Outside reading · Harbourview Law LLP

Do this now

Publish this record

_dmarc.harbourview-law.example

v=DMARC1; p=quarantine; rua=mailto:dmarc@getleaktrace.com

Sign in where your domain's DNS is managed.
That is usually where you bought the domain or your website host; it is the company whose name servers your domain uses.
Open the DNS records for harbourview-law.example.
The screen is usually called DNS, DNS records or Zone editor.
Add a new record and choose the type TXT.
Type _dmarc as the name.
If the screen does not add your domain itself, type _dmarc.harbourview-law.example.
Paste the record above as the value, exactly as copied.
Save the record.

Read the reports for about two weeks. When no mail your firm really sends is landing in spam, change p=quarantine to p=reject in the same record (forged mail is refused).

The full steps for your DNS host

The three most serious of 4 found

The other finding is closed by the same fix.

Finding 1: Nothing tells mail servers to refuse email forged in your name

high

What it means: Someone can send an invoice or a payment instruction in the name of your business today and nothing your domain publishes tells a mail server to refuse it.
Check it yourself: dig TXT _dmarc.harbourview-law.example +short @1.1.1.1
Run this on any computer; it returns the same answer for anyone.
Where the change is made: Your DNS settings.

Fixed by the step above

Finding 2: 1 domain made from your firm's name was registered on 20 September 2026, is set up to send and receive email and has no website. We cannot tell from outside who owns it. Is it yours?

high

What it means: If it is not yours, it can send payment instructions that look like your firm's. The reply goes to them and there is no website to check.
The record: Read from outside on 30 October 2026. The record for this finding is in the assessment.
Where the change is made: Your registrar account.

What your clients could see. An ordinary invoice email, shown as a client’s inbox would draw it.

Accounts <accounts@h•••.example>

Your firm’s own domain is harbourview-law.example.

Invoice 2217, updated banking details

Please find the invoice attached.

Our banking details have changed. Use the account below for this payment.

Illustration. No such email has been sent.

This is what one name shows from outside. The assessment also reads names registered under the same owner, every domain your firm owns and the names of your people. It also sets out what to do about each.

Finding 3: 3 addresses on your domain are present in monitored breach databases

high

What it means: The addresses appear in records published after other sites were breached. The lookup does not say what was listed with them. If a password was reused on your email, someone could sign in to that mailbox and read client files.
The record: Read from outside on 30 October 2026. The record for this finding is in the assessment.
Where the change is made: Each account named.

More about each finding

1. Nothing tells mail servers to refuse email forged in your name

Technical name: No DMARC record; Email forgery score (business email compromise, BEC)
The check: dig TXT _dmarc.harbourview-law.example +short @1.1.1.1
Run this from any computer. It shows what we saw. If it shows something else, we are wrong about this one.
How it works: Anyone, anywhere
any mail server
"From: Harbourview Law LLP"
a forged sender
Your client's inbox
not told to reject it
If this is used against you: Mail forged in your name tells a client to pay somewhere new. Reported business email compromise losses averaged roughly $123,000 per complaint in 2025. Source: FBI IC3 2025

2. 1 domain made from your firm's name was registered on 20 September 2026, is set up to send and receive email and has no website. We cannot tell from outside who owns it. Is it yours?

Technical name: Look-alike domain with mail records
If it is not yours: If you tell us it is not yours, your assessment includes a takedown request to its registrar: the registrar's abuse contact where the public record gives one, the evidence and a letter in your firm's name. With your permission we can send the requests to the registrar and the host in your firm's name and follow them up for 90 days: that is the look-alike response. It covers every live look-alike set up for email or copying your site in your reading and you can add it to the assessment; monitoring includes up to 6 a year. The registrar decides what happens; a domain set up only for email may fall outside its abuse rules.
How it works: harbourview-law.example
your domain
A near-copy of it
is set up to receive email

3. 3 addresses on your domain are present in monitored breach databases

How it works: Another site is breached
at some point
Address listed
in breach data
Addresses on your domain
3 found on the lists

What it means for a law firm

Illustration: what a client would see. Not a real email.

From[email protected]

SubjectUpdated bank details for your next payment

Hello, our bank details have changed. Please use the account below for your next payment. Reply to this email if you have any questions.

For a law firm, that is how a forged note asking a client to wire funds can reach a careful reader.

On the public record · dated and sourced

27 May 2025
California Court of Appeal, Fourth District, case D083655 (United States)

A California appeal court decision published in May 2025 covers a $475,000 settlement payment that went to criminals. They wrote to the paying side's lawyer from a domain one letter different from the other law firm's. The court ordered the paying side to pay again.

On your domain: A domain made from your firm's name is registered and set up to send email.

Matched on the way in the source reported. It does not mean your business was affected.

The rules for law firms

ABA Formal Opinion 477R expects lawyers to make reasonable efforts to prevent unauthorized access to client information sent over the internet. What is reasonable is judged case by case, starting with how sensitive the information is. Source: ABA Formal Opinion 477R.

What each rule expects, in plain words; not legal advice.

How payment fraud reaches a firm

The usual ways payment fraud reaches a firm: someone's mailbox is already being read, public records, someone else in the deal, or mass campaigns.

Each one ends with a message that looks like yours, sent just before a closing, a settlement or a trust-account payment.

A finding is a reason to check, not proof that anyone is inside. We read from outside only and we never go inside your systems or anybody's mailbox.

1. What firms do first: a new password for everyone who handles money. 3 of your addresses are listed in breach data. If a password from that breach is used anywhere else, it can open a mailbox.

2. Then a second sign-in step on every account. If a password is stolen, an account that asks for a second step still stays closed.

The assessment adds the full checklist for your mail system: where each setting is, what you will notice, whether it can stay on and how to undo it. Everything in the assessment

What we read and what came back clear

We read the ten things that reach law firms on 30 October: six clear, three open and one to tidy.

6 clear
3 open
1 to tidy

The 10 things we read

Forged email in your nameOpen
The records that tell inboxes whether to refuse email sent as you (DMARC, SPF and DKIM).
A way in that is open. Listed with the findings.
Look-alike namesOpen
212 names made from yours, each asked whether it is registered and set up for mail.
A way in that is open. Listed with the findings.
Firm addresses in breach dataOpen
Breach records for addresses at your own domain.
Three addresses at your domain are listed. Listed with the findings.
Your website's certificateClear
The certificate your website answers with: its name, its dates and who issued it.
Your website's settingsA setting to tidy
The headers and cookies your website sends to every visitor.
A setting to tidy. Listed with the findings.
Files your site should not showNot read
Common addresses for configuration files, code folders and cloud storage.
Read with the assessment, not on a free reading.
Keys in your website's codeClear
The scripts your front page loads, for keys and passwords left in them.
Software versionsClear
The versions your website and its script libraries show.
Services that answer from the internetNot read
The ports your web host answers on.
Read with the assessment, not on a free reading.
Host names on your domainClear
3 host names on your domain, from its own records and public certificate logs.
Your domain's registrationClear
Its registry record: the expiry date and the lock that refuses a move to another registrar.
Spam, malware and phishing listsClear
Whether your domain or its server is on a spam, malware or phishing list.

Two more parts are read with the assessment.

What the assessment adds

External Cybersecurity Assessment

The fix for every finding
Every finding mapped to the rules
The full outside watch
A deeper read of your website
The watch keeps running

Inside 72 hours. Delivered inside 72 hours of confirmation, human-verified first.
A dated record. A dated, independent record of what was checked, when and by whom. Give it to your lawyer or your insurer, or keep it on file.
When we refund. Your assessment will show more than your outside reading. If it does not, we refund it in full.

$700USD One payment.

Order the assessment Book a 10-minute call

Everything the assessment delivers

Your reading shows 4 findings. The assessment lists every one, with the proof, the exact steps in order and our re-check from outside until it is closed, wherever an outside check can settle it.

What you get

Every finding, proved: Each finding with the check that proves it, which anyone can run.
The fix for every finding: Step by step, with the check that proves it is done. Step by step for each finding, re-checked from outside until it is gone. For forged email we close it where we can reach your DNS host, one click for each step you approve. Where we cannot, you get the exact records to paste.
Human-verified: Every finding is human-verified before release. After delivery you get a recorded walkthrough of your own dashboard: a short video of your page that shows where each fix, document and setting is.
The watch keeps running: For your first month we read email settings every 5 minutes, new certificates for the domain and its look-alikes within minutes, new look-alike registrations every hour and the rest every day. A new finding reaches you the day it appears. Nothing renews on its own. Every check, not only the findings shown here: forged email, look-alike domains, breach-listed addresses, website software and keys left in website code.
Your evidence pack: An owner summary, the technical evidence, a rules and insurance briefing and a dated assessment record. The privacy rules that apply to a law firm and the questions insurers ask at renewal.
An AI security agent on your dashboard: It comes with the assessment. Ask it about any finding in plain English and it answers from your own firm's findings. Our AI agents operate externally. They never log in, never install anything and never touch your internal systems. The one change they can make, to your email records, happens only when you approve it.
What happens after you buy: Discover: Every finding fixed checks recorded on your firm from outside, each with its evidence. Once you buy, the Discover AI agent chooses follow-up checks. Validate: A person reads your assessment before it is released to you. Human-verified, inside 72 hours of confirmation. Close: After you buy, the Close AI agent gives you the steps for each finding, with your DNS host's own screens for an email record where we hold its guide. When you mark one done, AI chooses when to re-check from outside. Monitor: For the first month fixed checks re-check your email settings every 5 minutes, see new certificates for your domain and for look-alikes of your name within minutes, look for new look-alike registrations every hour and re-check everything else every day. The Monitor AI agent puts first the change that needs you. You approve any change to your email records, one step at a time.; A deeper read of your website: its sign-in pages, its forms, every plugin and script that reports its version (matched to public records of known flaws), and hidden instructions planted for AI assistants.

How this differs from what you already have

Your IT provider: Your IT provider keeps your systems running. We read your firm from outside and give you the exact fix for each finding with its proof. We re-check each fix from outside with a date, a record your insurer can see.
A penetration test: A penetration test tries to break in and needs access. We read only what is already public, from outside. We log into nothing.
Your insurer's scan: Your insurer's scan can feed your premium and eligibility. We do not see it. We show you what anyone can see of your firm from outside first, in plain words. You walk into renewal knowing your own answers.
A check you run yourself: A check you run yourself confirms one record. It cannot rank one finding against another.

See a sample assessment

Prefer email? Reply to the email this reading came with, or write to [email protected].

Your contact

Matt Sherzay

Founder, LeakTrace Inc.

[email protected]

About this reading

Method

How we looked: we read only what is visible from outside your firm: public records about harbourview-law.example and published breach lists. Nothing was logged into or tested.

Access

We never accessed your systems. Everything on this page is public.

Date and how to stop

What was publicly visible from outside on 30 October 2026. It does not cover your internal systems.

Why you are getting this: we read owner-run law firms from the outside. To have this reading and your details deleted, reply to the email it came with or write to [email protected]. Outside Reading Policy

More about this reading and your questions

Opened this at info@? It is for the owner. Not the right business? · · Send this reading on ·

The check takes a minute and anyone can run it. A gap like this is usually a default nobody was asked to change.

Who should this go to? A name is enough; an email means we can send it straight there.

Name Email (optional)

Thank you. We will send it to them instead.

How the rating works: High: more than one way in is open. One of them: firm addresses are in breach data. Counting firm addresses in breach data as a way in that is open is our judgement, resting on NIST SP 800-63B on reused passwords and we never say a listed password still works. A lower rating is better. How the rating works

How we prepared this

Public records only. We hold no keys to your firm. We did not log into or touch any of your systems. The first finding above carries its proof; the record for each of the others is in the assessment. Attackers now use AI to find ways in like these. Our outside checks read your firm first. These findings come from automated checks; the paid assessment is human-verified before it is released. If the check comes back different, we are wrong.

Attacks on firms like yours still start with ways in like these. AI makes every step after them faster and cheaper.

The outside watch for Harbourview Law LLP

Discover: We read everything about your firm that anyone outside can see. That includes forged email, look-alike domains, addresses in monitored breach databases, your website software and keys left in website code.
Validate: The first finding above carries its proof: a command that returns the same answer for anyone who runs it, your insurer included. The assessment carries the proof for every finding.
Close: Close each one before it is used. The assessment gives you the fix for each finding, step by step. Forged email closes where we can reach your DNS host. You approve each step with one click: reporting first, then refusing forged email, about four weeks in all, re-checked from outside at every step. Where we cannot, you get the exact record to paste.
Monitor: What anyone can see of your firm changes. On monitoring we re-read your email settings every 5 minutes, new certificates for your domain and for look-alikes of your name within minutes of being logged, new look-alike registrations every hour and everything else every day. We match newly exploited flaws to your website's software within a day. You hear the same day. The first month comes with the assessment.