Cloudflare Radar adds a lens on email threats and authentication
Cloudflare has launched a dedicated Email Security section on Cloudflare Radar, drawing on telemetry from the email routing and security services it has operated since the Area 1 Security acquisition closed in April 2022. Those services now process tens of millions of messages daily, giving Cloudflare a broad view of malicious email trends, sender authentication adoption, and the protocols mail servers use to talk to one another.
The new Radar section tracks the share of processed messages classified as malicious, the dominant threat categories, the top-level domains (TLDs) that originate the most spam and malicious mail, and how widely SPF, DKIM and DMARC are being applied. The same metrics are exposed through the Radar API for programmatic access. The view is global by default; there is no per-organization breakdown, but the data is intended to help administrators compare local observations against wider industry patterns.
Malicious share and threat categories
For February 2024, Cloudflare reported that an average of 2.1% of processed messages were classified as malicious. The share spiked to as much as 29% on February 10–11, which the company attributed to themed campaigns ahead of the Super Bowl, echoing prior observations of pre-game email surges. Smaller peaks appeared on February 13, 15, 17, 24 and 25.
Single messages can carry multiple threat types, so a sender impersonating a trusted colleague might also include a link to a credential-harvesting page. Cloudflare groups the threats it detects into four buckets: Attachment, Link, Impersonation and Other.
Link-based attacks dominated in February 2024, appearing in 58% of malicious messages. Because the visible text of an HTML link can be arbitrary, attackers routinely disguise malicious destinations behind display text pointing to a benign-looking URL. Nearly a third of malicious messages carried links to credential-phishing pages.
Malicious attachments appeared in just under 13% of malicious messages, with daily shares spiking as high as 70%. In nearly 6% of messages, opening the attachment triggered downloads of additional software, presumably malware.
Brand impersonation was present in over a quarter of malicious messages on average, with spikes reaching 88% on February 17. Extortion-themed messages also saw heavy activity in the week before Valentine's Day, peaking at over 95% of messages on February 15.
In the Other category, identity deception was the top technique, seen in over 36% of malicious messages. Charted daily, its use formed three apparent waves across the month, starting at the beginning of February, around February 9, and around February 20. Network reputation drove classification in over 11% of messages, where the source autonomous system was a known origin of unwanted mail.
Dangerous domains by TLD
Radar now shares which TLDs are most associated with malicious and spam mail, based on the domain in the message's From: header. Users can filter the view to show all TLDs, country-code TLDs (ccTLDs) only, or the original “classic” gTLDs from RFC 1591.
Cloudflare cautions that its spam percentages may run lower than other industry analyses, because some customers pre-filter spam before messages reach Cloudflare's security service.
For February 2024, the new gTLD associates and the ccTLD zw for Zimbabwe led in malicious share, each above 85%. The new TLDs academy, directory and bar showed the highest spam shares, at upward of 95%.
Looking at ccTLDs alone, more than half of messages from domains in zw (85%) and bd for Bangladesh (50%) were malicious. In bd and pw (Palau), malicious and spam shares were comparatively balanced; 80 ccTLDs saw less than 1% of their messages classified as malicious.
Among classic gTLDs, malicious and spam shares were low overall, with com showing the largest shares of both simply by scale. Cloudflare noted it is noteworthy that even restricted TLDs like int and gov saw 2% of messages from associated domains classified as malicious.
The explanations vary by TLD: loose or nonexistent registration rules, permissive approaches to domain tasting, or unusually low registration fees can all make a namespace more attractive to abuse.
Authentication adoption
With Google and Yahoo! announcing bulk-sender authentication requirements for the first quarter of 2024, email authentication methods are under renewed scrutiny. SPF lets a domain publish the servers allowed to send mail on its behalf; DKIM provides a cryptographic signature for message integrity; and DMARC tells receiving mail servers how to handle messages that fail both checks. The possible results for each are PASS, FAIL, or NONE when no policy is published for the domain.
In February 2024, over 93% of messages passed SPF, while 2.7% failed. Cloudflare suggests FAIL is the more interesting outcome here because SPF is easier to spoof than DKIM, and failure can also stem from legitimate “shadow IT” setups where, for example, a marketing team uses a third-party sender without adding it to the SPF record.
DKIM passed in 88.5% of messages and failed in 2.1%; for DKIM, the PASS rate is the metric to watch because signatures can fail for benign reasons. DMARC passed in 86.5% of messages and failed in 4.2%, but Cloudflare frames the combination of PASS and FAIL as the key signal, since simply having a published policy is the point of DMARC.
Transport protocols
The Radar data also sheds light on how mail servers connect to Cloudflare's infrastructure. For February 2024, 95% of inbound connections came over IPv4 and only 5% over IPv6 — a sharp contrast to Web traffic for the same period, where IPv6 accounted for 37% of requests to IPv6-capable sites. Cloudflare has long pushed IPv6 adoption for the Web, but this data suggests mail infrastructure is lagging.
TLS adoption among mail senders is far stronger. Just 6% of inbound connections to Cloudflare's email servers were unencrypted in February 2024, meaning the vast majority of messages were protected in transit against interception or modification.
The Email Security section is available at radar.cloudflare.com/email-security, and the underlying summary and time-series datasets are accessible via the Cloudflare Radar API for SPF, DKIM, DMARC, IP version, TLS version, malicious share, threat categories, and the top TLD breakdowns.
