46% of Commercial Real Estate Firms Vulnerable to Email Impersonation
News related to:DeshTEK Digital · 2 min read
In a recent scan of 398 commercial real estate (CRE) firms, it was discovered that 46% of these firms can be impersonated by email, a concerning finding that highlights the vulnerability of the industry to phishing and other cyber threats. Brokerages were found to be the most exposed segment, with 60% of them lacking adequate protection, compared to 29% of developers.
The lack of Domain-based Message Authentication, Reporting, and Conformance (DMARC) enforcement is a significant factor contributing to this vulnerability. Out of the 182 firms that had no enforcing policy, 80 had no DMARC record at all, while 102 had published a DMARC record but had it set to "p=none," which only reports on forgery without blocking it. Only 115 firms, accounting for 29% of the sample, had their DMARC set to "p=reject," effectively blocking forged emails.
Breaking down the exposure by segment, net lease specialists were found to be the most vulnerable, with 82% of them unprotected. Brokerages and advisory firms followed closely with 60% of them lacking protection. Healthcare and medical office firms, industrial firms, and retail firms each had 50% exposure, while REITs and capital markets and investment management firms had 35% and 33% exposure, respectively. Developers and owners, the least exposed segment, had 29% exposure.
Rahul Singh, Founder of DeshTEK Digital, emphasized the asymmetry in protection within the CRE industry.
The scan also uncovered that 43 firms, or 11% of the sample, had websites that did not load, and four were serving expired TLS certificates, which would show visitors a browser security warning. Every failed site was rechecked individually with a browser user agent and retries, and 33 sites that failed an automated first pass proved reachable and were excluded.
The scan was conducted on September 30, 2026, against 449 domains from public company listings. After removing duplicates, consolidating firms appearing under more than one domain, and excluding 30 architecture, engineering, and construction firms, 398 distinct CRE firms remained, each counted once. DMARC and SPF records were read from public DNS over DNS-over-HTTPS, with every negative result rechecked against a second independent resolver.
All data from the study is publicly available, and no firm's systems were accessed. The full method is published at https://www.deshtekdigital.com/press/cre-email-spoofing-study.html, and the anonymized dataset is available to journalists on request.