Survey of 254 Russian Domains Shows 89% DMARC Adoption but Highlights Gaps in Reporting and Subdomain Policies
A detailed DNS sweep of 254 Russian domains across retail, IT, industry, finance, media, government, telecom and other sectors has revealed high adoption rates for core email authentication records, yet also exposed practical limitations in how those records are configured.
The scan, performed on 28 September 2026, queried MX, SPF, DMARC and 14 common DKIM selectors. It found MX records at 96.1% of domains, SPF at 93.7%, DMARC at 89.0% and DKIM via typical selectors at 62.2%. Two domains returned SERVFAIL for all queries and were counted as having no records.
Among the 226 domains that published DMARC, policies broke down as 40.7% reject, 42.9% quarantine and 16.4% none. Thirty-three of the 43 domains without an rua aggregate reporting address still requested reject or quarantine treatment from receivers.
The researchers noted that 27 domains combined a strict parent-domain policy (reject or quarantine) with sp=none for subdomains, while a small number used pct values below 100. They stressed that DNS records alone cannot verify alignment between SPF or DKIM and the visible From header, nor confirm whether reports are actually received and acted upon.
Sector-level figures showed full SPF and DMARC coverage in the IT and finance samples, though the authors cautioned that the non-representative selection and small group sizes prevent direct comparisons of security maturity.
The study concludes that owners should first confirm whether a domain sends mail at all, review full SPF chains including redirects, test real messages for alignment, examine subdomain inheritance, and validate that rua addresses actually deliver usable reports before tightening policy.
Related articles
Developers Achieve Native iOS 16 Boot on Redmi Note 10 Pro and Note 12 4G Using Modified Apple XNU Kernel
A team known as dipa-studio has successfully booted iOS 16 natively on Redmi Note 10 Pro and Redmi Note 12 4G devices without any Android layer or emulation. The project relies on an adapted Apple XNU kernel and system components taken from the iOS 16.7.16 firmware of the iPhone X. While basic interface elements such as the Control Center, Notification Center, and Settings app function, the majority of hardware features remain non-operational. No Wi-Fi, Bluetooth, cellular connectivity, audio, cameras, or GPS are available, and the App Store along with Apple ID login are inaccessible. The port disables a significant portion of iOS security mechanisms, and installation wipes all user data from the original Android system. Performance is limited because the CPU renders the interface at roughly 20-30 frames per second without a dedicated graphics driver. The effort is described as purely experimental, with the Redmi Note 12 4G variant currently reaching only the lock screen.
How to Earn a Living Writing Technical Articles on Information Security
A detailed guide examines multiple platforms where technical writers can get paid for publishing articles on information security topics. Skillbox offers payments starting from 3,000 RUB but requires a civil-law contract and tax reporting. Codeby pays 250 RUB per 1,000 characters for relevant technical pieces without contracts, making it suitable for remote workers and privacy-conscious authors. Duty-Free provides a fixed 200 USD per article paid in cryptocurrency, yet operates in a gray area under law-enforcement scrutiny. Xakep.ru compensates authors with variable fees around 150 USD for pentest-related material plus subscription perks. The article also discusses risks of writing for high-paying but questionable resources and provides a roadmap based on long-term career goals.
True Crime from Investigators: Solar Group to Premiere Real Cyber Investigation Series at Russian Cybersecurity Week 2026
The Solar Group has announced that its Cyberculture project will shift from poster exhibitions to a short true-crime series titled True Cyber Crime. The series draws directly from real investigation cases handled by the company's security practitioners. Episodes will air on Cyberbez TV during the SOC Forum, which forms the centerpiece of Russian Cybersecurity Week running from 26 to 30 October 2026. In parallel, the Cyberbez-Likbez track will deliver lectures and meetings across more than twenty universities between 5 and 26 October, targeting both specialized and non-specialized audiences. The main SOC Forum itself is scheduled for 27-28 October at the Lomonosov cluster in Moscow. Organizers state that the narrative format is intended to hold viewer attention longer than static posters while explaining concrete digital threats and recommended protective behaviors.
Personal Experience Passing HTB CJCA: What to Know Before the Junior Cybersecurity Analyst Exam
A cybersecurity professional who recently transitioned careers shares a detailed account of completing the Hack The Box Certified Junior Cybersecurity Analyst certification. The exam combines practical red team and blue team tasks in a lab environment rather than multiple-choice questions. Preparation involved completing the full Junior Cybersecurity Analyst path in HTB Academy, practicing on Easy and Medium machines, and following the SOC Analyst Path on LetsDefend. The five-day exam requires separate passing scores in both offensive and defensive sections, with strong emphasis on professional reporting using SysReptor. Key lessons include maintaining organized notes per host, documenting findings with MITRE ATT&CK mappings, and preparing thoroughly for the second phase of alert triage and incident handling.