We Checked 405 Credit Union Domains. Here Is What We Found.

This week we pointed our public Domain Security Check at 405 credit union domains, the primary domains behind 850 people we already correspond with. The check reads the same public record an attacker or an examiner reads first: DNS, mail authentication, TLS, web headers, and the registry. Nothing intrusive. No logins. Nothing near member data.

We expected a spread. We got a pile-up in the middle and a bottom fifth that should worry the people who run those institutions. Here is what we found, what surprised us, and the one conclusion that matters. If you want every finding explained in dollars and fixes, the full breakdown is a separate page.

What we checked and how

Fifteen settings, graded pass or fail, weighted by how much damage their absence enables. Email: SPF, DMARC policy, DKIM, MTA-STS. DNS integrity: DNSSEC and CAA. Web transport: certificate validity, legacy TLS, the HTTP to HTTPS redirect, HSTS, and the standard security headers. Domain hijack: registrar transfer lock and registry expiry.

Every check uses data the institution already publishes to the world. Where a site blocked us, we recorded it as untestable rather than guessing. Results are aggregate only; no institution is named, here or anywhere else.

The grades

• A: 10 domains (2%)
• B: 78 domains (19%)
• C: 228 domains (56%)
• D: 84 domains (21%)
• F: 5 domains (1%)

Average score: 72 out of 100. Median: 73. The 89 domains graded D or F hold 173 of the 850 people, one in five. Only three domains passed every graded check. The typical domain fails three.

The good news first

Basic email authentication is table stakes in this sector, and the sector has paid it. SPF is present on 100% of domains. DKIM was there everywhere we could test for it. Registrar transfer locks are on 97%. Registrations are current on 98%. Certificates are valid on 98% of the sites we could reach.

Notice what those have in common. They are the settings a vendor sets up on your behalf: the mail platform, the registrar, the CDN. Where the sector does well, somebody else did the work.

The finding that matters most: DMARC without teeth

101 of 405 domains (25%) either have no DMARC record or publish it with p=none. None means "report forgeries to me, but deliver them anyway." Gmail, Microsoft, and Yahoo all read that policy before deciding what to do with a message claiming to be from your domain. At none, they deliver it.

Here is the number that stopped us. 215 of the 405 domains route mail through a named security gateway: Mimecast (75), Proofpoint (72), AppRiver (22), Barracuda (21), Cisco Secure Email (15). 52 of those gateway customers still sit at none. Roughly 74% of the whole set runs Microsoft 365, and 69 of the none-or-missing domains are on it. Every one of those institutions owns everything needed to enforce. They have not flipped the switch.

We wrote up how that attack actually unfolds against a credit union and its members, because the mechanism is misunderstood almost everywhere we go.

The web layer is where the C grades come from

Most of the sector landed in a C, and most of a C is the website.

• HSTS missing: 82 of 374 testable sites (22%). One header that tells the browser never to use plain HTTP for a year.
• Security headers failing: 96 of the 203 sites where the page could be graded (47%).
• No HTTP to HTTPS redirect: 25 sites. 22 of those follow one pattern: the bare domain hops to www over plain HTTP first, then to HTTPS. The padlock shows up one hop late.
• Legacy TLS 1.0 or 1.1 accepted: 22 sites. Every browser dropped both in 2020.
• Broken or mismatched certificates: 9 sites.

None of these is a breach on its own. Each one lowers the price of the next attack, and each one is visible from the outside with one command, which is why they are the first thing a penetration tester or an examiner writes up.

The three everyone skips

MTA-STS is absent on 91% of domains, CAA on 88%, DNSSEC on 79%. That is the industry norm, not a credit union problem, and nobody is failing an exam over them today. But each one closes a door the other findings leave open: CAA decides which certificate authorities may issue for your name, DNSSEC lets a resolver tell your DNS answers from a forgery, and MTA-STS stops mail to you from being downgraded or rerouted on the path. CAA is three records and ten minutes. Start there.

The bits that surprised us

1. Only three clean domains

Out of 405, three passed every graded check. We expected a dozen or more. The median domain fails three checks, and the failures are not exotic. They are the same three or four settings, over and over.

2. Twenty sites we could not see at all

Twenty primary domains did not answer a web request from either of the two locations we checked from. Mostly bot protection tuned to block everything unfamiliar; occasionally the site was down. We graded those on DNS, mail, and registry data only. The lesson is not that they are safe. It is that nobody is watching the site the way an outsider sees it.

3. The www hop

We did not go looking for the plain-HTTP hop to www. It found us: 22 of the 25 redirect failures share it. It happens because the certificate covers www and not the bare domain, so the bare domain has to redirect before it can encrypt. It looks fine in a browser. It is a guaranteed unencrypted request on every first visit.

4. Registrar lock is the strongest result, and still not enough

391 of 405 have the standard transfer lock. That is good. It is also the weak lock: the same account that sets it can remove it. We have written before about what the lock does not do. Registry lock is the real control, and we saw very little of it.

Configuration, not tooling

Put the good news next to the bad news and one pattern falls out. The checks the sector passes are the ones a vendor configures. The checks it fails are the ones that need a decision from the institution: publish the reject policy, send the header, fix the first hop, retire the old protocol, lock the account properly.

The D-graded credit unions run the same mail platform, the same gateways, and the same CDNs as the A-graded ones. The products are not the variable. Ownership is. When a board sees a D, the reflexive move is to ask what to buy. The winning move is to ask who owns each of these settings, by name, and when the change window is.

What to do this week

1. Run the Domain Security Check on your own domain. Add ?d=yourcreditunion.org to the address and the link runs the check on load, so you can forward it to whoever owns the domain.
2. Read the full breakdown for whichever rows failed. Each finding has the attack it opens, the reflexive fix that does not work, and the one that does.
3. Assign a name to each failing row. Not a vendor. A person.
4. Schedule the change windows. Most of this is an afternoon.
5. Re-run the check and keep the result. It is the evidence your examiner asks for.

If you would rather we walked you through your result, we are happy to. No pitch required.