Client money, client data, and email anyone can fake
In October 2026 we read the public email records of 669 Irish solicitors' practices. What we found, why it matters when clients send you money, and what putting it right involves.
What we found
Read from public DNS on 29 October 2026. The method and every sector are in our study.
- 376 of 669 practices (56.2%) publish no DMARC record, so nothing tells other mail systems what to do with email forged in their name.
- 158 more (23.6%) publish one that only asks for reports and stops nothing.
- 135 (20.2%) ask receiving servers to junk or refuse forged email. That is the second-highest of the five sectors we read, and it still leaves four in five open.
Why it matters to a practice
- A client told by email to send a deposit or closing funds to new bank details has no way to tell a forged email from yours. The defence is a call to a number held before the email arrived, and a domain that tells inboxes to refuse forgeries. What stops it.
- Your insurer's renewal form asks about two-step sign-in, backups and email filtering, and more underwriters want proof. What they ask.
- Client files are personal data, often sensitive. A request for a copy has a one-month clock, and a breach a 72-hour one. The clocks.
What we do
Protect, from €3,450 up to 10 staff
We set DMARC to enforce in stages, so email your case management system and other services send in your name keeps arriving, then put two-step sign-in, backups with a tested restore and an incident plan in place. A second scan and dated documents prove each, in an evidence pack for your insurer.
Read first
Start here
The free compliance check looks at your website and email from outside while you answer a few questions, and keeps the result as your compliance record. Or tell us what you have been asked, and we tell you what to do first.