We checked the public email records of 671 law firm domains in the US, UK, Canada, Australia and Europe. Here is how many enforce DMARC, what it will not stop, and how to get there safely.
Law firm email security has a simple public test. Anyone can look up whether a firm's domain tells mail servers to act on forged messages that fail authentication checks. On November 6, 2026, we looked up those records for law firm domains in the United States, the United Kingdom, Canada, Australia, New Zealand and Europe.
Of the 671 domains with mail servers in our sample, 368 (54.8%) had a DMARC policy that asks receivers to quarantine or reject those messages. The other 303 (45.2%) did not. That does not mean those firms have been defrauded or are careless. It means their public records leave one specific protection switched off.
The overall results
- SPF record present: 642 domains (95.7%).
- DKIM key found: 444 domains (66.2%). This is a minimum, as explained in the method section.
- No DMARC record: 121 domains (18.0%).
- DMARC policy of none: 182 domains (27.1%).
- DMARC policy of quarantine: 166 domains (24.7%).
- DMARC policy of reject: 202 domains (30.1%).
The biggest group that is not enforcing has already taken the first step. Those 182 firms published a DMARC record and stopped at none. Of them, 115 ask for reports and 67 do not, so 67 firms have a record that neither blocks forged mail nor sends them any data about it.
Results by country
Here is the share of domains with a quarantine or reject policy. The range in brackets is a 95% confidence interval, and it matters because some groups are small.
- Australia: 79.2% of 24 domains (60% to 91%).
- United Kingdom: 75.0% of 48 domains (61% to 85%).
- Canada: 73.3% of 30 domains (56% to 86%).
- United States: 52.5% of 442 domains (48% to 57%).
- Europe, excluding the UK: 45.9% of 122 domains (37% to 55%).
New Zealand had only nine domains, which is too few to report as its own result. Please do not treat this as a league table. Australia, the UK and Canada are too close to rank against each other. The clearer gap is that the US and European groups sit below those three, though we cannot tell you why from DNS records alone.
Why law firm email security matters
Law firms send instructions that clients act on, often involving money. The FBI's 2025 Internet Crime Report lists business email compromise at more than $3.04 billion in reported losses, the second-largest category of cyber-enabled fraud by loss. That figure covers all industries, not only legal, but the pattern is familiar to anyone who handles a closing or settlement: an email arrives with new payment details, and someone trusts it.
A DMARC policy addresses one version of that attack, where a criminal sends mail that claims to come from your exact domain. With a reject policy, you ask receiving mail servers to refuse it. The UK's National Cyber Security Centre calls a reject policy on all your domains the best way to prevent spoofing of your email.
What DMARC will not stop
It is easy to oversell DMARC, so here are its limits. LAWPRO, the Canadian lawyers' insurer, describes two common routes for wire fraud against firms, and DMARC blocks neither:
- A hacked mailbox. Criminals break into a real account, watch the correspondence and send payment instructions from a legitimate address. That mail passes authentication.
- A lookalike domain. The address looks like yours but is a different domain. Your DMARC policy only covers your own domain.
So the most important control is not a DNS record. Confirm payment instructions through a separate channel, such as a call to a number you already have. Replying to the email proves nothing if the account has been compromised. Multi-factor authentication on mailboxes also matters, since it makes the first route harder.
How to move your firm to enforcement safely
Going straight to reject can block your own legitimate mail, including messages from your billing or practice management software. A staged approach is safer. These steps follow the NCSC's published sequence.
- List every system that sends mail as your domain. Include your mailbox provider, document management, e-signature, billing, client portals, marketing tools and website forms.
- Fix SPF and DKIM for each one. Keep a single SPF record, and turn on DKIM wherever the provider supports it.
- Publish DMARC at none with a reporting address. For example:
v=DMARC1; p=none; rua=mailto:dmarc@yourfirm.com - Read the reports and fix what fails. The NCSC says many organizations are ready to move on after about 6 to 8 weeks.
- Move to quarantine, then reject. The NCSC says many organizations make the second move after about 3 months, starting with a small percentage of mail and monitoring closely for at least two weeks after changing.
- Protect domains you do not send from. Old firm names and merger domains can be spoofed too, so they need records of their own.
If your firm sends 5,000 or more messages a day to personal Gmail accounts, note that Google's sender guidelines require DMARC but accept a policy of none. Meeting that rule helps delivery, but it does not give you the protection described above.
How we ran this study
We wanted a sample anyone could rebuild, so we started with organizations classed as law firms on Wikidata that list an official website and one of 18 countries. That gave 713 unique domains:
- 3 no longer exist in DNS.
- 2 timed out on the first lookup, and 6 more had incomplete lookups, so we removed them.
- 31 have no mail servers.
- 671 remained. Four firms listed in more than one region count in each regional figure.
We only read public DNS records through public resolvers. We sent no email, tested no systems and are not naming any firm.
Please keep these limits in mind:
- This is not all law firms. Firms on Wikidata tend to be larger and better known. Solo and small practices may look quite different, so do not read these figures as an average for the profession.
- Some listed domains may be out of date. A merged firm's old domain can remain on the list.
- DKIM cannot be fully measured from outside. You need the selector name, and we tried 18 common ones. That makes 66.2% a minimum.
- This is one day's snapshot. Records can change at any time.
- Records do not show outcomes. We can see what a domain asks for, not how often it is spoofed.
This article is general information, not legal or professional advice. To see your own firm's records, run your domain through our free Email Security Checker. If you are also planning a new site, here is how we approach a law firm website with consultation booking and client intake.
Need help putting this into practice?
Our team can do it for you — a clear plan and price within 24 hours, no obligation.
