A recent report from U.S.-based email security firm PowerDMARC found that most sectors in Morocco, including banks, have weak email security.
Almost none use the MTA-STS protocol, which protects emails as they travel between servers, leaving them vulnerable to email interception and forgery.
The 2025 Morocco DMARC & MTA-STS Adoption Report, which analyzed 307 domains in sectors like banking, government, healthcare, and education, found that only 36.48% of domains have correctly set up DMARC, a protocol that protects against phishing emails. Meanwhile, 62.21% of domains have no DMARC security at all.
It also found that 22.80% of domains using DMARC have a none policy, offering weak protection, while 6.19% use a quarantine policy, which provides moderate protection. Only 7.49% use the reject policy, offering the strongest protection against email attacks.
The insurance sector leads in DMARC adoption with 66.67%, while the pharmaceutical sector lags at just 12.5%. The insurance industry also uses the strictest reject policy at 11.11%.
The same study revealed that 71.34% of key sectors in Morocco have correctly configured SPF (Sender Policy Framework) records to prevent email spoofing, while 26.06% have no SPF record at all.
The insurance sector leads with 88.89% adoption, showing a strong commitment to email security.
In contrast, the real estate sector has the lowest adoption at 54.55%, followed closely by the automotive sector at 55.56%. This highlights a clear security gap in these sectors that needs urgent attention through improved awareness and stronger email security policies.
The report also highlighted a worrying situation regarding the MTA-STS (Mail Transfer Agent-Strict Transport Security) protocol. None of the sectors in Morocco are using it, despite its importance in ensuring secure email transmission via encrypted SMTP connections.
Without this protocol, warned the same source, there is a risk of email interception and spoofing, along with serious security issues in the SMTP protocol, increasing the chances of downgrade attacks on domains.
The study found that the adoption of DNSSEC (Domain Name System Security Extensions) in Morocco is minimal, with 98.70% of domains not enabling it. The highest adoption of this protocol was seen in real estate at 9.09%, followed by healthcare at 7.41%.
It also revealed that 55% of banking sector domains lack authentication protocol records, while 5% use it with a medium protection policy (quarantine policy). Also, 40% have a none policy, leaving them vulnerable to cyberattacks.
As for SPF, designed to prevent email spoofing, 80% of banking domains have it properly configured, but DNSSEC is disabled in the sector.
The report warned that these security gaps pose a serious threat to Morocco’s digital communications and called for urgent action to improve information security infrastructure.
add your comment
Terms of publication : Not to offend the writer, people, sacred things, or attack religions or the divine self, and refrain from racist incitement and insults.