Healthcare is the most vulnerable sector in Ecuador, with only 4.4% of domains enforcing DMARC at p=reject and 47.8% lacking a DMARC record entirely. With 0% MTA-STS adoption, sensitive patient data and internal communications are highly exposed to spoofing, phishing, and interception attacks.
Finance leads Ecuador in DMARC enforcement at 43.7% p=reject, but this strength is offset by a 97.2% MTA-STS gap, leaving email traffic largely unencrypted. This creates a critical risk for wire transfers, SWIFT communications, and customer transactions, where interception attacks can bypass authentication.
Government domains show strong SPF adoption at 100%, yet only 14.3% enforce DMARC at p=reject, with many remaining in monitoring or quarantine modes. Combined with minimal MTA-STS adoption, attackers can spoof official communications and exploit public trust.
Educational institutions maintain relatively strong SPF adoption at 93.9%, but only 22.5% enforce DMARC, with a large portion still in monitoring modes. With 0% MTA-STS adoption, student credentials, research data, and internal communications remain vulnerable to phishing and data exfiltration.
Media is one of the most exposed sectors, with only 6.5% of domains enforcing DMARC and 46.8% lacking any DMARC record. Without enforcement, attackers can easily spoof trusted news sources to spread misinformation or conduct phishing campaigns at scale.
Telecom providers face ongoing risks from billing fraud and account takeover attempts. While 26.1% of domains enforce DMARC, a significant portion remains in monitoring mode, and 0% MTA-STS adoption leaves customer communications vulnerable to interception and spoofing.
