Level finding. 58 of 114 registered investment advisers measured (50.9%, 95% Wilson CI [41.8, 59.9]) publish no enforcing DMARC policy and can therefore be impersonated by email to their own clients.
We drew 200 registered investment advisers at random from the regulator's public roster and measured the published email-authentication posture of each, using only public DNS and contacting no one. Of the 114 that were mail-active and on their own domain, about half, 58 of 114 (50.9%, 95% Wilson CI [41.8, 59.9]), publish no enforcing DMARC policy, which means a message that did not originate with the adviser can still reach a client's inbox appearing to. Strict protection (p=reject) is present at 15.8% (18/114). SPF is published at 94.7% and DNSSEC is signed at 7.9%. The protocol, frame, seed and draw rule were fixed and frozen before any data was pulled, and the result is published as measured.
Registered investment advisers hold client account and identity data, and their clients act on email that appears to come from the adviser: a transfer instruction, a statement, a request to sign. Email authentication is the public, checkable control that decides whether a message claiming the adviser's domain can be refused by the receiving mail server. An adviser either publishes an enforcing DMARC policy, or impersonating mail can pass. This study measures which, across a random draw from the regulator's own roster.
Frame. SEC-registered investment advisers with regulatory assets under management of $500 million to $10 billion, a website address on file, and a main office in the 50 states or DC, drawn from the SEC's monthly Form ADV data file (October 2026 release).
Draw. Each eligible row was ordered by the SHA-256 hash of the seed (20261005) joined to its regulator key, and the first 200 were taken, once, without replacement. The rule is reproducible from the frozen frame file. No draw was replaced after an exclusion.
Measures. Passive public DNS only, read through two public resolver sets. No mail was sent and no adviser was contacted. For each registrable domain we resolved DMARC at _dmarc (presence, policy, parseability; RFC 7489), SPF (presence, tri-state with indeterminate reads excluded rather than counted absent; RFC 7208), DNSSEC by the DNSKEY-at-apex definition (RFC 4033 et seq.), and MX as a mail-active check.
Operational definitions. Spoofable: no enforcing DMARC (record absent, p=none, or unparseable). Protected: p=quarantine or p=reject. Strictly protected: p=reject. Shares carry 95% Wilson score intervals. No significance test and no model are used.
Coverage. Of 200 drawn, 114 were measured. Excluded, and in no denominator: 79 because the website on file was a shared platform such as a social-media profile, not the institution's own domain; 7 for having no MX record (not mail-active).
58 of 114 registered investment advisers (50.9%, 95% CI [41.8, 59.9]) publish no enforcing DMARC policy. Of those, 26 publish no DMARC record at all and 32 publish a record at p=none. Any enforcing policy is present at 49.1% (56/114), and strict protection (p=reject) at 15.8% (18/114). Among enforcing records, 1 applies the policy to less than 100% of failing mail.
| Measure | k/n | Share | 95% CI |
|---|---|---|---|
| No enforcing DMARC (spoofable) | 58/114 | 50.9% | [41.8, 59.9] |
| Any enforcing policy | 56/114 | 49.1% | [40.1, 58.2] |
| p=reject | 18/114 | 15.8% | [10.2, 23.6] |
| SPF published | 108/114 | 94.7% | [89.0, 97.6] |
| DNSSEC signed | 9/114 | 7.9% | [4.2, 14.3] |
A from-scratch classifier, written separately from the measurement code, reproduced every count from the raw answers. A second resolution pass through a different resolver set disagreed on 1 field across all 114 domains; the first pass is reported and the disagreement is logged, not reconciled.
This study's interval overlaps none of the other four. The earlier studies used search-compiled frames of smaller businesses; this study and its two companions draw at random from regulator rosters, so the comparison is between different populations and methods of sampling, not a trend.
Published DNS is a proxy for deployed behavior: a domain without an enforcing policy may still filter inbound mail, and the measure concerns mail that claims the adviser's domain, not mail the adviser receives. DKIM is outside passive scope. The registrable domain derived from the website field is taken as the mail domain; a adviser that sends from a different domain is measured on its website domain. The website field in the frame often holds a social-media profile rather than the adviser's own domain; under the pre-registered rule those 79 draws were excluded, not replaced, which leaves 114 measured and a wider interval. If advisers that list a profile differ from those that list their own domain, the level here describes the latter. Regulator data are as of the dates stated in the frame.
An adviser that has not yet moved to an enforcing policy can do so with a single DNS change, after a short monitoring period at p=none to confirm that its legitimate senders, including custodian and CRM platforms, align. The measurement above is exactly what any client, or any attacker, can read from the outside.