have not enforced protection against email that spoofs their own domain
No enforcing DMARC policy · 958 of 1,246
Annual sector research · Edition 1
We checked the email security of 1,252 Melbourne law firms. Most can still be spoofed.
Payment redirection fraud usually starts with an email that looks like it came from your firm. We ran the same twelve public checks against every Melbourne law firm on the Victorian register, without touching a single system. The full report shows what we found, and the short list of fixes most firms can start this week.
- 1,252 firms assessed
- 12 checks each
- Passive, external only
- No firm named
The first edition of a study we run every year, so the profession can watch itself improve.
What we found
The results were worse than we expected.
Three firms in four have not switched on the one setting that tells other mail systems to refuse email pretending to come from their domain. Fewer than one in thirteen refuses it outright. For a profession that moves client money on emailed instructions, that is the finding that matters most.
ask receiving mail systems to refuse forged mail outright, the strictest setting
DMARC policy of reject · 92 of 1,246
have addresses on their domain in known collections of breached data
Breach corpus presence · 55 of 1,246
have addresses caught by password-stealing malware
Information stealer records · 9 of 1,246
Why it matters
This is one of the mechanisms behind payment redirection fraud.
Anyone on the internet can compose an email that shows your firm's real domain in the From line. Nothing stops them writing it. What can stop it being delivered is a setting published in your domain's public records that asks receiving mail systems to refuse or quarantine messages that fail authentication. Three firms in four have either not published that setting or left it in a mode that records failures and asks for nothing to be done.
For most businesses that gap is a nuisance. For a law firm it is a route into payment redirection fraud, where a client receives what looks like an email from your office giving bank details for a deposit or a settlement, and pays a third party. Recovery is uncertain, and responsibility for the loss becomes a matter between the firm, its client and its insurer. The Legal Practitioners' Liability Committee has written about this pattern repeatedly in Call before you pay.
The setting itself costs nothing to publish. The work sits in confirming your own legitimate mail still gets through once it is enforced, and that is where most firms stop. The report sets out what to publish and in what order, written so you can hand it to whoever looks after your domain.
What's inside the report
The full findings, in plain language, with the fix.
- The full picture across all 1,246 graded firms, as counts and percentages
- Why being on Microsoft 365 or Google Workspace does not fix it on its own
- Credential and password-stealer exposure, broken down by mail platform
- The fix, in order, including the 2026 change to the DMARC standard that quietly broke a common setting
- What belongs alongside the email fix, and the one control that catches what the records miss
- How firms score, and the full method behind every number
How we did it
Passive, external, and honest about who we are.
We publish this study every year, so the profession can see whether it is improving. This is the first edition.
Nothing was touched
Every finding comes from public DNS records, published certificates, the response of each firm's public website, and third party breach data. No system was accessed, probed or logged into.
The whole profession
The list was built from the statutory Register of Lawyers, not a directory. Within the firms we could identify with a working domain, this is a population, not a sample.
No firm is named
We publish counts and nothing further. Where a check surfaced something serious and current, we contacted that firm directly before the report was prepared.
Repeated every year
This is an annual study. We run the same checks each year and publish the results, so any firm can track whether the profession, and its own posture, is getting better.
Our interest, stated plainly. Unity Systems produced this study. We are an Australian IT and cyber security company, we work with professional firms, and we sell the services it describes. We are not a neutral party, and we would rather you knew that up front. The method and every figure are published in the report so you can check the findings for yourself.
Get the report
Read the full study. It's free.
Enter your work email and we'll unlock the PDF right here, straight away.
Your report is ready.
The Melbourne Legal Sector External Exposure Study, Edition 1.
If it doesn't open, click the button above. Reading it with your IT partner? Forward them the fix in section 06. Prefer to talk it through? Book a free Security X-Ray.
Questions
Fair questions before you hand over an email.
Is it really free?
Yes. The full report is free. We ask for a work email so we know the study is reaching the firms it's about, and so we can let you know if we publish a correction or a later edition.
Will you spam me?
No. We'll send the report and nothing else, unless you tick the optional box to hear from us occasionally. You can unsubscribe any time.
Is my firm named in the report?
No firm is named anywhere in the study. We publish counts only. If a check surfaced something serious and current for a specific firm, we contacted that firm privately before publishing.
Why won't a Gmail or Outlook address work?
The study is about firms and their own domains, so the download asks for a work address. If you're a sole practitioner without one, call us on 1300 313 384 and we'll send it across.
Want to know exactly where your firm stands?
The study measures the profession. A scan measures you. Run the passive 60-second check on your own domain, or book a free Security X-Ray and we'll walk you through the fixes.