We scanned 442 security consultancies. Half spoofable

We checked the email authentication of 442 security, GRC and compliance consultancies — the firms companies hire to assess their controls, prepare them for SOC 2 and ISO 27001, and tell them to enforce DMARC. On their own domains, 42% can be spoofed: 187 of the 442 sit at DMARC p=none or publish no DMARC at all, which tells receiving servers to deliver forged mail from their domain without interference. Only 24% are at full p=reject, and 96% publish no transport-security policy.

It's the same check these firms run on their clients, read from public DNS in seconds. Here it is run back on them.

The headline numbers

Across the 442 consultancy domains:

• 85% publish DMARC (374/442) — but only 58% enforce it at quarantine or reject (255/442).
• Just 24% are at full p=reject (108/442) — barely one in four.
• 42% are spoofable (187/442): 119 at p=none (monitoring only, no protection) and 68 with no DMARC at all.
• Of the ones that do publish DMARC, 84 collect no reports (no rua) — enforcing or not, they can't see who is failing.
• 95% publish SPF (421/442), 58% with a -all hardfail.
• 70% have a detectable DKIM signature (311/442).
• Only 4% publish MTA-STS and 5% TLS-RPT — the records that force and report encrypted SMTP delivery.

So SPF is nearly universal, DMARC enforcement is a coin-flip, and transport security is almost non-existent.

The 42% that can be spoofed

187 of these firms leave the front door open: a phishing email forging their domain in the "From:" line is delivered to a recipient's inbox with nothing stopping it. For most businesses that's a routine gap. For a consultancy whose deliverable is "we assessed your security posture," it's the finding they'd write up in red on a client — sitting unfixed on their own domain.

To be fair to the ones at p=none: that's a legitimate first step. You publish it, watch the aggregate reports, then ramp to quarantine and reject. The problem is the ramp stalling — and the 84 firms with DMARC but no rua address aren't even collecting the reports that would tell them it's safe to move up.

We're not naming individual firms here; the full per-domain breakdown — every consultancy's SPF, DKIM, DMARC and MTA-STS side by side — is on the GRC-consultancy leaderboard, read straight from their public DNS.

The ones setting the standard

Nine firms do the whole thing right — DMARC at p=reject and MTA-STS to force encrypted delivery:

alphabit.gr · bare-consult.com · digitalxraid.com · evalian.co.uk · reckonsecurity.com.au · rightcue.com · sapphire.net · securecyber.co.uk · threatscene.com

That's the bar: enforce DMARC so nobody can send as you, and require TLS in transit so nobody can read or downgrade your mail. Two percent of the cohort clear it.

Why this one is worth fixing first

If you run a security or GRC practice, this is the cheapest credibility you will ever buy. Your own domain is the first thing a prospect's security team checks before they trust you with theirs — and it takes an afternoon: move DMARC off p=none, publish a rua so you can watch the reports, and add an MTA-STS policy.

Start by seeing exactly where your domain stands:

Check your domain's DMARC →

And if you assess client domains for a living, the same 18-check scan runs on any of theirs — that's the workpaper for security teams and consultancies we built for exactly this.