Tax season may be months away, but criminals who impersonate accounting firms do not follow a seasonal calendar. A new study of public DNS records shows that most small tax practices remain wide open to email spoofing, and the gap between what firms have configured and what actually protects them is stark.
Investment and expense management platform Hub Software examined the publicly visible email settings of 3,609 U.S. tax practices with two to eight preparers, drawing its sample from the IRS public PTIN list with one firm per web domain. The findings were reported by Accounting Today on October 15, 2026.
The enforcement gap in numbers
The first layer of protection is nearly universal. The study found that 97% of firms configure their email to check whether the sending mail server is authorized to originate email from their domain through a published Sender Policy Framework record. SPF adoption, in other words, is essentially solved.
DMARC is where things fall apart. Some 65% of firms publish a Domain-based Message Authentication, Reporting and Conformance policy, which tells receiving providers what to do when anti-spoofing checks fail. But 45% of the firms that have such a policy set it to “none”, a monitoring mode that blocks nothing even when authentication fails. Only 34% of firms tell their email providers to set aside or refuse email that fakes their name.
Adding it all together, only 29% of the firms surveyed were fully protected with SPF, enforced DMARC and DKIM signing. In other words, fewer than one in three small tax practices actively stops criminals from sending email that appears to come from the firm.
Small firms and Google Workspace users lag behind
Risk scales with size, but not in the way you might hope. Of firms with two to three preparers, only 32% actively block fake email sent from their domain, versus 42% of those with four to five preparers and 45% of those with six to eight. The smallest firms made up the largest portion of the sample, 77%, which means the under-protected majority is the industry norm rather than the exception.
The platform split is even more striking. Of firms using Google Workspace, only 12% actively block email impersonation. Among Microsoft users the figure is 37%, and firms with an upfront security filter reach 41%. The gap suggests that defaults and console design shape security outcomes more than intent does.
Geography varies widely too. Mississippi was the least protected state, with only 15% of firms showing SPF, enforced DMARC and DKIM signing, while Iowa led the country at 58%.
Why this matters more for tax firms than most businesses
A tax firm’s email address is a key to its clients’ trust, as the report itself puts it. If a criminal can send email that looks like it came from the firm, clients will open the attachment, click the link or send the documents. Tax practices exchange W-2 forms, bank details and complete tax returns by email, so a successful impersonation of the firm’s domain can hand an attacker exactly the data needed for refund fraud and identity theft.
The fix is a known path
The remediation the report describes is the standard DMARC journey, and it is achievable for a small firm in weeks rather than months. Turn on DKIM signing in Microsoft 365 or Google Workspace, then publish the records the platform provides. Publish DMARC at “none” with reporting switched on and read the aggregate reports for two to four weeks, because they will show every service sending as the firm, including payroll tools, e-signature platforms and the tax software’s client portal. Once every legitimate sender is covered, move the policy to “quarantine” and then to “reject”. That last step is the one that stops fake email.
SPF adoption is nearly universal, but a DMARC record set to “none” leaves the door open for anyone who wants to send as your domain. Excello Mail turns your DMARC aggregate reports into a clear picture of every service sending as you, so you can move from monitoring to enforcement without breaking legitimate mail. Sign up for free to Excello Mail and close the gap before someone else exploits it.