Ahead of the 2026 Midterms, DigiCert Finds 82% of U.S. Campaign Domains Lack Full Protection Against Email Impersonation

Analysis of 3,756 campaign domains finds many campaigns do not tell email providers to quarantine or reject spoofed messages

LEHI, Utah - September 22, 2026 - DigiCert, a global leader in intelligent trust, today released The 2026 Election Trust Check, an analysis of U.S. political campaign domains across all 50 states. The research found that 82% were not enforcing protections that help prevent fraudulent emails from reaching voters. With the 2026 midterms approaching, this leaves a major channel for fundraising, volunteer recruitment, and voter outreach vulnerable to fraud. 

DigiCert reviewed publicly available email-authentication records for 3,756 campaign domains across the country. The company looked at whether campaigns use Domain-based Message Authentication, Reporting and Conformance (DMARC), a tool that tells email providers to block or quarantine messages that were sent by servers, which do not pass authentication checks. Enforcement rates were similarly low for both major parties.

A campaign domain is the internet identity associated with a campaign, such as “candidate.com.” It may appear in both the campaign’s website URL and its email addresses. Because voters may view a familiar domain as a sign of legitimacy, attackers can spoof it to solicit money, steal information, direct recipients to fraudulent websites, or spread misinformation.

Key findings

• Only 18% of campaign domains enforce DMARC.
• 38% monitor but do not enforce campaign domains, which means email providers aren’t asked to quarantine or reject suspicious messages.

“When voters receive an email asking for their support, personal information or a donation, they should be confident it truly came from the campaign,” said Al Iverson, Industry Research and Community Engagement Lead at Valimail, a DigiCert company. “Monitoring suspicious email is a good start, but it does not stop impersonators. By turning on enforcement, campaigns can help email providers block fraudulent messages before they reach voters.” 

DMARC does not stop every form of phishing, but it addresses a specific risk: unauthorized use of a campaign’s exact domain. CISA recommends DMARC and SPF to help protect election-related email from spoofing and phishing.

Read The 2026 Election Trust Check, for the full findings and steps campaigns can take to strengthen email protection. DigiCert offers free assisted DMARC enforcement through Valimail, a DigiCert company. Campaigns that have reached enforcement can pursue BIMI and a DigiCert Mark Certificate to display a validated logo in participating inboxes.

Methodology

Using official election authorities and documented secondary sources, DigiCert built a nationwide dataset of 5,597 candidate records and identified 3,756 unique campaign domains. On August 21, 2026, DigiCert examined publicly observable DNS records for DMARC, SPF and BIMI. Policies of p=quarantine or p=reject were classified as enforcement; p=none was classified as monitoring.

This point-in-time analysis relied solely on public DNS data and did not access campaign systems, email accounts or sending platforms. It does not establish whether a campaign experienced spoofing, whether specific messages reached inboxes or whether email authentication affected an election outcome.

About DigiCert

DigiCert is a global leader in intelligent trust. We protect the digital world by ensuring the security, privacy, and authenticity of every interaction. Our AI-powered DigiCert ONE platform unifies PKI, DNS, and certificate lifecycle management to secure infrastructure, software, devices, messages, and AI content, agents, and models. Learn why more than 125,000 organizations, including 90% of the Fortune 500, choose DigiCert to stop today’s threats and prepare for a quantum-safe future at www.digicert.com.