A campaign doesn't need national prominence to encounter suspicious email activity. During a 30-day review of one campaign for a state-level office, mailbox providers reported 550 messages claiming to be from its domain. Each one failed DMARC authentication.

In fact, DigiCert’s nationwide election research found that four in five of the 3,756 campaign domains reviewed were not enforcing DMARC as of August 21, 2026, making it easier for fraudsters to send spoofed emails.  

Let’s take a closer look at just one campaign and the hundreds of suspicious messages claiming to be sent from its domain.

What one campaign’s reports revealed

During the 30-day review period of one campaign for a state-level office, mailbox providers reported 550 messages using its domain from 413 overseas IP addresses across 41 countries. Every single one failed DMARC, an email authentication standard that helps protect against domain impersonation.

Mailbox providers send aggregate reports to the reporting address listed in a domain’s DMARC record. Valimail, a DigiCert company, organizes those reports to help identify patterns across authenticated and unauthenticated messages.

Much of the activity clustered within a few days. Most sources sent only one or two messages, resembling “snowshoeing,” a tactic that spreads email across many IP addresses to keep each source’s volume low. Abusive senders use this tactic to avoid detection and stay below spam-filter thresholds, making a larger sending operation look like scattered, isolated messages.  

The pattern raises concerns about possible impersonation. However, geography and authentication failures alone do not prove malicious activity—they could just be misconfiguration by the IT team. Legitimate forwarding or incorrectly configured email services can also cause failures. The reports do not reveal message content, who was responsible, or whether messages reached inboxes.

Monitoring doesn't mean blocking

This campaign used DMARC monitoring only (p=none). With reporting enabled, that’s like placing a security camera above an unlocked door: You can see activity, but you haven’t locked the door to keep unwanted visitors out.  
 
Email providers may still stop suspicious messages through their own security checks, but the campaign’s DMARC policy wasn’t explicitly instructing them to block messages that failed authentication.

DigiCert’s nationwide study measured published protections, not attacks. It does not establish that four in five campaigns experienced suspicious activity. It shows that most domains reviewed lacked an important defense against direct domain impersonation.

For voters, that means a familiar campaign name in the inbox deserves verification, whether it belongs to a national candidate or a smaller campaign.

What voters can check before acting

As our article on authentication and identity explains, authentication helps establish whether a message is authorized to use a domain. It cannot establish whether that domain belongs to the intended candidate or whether the message content is true or safe.

Before donating, sharing personal information, or forwarding a campaign email:

• Check the full sender address. Look for misspellings or an unexpected domain.
• Look for sender verification signals. Some email providers display indicators for verified senders, but a familiar logo alone does not establish verification.
• Visit the campaign’s official website independently. Use trusted election records to help confirm the correct campaign before taking action.
• Verify surprising claims. Check a separate, reliable source. If a request seems unusual, contact the campaign through independently obtained contact information.

Verified Mark Certificates (VMCs) and Common Mark Certificates (CMCs) can support validated logos beside authenticated email in participating inboxes. Gmail also shows a verified checkmark for VMC senders.

Check the domain and verify the request

Valimail’s domain checker can show whether a domain publishes an enforcing DMARC policy. It cannot determine whether an individual email is safe.

This one campaign’s reports give voters shows why verification matters. With four in five campaign domains in DigiCert’s study lacking DMARC enforcement, voters have good reason to check the sender and verify requests independently before taking action.

About this analysis: The example covers one campaign over a 30-day period. Its name and other identifying details have been omitted.