01 / Key Findings
Supply-Chain Spoofing Signals
557 observed companies are still outside clear DMARC enforcement.
Compares expiring primes with connected suppliers using the same observed-DMARC denominator.
562 observed companies have DoD, a service branch, or a defense agency as their top observed buyer; the table below lists those buyer rows separately.
Shows where email authentication risk concentrates by supplier market, not just by company count.
Spoofing risk is most useful when it is read through the contract chain. A non-enforcing DMARC posture at a connected supplier is not just an email hygiene issue; it can become believable impersonation surface around teaming, invoicing, onboarding, and recompete communications.
The DoD-linked portion of this sample gives the report its sharper sales value: it connects observable email-authentication posture to buyer ecosystems, expiring prime contracts, supplier relationships, and capability segments instead of treating every company as an isolated domain.
The industry view is the strongest prospecting lens. Capability segments with lower enforcement or larger no-record populations are better campaign targets because the story is concrete: these are the supplier markets where spoofed procurement and vendor communications can blend into ordinary contract activity.
02 / Exposure View
Where supplier email exposure concentrates
This view links email authentication to the actual buying ecosystem: which supplier bases enforce DMARC, which capability segments lag, and where spoofing exposure can still sit behind recompetes.
Spoofing risk follows the contract chain
The same email control gap looks different when it sits behind a recompete, a prime/sub relationship, or a buyer-linked supplier base. This graph connects buyer exposure, supplier role, industry segment, and DMARC posture.
DMARC Distribution Across the Cohort
Spoofing-Risk Reading
Between published p=none (18%) and present-but-unclassified DMARC records (13%), plus domains with no DMARC record observed (0%), a large slice of the contractor base still leaves room for supplier and invoice-spoofing campaigns to blend in.
That aggregate covers 562 observed companies assigned to DoD, a military service branch, or a defense agency as their top observed buyer. The agency table keeps those components as separate line items, so its single Department of Defense row is narrower than this aggregate.
The distribution is calculated on observed DMARC rows, then broken out by procurement agency, company role, award footprint, and industry so the story is about where exposure sits, not just whether a TXT record exists.
Buyer-Linked Supplier Bases by Enforcing Share
Industry / Capability Enforcement Map
03 / Data
Report Tables
Overall DMARC Distribution
Distribution across 1,770 companies with observed DMARC posture in the sampled DoD recompete and supply-chain company set.
| DMARC state | Observed companies | Share of observed |
|---|---|---|
| Reject | 669 | 38% |
| Quarantine | 488 | 28% |
| Enforced / policy variant unspecified | 56 | 3% |
| None | 321 | 18% |
| Present / unclassified | 236 | 13% |
| No DMARC record observed | 0 | 0% |
Agency Cohort Breakout
Contextual agency view. Companies are in this report because of the DoD recompete/supply-chain sample; defense components are listed separately here, while the hero DoD-linked metric combines DoD, service branches, and defense agencies.
| Top buying agency | Observed contractors | Enforcing DMARC | p=none |
|---|---|---|---|
| Department of Defense | 533 | 71% | 14% |
| Department of Veterans Affairs | 42 | 69% | 19% |
| National Aeronautics and Space Administration | 25 | 64% | 16% |
| Department of Health and Human Services | 18 | 78% | 22% |
| Public Buildings Service | 14 | 50% | 29% |
| Department of Homeland Security | 11 | 73% | 27% |
| Department of the Navy | 11 | 73% | 18% |
| Federal Acquisition Service | 10 | 60% | 0% |
Prime vs Supply-Chain Breakout
Observed DMARC posture split by companies with DoD-linked contracts expiring in the next 15 months and connected supply-chain companies.
| Company role | Observed companies | Enforcing DMARC | p=none |
|---|---|---|---|
| Prime with expiring contract | 377 | 71% | 14% |
| Connected supply-chain company with direct awards | 473 | 71% | 13% |
| Supply-chain company without direct awards | 920 | 67% | 22% |
Direct Award vs Supply-Chain-Only Breakout
Separates companies with direct federal awards from relationship-only supply-chain companies that do not have direct award value in this local dataset.
| Award relationship | Observed companies | Enforcing DMARC | p=none |
|---|---|---|---|
| Companies with direct federal awards | 850 | 71% | 14% |
| Supply-chain companies without direct awards | 920 | 67% | 22% |
Industry / Capability Breakout
Observed DMARC posture grouped by NAICS description or research-derived industry tags, connecting email security to supplier markets and capabilities.
| Industry or capability | Observed companies | Enforcing DMARC | p=none | Other observed state |
|---|---|---|---|---|
| Software Development | 155 | 73% | 11% | 16% |
| Aerospace & Defense | 147 | 76% | 15% | 9% |
| IT Infrastructure & Services | 147 | 73% | 12% | 15% |
| Cybersecurity Services | 101 | 80% | 10% | 10% |
| Telecommunications | 83 | 63% | 17% | 20% |
| Consulting & Advisory | 77 | 55% | 18% | 27% |
| Construction & Infrastructure | 71 | 63% | 20% | 17% |
| Engineering Services | 53 | 83% | 9% | 8% |
| Commercial & Institutional Building Construction | 44 | 59% | 23% | 18% |
| Electronics Manufacturing | 42 | 69% | 12% | 19% |
Contractor Size Breakout
Breakout by direct federal award footprint for companies with award value in the current database snapshot.
| Award-footprint band | Observed contractors | Enforcing DMARC | p=none |
|---|---|---|---|
| $1B+ | 47 | 70% | 19% |
| $100M-$1B | 142 | 71% | 15% |
| $10M-$100M | 242 | 64% | 19% |
| Under $10M | 1,339 | 69% | 18% |
Average Award Size Breakout
Breakout by average observed contract size for contractors with current contract data.
| Average award band | Observed contractors | Enforcing DMARC | p=none |
|---|---|---|---|
| $50M+ avg award | 4 | 50% | 25% |
| $5M-$50M avg award | 58 | 76% | 16% |
| $500K-$5M avg award | 238 | 69% | 18% |
| Under $500K avg award | 1,470 | 68% | 18% |
04 / Methodology
How This Report Was Calculated
- Cohort is a local analytical sample, not a census of all federal contractors. It combines companies with DoD-linked contracts expiring in the next 15 months and supply-chain organizations connected through FPDS/USASpending subaward records, mined teaming/subcontractor relationships, and company-research supply-chain partner data.
- The 15-month recompete window is calculated from contract end_date values in the local contracts table using records whose end date falls between the report generation date and date('now', '+15 months'). Option periods and future extensions are only reflected when already present in the loaded contract record.
- DMARC state is resolved from company security_signals, the latest passive dns_email_security scan, and fingerprint-derived indicators, then bucketed as reject, quarantine, enforced-unspecified, none, present-unclassified, no-record-observed, or unknown.
- Passive dns_email_security results are treated as recent authoritative checks for 180 days; stale passive evidence is kept in unknown rather than counted as no-record.
- Agency breakout uses the contractor's highest-concentration buying agency from current contract records rather than all agencies equally.
- Explicit no-record findings require an authoritative checked signal, while missing, stale, or non-authoritative evidence stays separate as not yet observed.
05 / Boundaries
Important Limits
- This is a public-signal observation of primary contractor domains, not a mail-flow validation or legal compliance assessment.
- This sample is tied to the expiring-contract and connected supply-chain population in the local database and should not be read as representative of the full federal contractor base.
- Subsidiary, alternate, and campaign domains may have different DMARC posture than the primary domain represented here.
- Agency assignment is simplified to the contractor's top current buying relationship for readability, so multi-agency exposure is compressed.
- Cohort ranking depends on the local contract dataset loaded into this instance and can shift as contract ingestion improves.