The Anatomy of a DMARC Attack

It is relatively easy for an attacker to perform an attack on a DMARC record. One common tactic is called "DMARC record spoofing," in which an attacker alters a DMARC record to redirect email messages to a malicious domain. This can be done by compromising a DNS server or by using a phishing attack to trick a domain owner into providing login credentials for their DNS account.

Another tactic is "DMARC bypass," in which an attacker sends an email that appears to be from a legitimate domain but uses a different “From” address, making it difficult to detect by DMARC. Attackers can also use “subdomain takeovers”, which is when an attacker registers a subdomain that has been abandoned or whose DNS registration has expired and then point it to a malicious server.

Additionally, attackers can use spear-phishing tactics to trick employees of a company into giving away access to the DNS or Email infrastructure, allowing them to alter the DMARC records.

In summary, while DMARC is a powerful tool for protecting against email spoofing, it is not foolproof and it is relatively easy for attackers to circumvent the protection by compromising DNS servers, tricking domain owners, using subdomain takeovers, or spear-phishing tactics.