Email Security at Law and Tax Firms: Why the Sector Trails on DMARC and DKIM
Law and tax firms handle some of the most sensitive email in the economy. In our scan of 23,488 DACH company domains they had the lowest DMARC, DKIM and overall authentication rates of all sectors. Here is the data and a plan to fix it.
Kenneth Kather · Founder & CEO, KNK Outbound
Key takeaways
- Of 530 law and tax firm domains, 64.9% have a DMARC record, compared with 74.9% across all domains. That is the lowest rate of the ten sectors in our study.
- Only 44.2% meet all three basic requirements of SPF, DKIM and DMARC, against 58.3% overall and 66.3% in the best sector, logistics and trade.
- These settings do not encrypt anything. They stop others from sending forged mail in the firm's name, which matters when clients act on instructions received by email.
- Most firms can close the gap in about four weeks, and the first step takes no technical knowledge: list everything that sends mail in the firm's name.
The short answer
Law and tax firms in Germany, Austria and Switzerland lag behind other sectors on basic email authentication. In our scan of 530 firm domains, 64.9% have DMARC and 34.2% enforce it, 57.9% have a detectable DKIM key, and only 44.2% meet all three basic requirements. A domain without an enforced DMARC policy is easier to impersonate, because receiving servers get no instruction to refuse forged mail. Most firms can fix this in about four weeks.
What the data shows
The figures come from our DMARC study, a DNS scan of 23,488 company domains in DACH from October 2026. The sector "law and tax" contains law firms, tax advisers and similar practices.
| Measure | Law and tax | All domains | Best sector (logistics and trade) |
|---|---|---|---|
| Domains | 530 | 23,488 | 368 |
| SPF present | 99.1% | 97.5% | 98.4% |
| DMARC present | 64.9% | 74.9% | 82.1% |
| DMARC enforced | 34.2% | 41.7% | 50.5% |
| Policy reject | 15.3% | 18.8% | 26.4% |
| DKIM detectable | 57.9% | 67.9% | 75.3% |
| SPF, DKIM and DMARC together | 44.2% | 58.3% | 66.3% |
- Law and tax
- 530
- All domains
- 23,488
- Best sector (logistics and trade)
- 368
- Law and tax
- 99.1%
- All domains
- 97.5%
- Best sector (logistics and trade)
- 98.4%
- Law and tax
- 64.9%
- All domains
- 74.9%
- Best sector (logistics and trade)
- 82.1%
- Law and tax
- 34.2%
- All domains
- 41.7%
- Best sector (logistics and trade)
- 50.5%
- Law and tax
- 15.3%
- All domains
- 18.8%
- Best sector (logistics and trade)
- 26.4%
- Law and tax
- 57.9%
- All domains
- 67.9%
- Best sector (logistics and trade)
- 75.3%
- Law and tax
- 44.2%
- All domains
- 58.3%
- Best sector (logistics and trade)
- 66.3%
Three points stand out. On DMARC present, DKIM and the combined measure, law and tax firms rank last of the ten sectors. On enforced DMARC they rank second to last, just above health and medical technology, a much smaller group of 151 domains. And on SPF they are in fact the best of all sectors at 99.1%. SPF alone is simply not enough, because a forged sender can pass or sidestep it unless DMARC ties it to the visible address.
DKIM can only be detected from outside if the selector can be guessed, so the true DKIM rate is somewhat higher than any such scan shows. That limit applies to all sectors equally.
Why this matters more for firms than for most
A forged email from a law or tax firm is unusually convincing. Clients expect instructions by email, they act on deadlines, and they rarely question their adviser.
The classic case is a forged notice with new bank details for a settlement, a client account or a tax payment. Another is a fake request for documents. Enforced DMARC makes the first variant harder: receiving servers that check it refuse mail claiming to come from the firm's exact domain.
There is also a professional side. Firms are bound by confidentiality duties, in Germany among others under Section 43a(2) of the Federal Lawyers' Act and Section 203 of the Criminal Code, and under Article 32 GDPR they have to take appropriate technical measures. Whether a missing DMARC record breaches any of these is a question for each case, and we do not answer it here. This is not legal advice. It is simply hard to explain after an incident that a free, standard setting was never switched on.
What these settings do, and what they do not do
| Setting | What it does | What it does not do |
|---|---|---|
| SPF | Lists the servers allowed to send for the domain | Protect the visible sender address on its own |
| DKIM | Signs outgoing mail so changes can be detected | Encrypt the content |
| DMARC | Tells receivers what to do with mail that fails, and sends reports | Stop lookalike domains such as a misspelled firm name |
| Encryption (S/MIME, portals) | Protects the content of the message | Prevent others from forging the sender |
- What it does
- Lists the servers allowed to send for the domain
- What it does not do
- Protect the visible sender address on its own
- What it does
- Signs outgoing mail so changes can be detected
- What it does not do
- Encrypt the content
- What it does
- Tells receivers what to do with mail that fails, and sends reports
- What it does not do
- Stop lookalike domains such as a misspelled firm name
- What it does
- Protects the content of the message
- What it does not do
- Prevent others from forging the sender
So DMARC does not replace encrypted channels for sensitive content. It solves a different problem. Court communication through special channels such as Germany's beA runs separately and is not affected.
A four-week plan for a firm
Week 1: Find out where you stand. Enter the firm's domain in our free email deliverability check. Then list everything that sends in the firm's name: mailboxes, practice management software, scanners, the contact form on the website, newsletter tools, and external accounting or billing services.
Week 2: Close the gaps. Ask your IT provider to enable DKIM for the main mailboxes and every other sender on the list. Exact records for the common systems are in setting up SPF, DKIM and DMARC. If your firm runs on hoster packages, the defaults at IONOS, Strato and All-Inkl are worth a look first.
Week 3: Watch the reports. Publish a DMARC record with p=none and a report address, and check what comes back. Reading DMARC reports explains how. Reports contain sender information, so agree who at the firm or the provider receives them.
Week 4 and after: Enforce. Move to p=quarantine, and once no legitimate mail is failing, to p=reject. The steps are in moving from p=none to reject.
Most of this is an hour or two of your IT provider's time, spread over a few weeks. The part that takes care is finding every sender.
Questions to ask your IT provider
- Is DKIM active for our domain in every system that sends in our name?
- What is our DMARC policy, and who reads the reports?
- Which external services send mail with our address?
- When will we move to p=reject, and what could break?
- What do we do if a client reports a forged message?
A note on how we use this
We are not a law firm or an IT security company. We run outbound campaigns, so email authentication is part of our daily work, and we published the study because the numbers were not available anywhere else. All figures are aggregates, and no firm is named. The dataset is free to use under CC BY 4.0 on the study page.
Frequently asked questions
How well do law firms protect their email domains?
Below average. In our scan of 530 law and tax firm domains in DACH, 64.9% have DMARC (74.9% overall), 34.2% enforce it (41.7% overall), and 44.2% meet all three of SPF, DKIM and DMARC (58.3% overall). That is the lowest combined rate of the ten sectors in the study.
Does DMARC replace encrypted email for law firms?
No. DMARC protects the sender address against forgery, and encryption protects the content. A firm usually needs both. Court communication through channels such as Germany's beA runs separately.
Can someone send fake emails in our firm's name?
If the domain has no enforced DMARC policy, forged mail in its name is much more likely to arrive. You can check your policy with a free tool. A p=reject policy tells receiving servers to refuse such mail, although lookalike domains need separate monitoring.
Is a missing DMARC record a breach of professional duties?
We cannot answer that in general. Confidentiality rules and Article 32 GDPR require appropriate technical measures, and what is appropriate depends on the case. Please consult a lawyer or your data protection officer. This is not legal advice.
How long does it take to set up?
Usually about four weeks from first check to enforcement, with an hour or two of actual work for the IT provider. Most of the time goes into waiting for reports and making sure every system sending in the firm's name passes.