Nearly half of CRE firms lack email spoofing protection

A scan of 398 commercial real estate firms found 46% had no enforcing DMARC policy, leaving forged email able to land in inboxes. Brokerages were twice as exposed as developers, underscoring a gap in protection around the very emails used for closings and payment instructions.

Why it matters: - Commercial real estate firms are exposed to email spoofing, which can be used to impersonate a business and send fraudulent wire or closing instructions. - The risk is concentrated in brokerage workflows, where compromised email could hit deals, payments and client trust. - The scan found brokerages were much less protected than developers, suggesting the weakest point is often where transactions are actually coordinated.

What happened: - DeshTEK Digital scanned 398 commercial real estate firms' internet domains and found 182 firms, or 46%, had no enforcing DMARC policy. - DMARC is the published rule that tells receiving mail servers what to do when an email fails authentication. - Without an enforcing policy, a forged message that appears to come from a firm can reach the recipient's inbox instead of being blocked. - The scan ran on 30 September 2026 and used public company listings to build the sample. - The study excluded 30 architecture, engineering and construction firms and removed duplicates and firms listed under more than one domain.

The details: - Of the 182 unprotected firms, 80 had no DMARC record at all. - Another 102 firms had DMARC set to p=none, a monitoring mode that reports spoofing attempts but does not stop delivery. - Only 115 firms, or 29% of the sample, used p=reject, the setting that blocks forged messages. - Thirty-three firms, or 8%, had neither DMARC nor an SPF record. - Segment results showed net lease specialists at 82% unprotected, brokerage and advisory at 60%, healthcare and medical office at 54%, industrial at 50%, retail at 50%, REITs at 35%, capital markets and investment management at 33%, and developers and owners at 29%. - The scan found 43 firms, or 11% of the sample, published a website address that did not load. - Four firms were serving an expired TLS certificate, which triggers a browser security warning. - Each failed site was re-checked manually with a browser user agent and retries, and 33 sites that failed an automated first pass were excluded after proving reachable.

Between the lines: - The data suggests institutional capital holders have done more of the work on email security than the brokerages that often handle the transaction messages. - Rahul Singh, founder of DeshTEK Digital, said the asymmetry is the core finding because the protection is concentrated away from where the transaction is not. - Singh said the 102 firms at p=none had already done the hard part by publishing DMARC, but left it in monitoring mode. - The study notes that moving from monitoring to quarantine or reject can be done quickly by the team that manages the domain. - The sample was compiled rather than random and skewed toward large REITs and institutional firms, which are generally better protected than average, so the true industry-wide exposure may be worse. - The study also notes that DKIM could not be checked without each firm's selector, so the absence of DKIM from the scan does not mean those firms lack it.

What's next: - DeshTEK Digital published the full method at the full study. - The anonymized dataset is available to journalists on request. - Individual firms were not named. - DeshTEK Digital said all data came from public sources and no firm's systems were accessed. - The company said its marketing intelligence platform is focused on commercial real estate and operates under DeshTek Technologies (OPC) Pvt. Ltd. in Bengaluru.

The bottom line: - Nearly half of scanned CRE firms could be impersonated through email, and the weakest protection sits in the middle of dealmaking, not at the top of the market.