Does a law firm need DMARC?
Yes, a law firm should publish one. Clients act on emails that look like yours. Without a DMARC record nothing your domain publishes tells inboxes to refuse email forged in your firm's name. The rules for lawyers do not name DMARC. They ask for reasonable efforts. It is one record in your DNS settings.
Last read from the sources at the foot of this page.
What does DMARC do for a law firm?
The standard describes DMARC in one sentence. A firm publishes its wishes in DNS. The inbox that receives a message uses them.
For a law firm the message at risk is usually a payment instruction or a trust account detail. If the From line shows the firm's exact address and nothing tells inboxes to refuse it, a forged email reaches the client the same way a real one does.
Domain-based Message Authentication, Reporting, and Conformance (DMARC) is a scalable mechanism by which a mail-originating organization can express domain-level policies and preferences for message validation, disposition, and reporting, that a mail-receiving organization can use to improve mail handling.
What are the three policies?
The record carries one of three policies. The standard words them this way.
none: The Domain Owner requests no specific action be taken regarding delivery of messages.
quarantine: The Domain Owner wishes to have email that fails the DMARC mechanism check be treated by Mail Receivers as suspicious.
reject: The Domain Owner wishes for Mail Receivers to reject email that fails the DMARC mechanism check.
How many law firms have no such rule?
71 percent of the 285 Ontario law firms we measured between 25 May and 16 October 2026 have no published rule telling mail servers to refuse mail forged in their name. That counts firms with no DMARC record and firms whose record is set to monitor only. The Ontario law figures page shows the count.
The count comes from the DNS records each firm publishes. It says nothing about whether any firm was ever forged.
What does a DMARC record not stop?
It governs the firm's own domain only. It does not stop a message from a different domain that looks similar. LAWPRO, the insurer of Ontario lawyers, describes that trick in its June 2026 examples.
It also does not stop a message sent from a real mailbox someone has taken over. The call-back rule for changed payment details covers both.
Fraudsters will spoof an email address by creating a very similar looking address by adding an extra letter/number or changing a character(s).
Do the rules for lawyers mention it?
The rules read here do not name DMARC. The American Bar Association's opinion speaks of reasonable efforts to prevent inadvertent or unauthorized access. The Ontario rule asks a lawyer to understand relevant technology, with its benefits and risks. A DMARC record is one thing a firm can do within that. The rules do not say it must. Both are quoted on their own pages.
A lawyer generally may transmit information relating to the representation of a client over the internet without violating the Model Rules of Professional Conduct where the lawyer has undertaken reasonable efforts to prevent inadvertent or unauthorized access.
A lawyer should understand the benefits and risks associated with relevant technology, recognizing the lawyer's duty to protect confidential information set out in section 3.3.
What should a law firm do?
- List every service that sends mail in the firm's name, such as the mail system, the billing tool and the newsletter tool.
- Publish a DMARC record at p=none with an address that receives the reports.
- Read the reports for a few weeks and fix any of the firm's own services that fail.
- Move to p=quarantine, then to p=reject.
- For a domain that sends nothing, publish an SPF record of v=spf1 -all.Add a DMARC record at p=reject. Where the domain takes no mail, add a null MX too. A domain that does send mail moves to quarantine first and then to reject, as in the step above.
- Keep the call-back rule.DMARC does not replace it.
Where is the change made?
Your DNS settings, where the record is published as a TXT record named _dmarc. The company that runs your domain's DNS shows the list of records. Many give step-by-step help.
What can an outside reading show?
It shows whether a DMARC record exists at your domain and which policy it carries, because the record is public. It cannot show which services send as your firm, or whether anyone reads the reports.
What else do people ask about this?
Is SPF or DKIM enough without DMARC?
No. SPF and DKIM check parts of a message a recipient never sees. DMARC ties the result to the From address on screen and tells the inbox what to do when the check fails.
Will p=reject block the firm's own email?
It can, if a service that sends for the firm is not set up to pass. Starting at p=none and reading the reports first shows those services before anything is refused.
Does DMARC stop look-alike domains?
No. It protects the firm's exact domain. A different domain that resembles it is not covered, so clients also need to know how the firm asks for payment.
Where does this come from?
- RFC 7489, Domain-based Message Authentication, Reporting, and Conformance (DMARC)rfc-editor.orgRead 1 November 2026
- LAWPRO practicePRO, Current scams, cons, and swindlespracticepro.caRead 1 November 2026
- American Bar Association, Formal Opinion 477Ramericanbar.orgRead 1 November 2026
- Law Society of Ontario, Rules of Professional Conduct, Chapter 3lso.caRead 1 November 2026
- What ABA Formal Opinion 477R says about sending client information
- Does DMARC protect your firm from look-alike domains?
- DMARC figures for Ontario law firms
- What the Law Society of Ontario rules say about technology and client information
- Business email compromise, explained
- Every question we have answered
See what is open before anyone else does.
We read your domain from outside and show each way in with a check anyone can re-run.