46% of Commercial Real Estate Firms Can Be Impersonated by Email, Scan Finds

Scan of 398 CRE firms finds brokerages (60%) twice as exposed as developers (29%). No enforcing DMARC means forged email reaches the inbox.

BENGALURU, KARNATAKA, INDIA, October 1, 2026 /EINPresswire.com/ -- Nearly half of commercial real estate firms have not switched on the standard protection that stops criminals sending email in their name, according to a scan of 398 CRE firms' internet domains published today by DeshTEK Digital.

The scan checked each firm's DMARC record — the published instruction that tells receiving mail servers what to do with an email that fails authentication. 182 of the 398 firms, or 46%, had no enforcing policy, meaning a forged email appearing to come from the firm is delivered to the recipient's inbox rather than blocked.

Of those, 80 firms had no DMARC record at all. A further 102 had published one and left it set to p=none, a monitoring mode that reports forgery to the firm without stopping it. Only 115 firms, 29% of the sample, used p=reject, the setting that actually blocks a forged message. Thirty-three firms, 8%, had neither DMARC nor an SPF record.

Brokerages are the least protected

The gap between segments was wider than the overall figure suggests:

Net lease specialists: 82% unprotected (17 firms scanned)
Brokerage and advisory: 60% (82 firms)
Healthcare and medical office: 54% (13 firms)
Industrial: 50% (28 firms)
Retail: 50% (12 firms)
REITs: 35% (52 firms)
Capital markets and investment management: 33% (21 firms)
Developers and owners: 29% (21 firms)

Firms holding institutional capital have largely done the work. The brokerages coordinating transactions between them have not, despite being the party whose email most plausibly carries closing and payment instructions.

"A developer with a security team has DMARC set to reject. The brokerage arranging their next disposition often does not, and that brokerage is the one emailing wiring details near a closing," said Rahul Singh, Founder of DeshTEK Digital. "The asymmetry is the whole finding: the protection is concentrated exactly where the transaction is not."

"The 102 firms sitting at p=none are the interesting group," said Singh. "They did the hard part, someone published a DMARC record, and then left it in monitoring mode, which tells you about forgery after it has already been delivered. Moving to quarantine or reject is an afternoon's work for whoever runs the domain."

Websites

The scan also found that 43 firms, 11% of the sample, publish a website address that does not load, and four are serving an expired TLS certificate, which shows visitors a browser security warning. Every failed site was re-checked individually with a browser user agent and retries; 33 sites that failed an automated first pass proved reachable and were excluded.

Method

The scan ran on 30 September 2026 against 449 domains from public company listings. After removing duplicates, consolidating firms appearing under more than one domain, and excluding 30 architecture, engineering and construction firms, 398 distinct CRE firms remained, each counted once. DMARC and SPF records were read from public DNS over DNS-over-HTTPS, with every negative result re-checked against a second independent resolver.

All data is public. Nothing required a login and no firm's systems were accessed. The full method is published at https://www.deshtekdigital.com/press/cre-email-spoofing-study.html and the anonymised dataset is available to journalists on request. Individual firms are not named.

Two limitations are stated plainly. The sample is compiled rather than random, and weighted toward large REITs and institutional firms, which are better protected than average, so the true industry-wide figure is likely worse. And DKIM cannot be checked without knowing a firm's selector, so its absence from this study does not mean these firms lack it.

About DeshTEK Digital

DeshTEK Digital is an AI marketing intelligence platform built specifically for commercial real estate, with 28 tools covering website and reputation audits, AI search visibility across Claude, ChatGPT and Gemini, backlink intelligence, broker authority scoring, lease abstraction and client reporting. It is operated by DeshTek Technologies (OPC) Pvt. Ltd., Bengaluru, India. https://www.deshtekdigital.com

Media contact
Rahul Singh, DeshTek Technologies (OPC) Pvt. Ltd.
info@godeshtek.com
https://www.deshtekdigital.com

Rahul Singh
DeshTek Technologies (OPC) Pvt. Ltd.
+91 97094 68319
rahul@godeshtek.com
Visit us on social media:
LinkedIn
Bluesky
Instagram
Facebook
YouTube
X