Advisor tenant firm with no DMARC on the sending domain

Wire-fraud pretext against a principal rarely originates from a domain the principal controls. It originates from a domain the principal *trusts* — the accountant, the wealth manager, the law firm, the business affairs manager. When any of those advisor firms fail to publish a DMARC policy on their sending domain, an attacker can spoof mail from `[email protected]` to `[email protected]` and pass inbound-mail authentication checks in most consumer and small-business mail environments. ## Why attackers exploit it Advisor-tenant firms are the wire-fraud attack surface for the principal, and they are typically outside the principal's direct security control. A family office or wealth firm that hardens its own DMARC posture but never checks its advisors' posture has closed the front door while leaving the back door open. ## Remediation direction Periodic external assessment of every advisor tenant's email authentication posture, delivered to the principal or family office CoS with named recommendations and a template introductory note to the advisor firm asking them to remediate. Institutional-grade programs run this assessment quarterly and track posture changes over time.