DigiCert Finds 82% of Campaign Domains Lack Email Protection

Lehi, Utah, Sept. 22, 2026 /CourierPR/ -- DigiCert, a global leader in intelligent trust, today released The 2026 Election Trust Check, an analysis of U.S. political campaign domains across all 50 states. The research found that 82% of campaign domains were not enforcing protections that help prevent fraudulent emails from reaching voters. This leaves a major channel for fundraising, volunteer recruitment, and voter outreach vulnerable to fraud, as attackers can spoof these domains to solicit money, steal information, direct recipients to fraudulent websites, or spread misinformation.

The research, which reviewed publicly available email-authentication records for 3,756 campaign domains across the country, found that only 18% of these domains enforce Domain-based Message Authentication, Reporting and Conformance (DMARC). DMARC is a tool that tells email providers to block or quarantine messages that were sent by servers that do not pass authentication checks. Additionally, 38% of the domains monitor but do not enforce campaign domains, meaning email providers are not asked to quarantine or reject suspicious messages.

This leaves a significant vulnerability in the system, as voters may view a familiar domain as a sign of legitimacy, allowing attackers to spoof it to solicit support, personal information, or donations. The research also revealed that 90% of the Fortune 500 organizations choose DigiCert to stop spoofing and phishing, underscoring the importance of email authentication in preventing such attacks.

DigiCert offers free assisted DMARC enforcement through Valimail, a DigiCert company, for campaigns that have reached enforcement. Campaigns that have implemented DMARC can pursue BIMI (Brand Indicators for Message Identification) and a DigiCert Mark Certificate to display a validated logo in participating inboxes, further enhancing the security of their email communications.

The 2026 Election Trust Check highlights the critical need for campaign domains to enforce DMARC and other email authentication measures to protect against email impersonation and fraud. As the 2026 midterms approach, this vulnerability could have significant implications for campaigns' ability to effectively communicate with voters and conduct their operations securely.