and no model are used.
Coverage. Of 200 drawn, 197 were measured. Excluded, and in no denominator: 3 for having no MX record (not mail-active).
49 of 197 credit unions (24.9%, 95% CI [19.4, 31.4]) publish no enforcing DMARC policy. Of those, 4 publish no DMARC record at all and 44 publish a record at p=none; 1 publish a record that does not parse. Any enforcing policy is present at 75.1% (148/197), and strict protection (p=reject) at 32.0% (63/197). Among enforcing records, 6 apply the policy to less than 100% of failing mail.
| Measure | k/n | Share | 95% CI |
|---|---|---|---|
| No enforcing DMARC (spoofable) | 49/197 | 24.9% | [19.4, 31.4] |
| Any enforcing policy | 148/197 | 75.1% | [68.6, 80.6] |
| p=reject | 63/197 | 32.0% | [25.9, 38.8] |
| SPF published | 197/197 | 100.0% | [98.1, 100.0] |
| DNSSEC signed | 38/197 | 19.3% | [14.4, 25.4] |
Two layers agreed. A from-scratch classifier, written separately from the measurement code, reproduced every count from the raw answers. A second resolution pass through a different resolver set agreed on every field for all 197 domains.
This study's interval overlaps banks, and does not overlap veterinary, insurance or advisers. The earlier studies used search-compiled frames of smaller businesses; this study and its two companions draw at random from regulator rosters, so the comparison is between different populations and methods of sampling, not a trend.
Published DNS is a proxy for deployed behavior: a domain without an enforcing policy may still filter inbound mail, and the measure concerns mail that claims the credit union's domain, not mail the credit union receives. DKIM is outside passive scope. The registrable domain derived from the website field is taken as the mail domain; a credit union that sends from a different domain is measured on its website domain. Regulator data are as of the dates stated in the frame.
A credit union that has not yet moved to an enforcing policy can do so with a single DNS change, after a short monitoring period at p=none to confirm that its legitimate senders, including core-processor and statement vendors, align. The measurement above is exactly what any member, or any attacker, can read from the outside.