Seven in ten of the law and accounting firms we have looked at cannot stop an email sent in their name from being delivered.

That is not a prediction about what attackers might do. It is the current state of the public records those firms publish about their own domains, read the same way every receiving mail server reads them, from outside, with no access to anyone's systems.

What we measured

Three records decide whether a forged email claiming to be from a domain reaches an inbox. SPF names the servers allowed to send. DKIM signs each message so a receiver can prove it was not altered. DMARC tells receivers what to do when a message fails those checks: nothing, quarantine, or reject. All three are published in public DNS. An attacker reads them before we do.

Across the Canadian and US legal and accounting landscape in our visibility:

  • 39.1% publish no DMARC record at all. Receivers are given no instruction, so forged mail is delivered on the strength of the display name alone.
  • 31.4% publish DMARC in monitor mode. It produces reports and blocks nothing. Most of those reports are going nowhere anybody reads.
  • 70.5% therefore cannot stop a forged invoice, a fake payment instruction or a fee request sent in their name.
  • 8.8% publish no SPF record, which means the most basic of the three checks has nothing to check against.
  • 23.2% have at least one staff address sitting in breach databases with a password beside it.

Why monitor mode is the more interesting number

A firm with no DMARC has not started. A firm on monitor mode has started and stopped, usually because someone was worried that enforcement would break legitimate mail. That fear is reasonable and it is the whole problem: the step from monitor to enforcement is the one that requires knowing which senders are yours, and nobody wants to be the person who blackholes the partners' email.

So the record sits at p=none for years, produces a daily report nobody opens, and the firm believes the box is ticked.

What it costs, in the specific

The pattern is not ransomware. It is a client receiving wire or fee instructions that appear to come from the firm, in the firm's format, during a transaction the client is expecting. The money moves within hours and is rarely recovered. Business email compromise is the second costliest category of reported cybercrime in the FBI's 2024 Internet Crime Report, ahead of ransomware by total loss.

For a professional firm there is a second cost. The client's question afterwards is not whether the firm was hacked. It is why an email in the firm's name could be delivered at all, when the fix is three records in public DNS.

How to check your own, in two minutes

You do not need a vendor for this. From any terminal:

dig TXT _dmarc.yourfirm.com +short
dig TXT yourfirm.com +short | grep spf1

If the first returns nothing, you are in the 39.1%. If it returns p=none, you are in the 31.4%. If it returns p=quarantine or p=reject, forged mail in your name is being acted on.

Method

Findings are read from public sources only: DNS records, certificate transparency logs, breach databases, and what a firm's own servers answer to an ordinary request. No systems were accessed, no logins were used, and no firm is named here or anywhere else. Percentages describe the firms in our visibility across Canada and the United States, not a national census.