DDC recently announced a new vendor partnership with Valimail to help campaigns secure their outbound emails and comply with security sending requirements.
Bad actors can spoof or impersonate a campaign’s email traffic to phish supporters, steal money, or otherwise influence them. DDC is excited to offer Valimail for campaigns because it blocks spoofing and impersonation attacks by ensuring that email senders like Google and Yahoo know email from your campaign is legitimate.
We had an opportunity to pose some questions to Seth Blank, Valimail’s Chief Technology Officer, about how the product can secure email, some additional benefits of the product, and their commitment to protecting democracy.
DDC: First off, many thanks for your support of DDC and the campaigns we serve. What is the company’s motivation to work with DDC?
Seth: Protecting elections, campaigns, and officials has been a passion of Valimail’s since our inception, and we’ve been offering pro bono services since 2018. Unfortunately, this has been a difficult offer for campaigns to accept. Partnering with DDC, under their FEC guidance, allows us to make the difference we’ve always wanted to make. We couldn’t be more excited to work with DDC to protect campaigns from email impersonation and to do so in a simple, automated, and rapid way.
DDC: The drumbeat of information about the candidate, their policy positions, and fundraising via email is critical for campaigns to maintain. What are the security risks and concerns that campaigns face when it comes to email systems?
Seth: When a threat actor can use a candidate’s or campaign’s exact email address to send mail, they can wreak havoc. It doesn’t take much to impersonate the candidate, spread disinformation, steal donations, or get fraudulent access to campaigns' systems or databases.
DDC: How does Valimail address those cybersecurity concerns and risks?
Seth: Impersonating email is easy, inexpensive, and legal. Thankfully, there are open standards (SPF, DKIM, and DMARC) that prevent such email impersonation. Unfortunately, these standards can be incredibly difficult to manage and maintain for organizations of all sizes. Success rates for implementation are awful (less than 15%). Valimail provides an automation suite that makes implementing these standards as easy as pressing a button. Campaigns using Valimail get continuous protection without the hassle or failures.
DDC: Let’s say an organization already has DMARC in place for their promotional emails, what benefit does Valimail provide them?
Seth: Just passing DMARC is no longer enough. Valimail ensures the campaigns get continuous protection at scale. Especially under Google and Yahoo’s new rules, which continue to evolve, Valimail ensures campaigns are always ahead of the ball, ensuring that they don’t have any gaps against the new rules, and delivery of critical campaign messages are not at risk.
DDC: One of the things that impressed us about Valimail was ease of use. We had explored other potential ways of campaigns getting compliant and protecting domains but they were all too complicated for organizations without IT or cybersecurity support. Can you talk about Valimail’s process for getting the product up and running and your philosophy about ease of use?
Seth: Valimail was built on the premise that DMARC did not need to be a manual, error prone, and time consuming project. We invented hosted email authentication and automation -- and have the patents to prove it -- so that customers could use a product and press buttons, instead of engaging in painful consulting engagements. We are constantly raising the bar, creating and improving automation to deliver outsized results for our customers every day, including DMARC-as-a-Service and guided workflows to make onboarding and getting to Enforcement painless and fast. And if you need additional help beyond the automation, we have the best onboarding support team in the world. DMARC is our business, it doesn't have to be yours. You have a campaign to run.
DDC: How do I find out if we already have DMARC?
Seth: Use Valimail’s domain checker! We’ll instantly tell you if your domains have DMARC and if there’s immediate work to do. By sending reports to our free product, Monitor, you’ll be able to assess if you have any gaps against the new Google and Yahoo requirements, so you can take appropriate action.
To get started with Valimail for your campaign email info@defendcampaigns.org.
Read more about email security in DDC’s Knowledge Base.