Outside adviser with no DMARC on its sending domain

Severity CriticalKind Third-party / vendor riskEffort to fix SignificantUpdated 7 Oct 2026By LeakTrace

Definition

A firm’s accountant, lawyer or broker sends mail from a domain with no DMARC policy, so email in that adviser’s name can be forged to ask the firm for a payment.

What it is

Why it matters

The check behind the finding

nslookup -type=txt _dmarc.youradviser.ca

No record, or p=none, means the adviser’s email can be forged.

Closing it

The firm that owns the domain is the one that can close it, and it is done in stages so that none of its real mail is lost. An outside reading of each advisor's domain shows it, and the assessment gives the exact steps to the firm that has to make the change.

The outside watch for your firm: see what is open before anyone else does, with the proof for the lead finding. Check my firm →