Most South Florida law firms and real estate offices can't stop fake emails in their name (2026)

Data checked October 18, 2026.

One of the most common business email scams is a fake message from someone you already trust: "Our payment details have changed, please send the funds here." It works because the email looks like it came from your lawyer, your real estate office or your property manager.

We wanted to know how many local firms have blocked that trick on their own domain. So we checked the public email settings of 749 South Florida law firms and real estate offices.

About 4 in 5 haven't.

What we found

	Law firms	Real estate offices
Firms checked (domain receives email)	519	230
No DMARC record at all	51%	48%
DMARC set to "monitor only"	29%	35%
Not blocking fake email in their name	79%	83%
Blocking it (quarantine or reject)	21%	17%
No SPF record	9%	10%

By type of firm:

Type of firm	Firms checked	Not blocking fake email
Criminal defense lawyers	115	89%
Real estate brokerages	99	86%
Immigration lawyers	141	84%
Property management companies	131	81%
Family lawyers	122	80%
Personal injury lawyers	141	67%

Even the best group, personal injury firms, leaves two in three without protection.

Why it matters

• Business email compromise was the second-costliest crime type in the FBI's 2025 Internet Crime Report, after investment fraud: $3.05 billion in losses from 24,768 complaints. Real estate fraud added $275.1 million. (Source: FBI IC3 2025 report.)
• Florida ranked 3rd in the country for total reported losses: $1.60 billion.
• Without an enforced DMARC record, a firm hasn't told inbox providers what to do with mail that fakes its address. Gmail and Outlook still filter some of it, but nothing from the firm itself tells them to block it.

What this check is (and isn't)

DMARC is a public DNS record where a domain owner tells inboxes what to do with mail that fails sender checks.

• "p=none" means "watch and report".
• "p=quarantine" or "p=reject" means "send fakes to spam, or refuse them".
• SPF and DKIM are the two sender checks DMARC builds on.

A firm with no DMARC record, or one stuck on "monitor only", is easier to impersonate. That doesn't mean the firm has been hacked, or that its own inbox is unsafe. It means nothing is stopping a scammer from putting the firm's address on a fake email. DMARC doesn't stop look-alike domains (like yourfirm-law.com) or a hacked mailbox; it only blocks fakes that use the firm's exact address.

How to check your own firm (2 minutes)

Run your domain through our free email security check. No sign-up. It reads the same public records and explains the result in plain English.

Watch how it works (30 seconds):

How to fix it

1. Make sure SPF lists every service that sends mail for you: your email provider, your CRM, your e-signature tool.
2. Turn on DKIM in your email provider.
   • Microsoft 365: Microsoft Defender portal, Email authentication settings.
   • Google Workspace: Admin console, Apps, Gmail, Authenticate email.
3. Publish a DMARC record that starts in monitor mode: v=DMARC1; p=none; rua=mailto:dmarc@yourfirm.com.
4. After 2-4 weeks of clean reports, move to p=quarantine, then p=reject. That last step is what actually blocks fakes.

If your IT provider handles your email, send them this page. It's usually under an hour of work.

How we did it

• The firms: 664 South Florida law firms (personal injury, immigration, family and criminal defense practices) and 288 real estate offices (brokerages and property management companies) from public Google business listings in Miami-Dade, Broward and Palm Beach counties (October 2026). The sample doesn't include title companies or real estate closing attorneys.
• The domains: we used each firm's own website domain and skipped Facebook pages, directory profiles and site-builder subdomains. That left 561 law firm and 276 real estate domains; those with mail (MX) records are counted above: 519 and 230.
• The records: we read public DNS only (MX, SPF and the DMARC record at _dmarc), on October 18, 2026, through Cloudflare's DNS service. We re-checked a random 20 through Google's public DNS, and all 20 matched.
• What we didn't do: we sent no email and contacted no firm. We don't name any firm.
• Limits:
  • Some firms send mail from a different domain than their website.
  • Some large brokerages share a franchise domain.
  • DKIM can't be fully checked from outside without knowing the selector, so it isn't scored.

Raileon is a North Miami company that builds custom software and automation for businesses. Questions about the data: admin@raileon.com.