What we found checking 282 Irish recruitment agencies
In October 2026 we checked the email settings and websites of independent Irish recruitment agencies. Here is what we found, why it matters when you hold candidates' details, and what putting it right costs.
What we found
- 207 of 268
- agencies' email domains have nothing telling inboxes to stop email forged in their name.
- 32 of 251
- websites have no privacy notice a candidate can reach from the homepage, or a CV form with none beside it.
- 40 of 251
- websites start tracking visitors before they have agreed to anything.
Email settings were read from public DNS. Every website finding was opened again in a real browser to confirm it before we counted it.
Why it matters to a recruiter
Your name on a fake job offer
Without DMARC set to enforce, anyone can send email that shows your agency's own address. A fake offer asking a candidate for a visa fee or their bank details looks exactly like your real email, and the candidate has no way to tell. DMARC set to reject stops email using your exact address. Lookalike addresses need a different check, and we show you how to spot them.
Candidates you find yourself
When you take someone's details from LinkedIn or a CV database, the GDPR (Article 14) says you tell them who you are, where you got their details and what you will do with them. If you contact them, that goes in your first message. If you don't, you have a month.
The CV form and the cookie banner
When someone sends you their CV, the GDPR (Article 13) says they should see what happens to it at that moment: a line beside the form and a link to your notice. And Irish law needs a visitor's agreement before any tracking tool loads on your site.
What we do about it
- Email protection, €450 once
- We put in SPF and DMARC in stages. First we read the reports, so email from your recruitment CRM, job boards and payroll keeps arriving. Then we set it to reject anything forged.
- GDPR pack, €650 once
- A privacy notice written for how you work, covering candidates you find yourself as well as those who apply, and the line that goes in your first message to them. A record of what you hold and why, and the steps for when someone asks for their data or something goes wrong.
What you pay for either comes off Protect if you take it within three months. Protect does the whole job: email, cookies, two-step sign-in, backups, a plan for when something goes wrong, and the evidence your clients' security questionnaires and your insurer ask for.
Find out where your agency stands
Send us your website and we will tell you what a candidate sees on it and whether your email can be faked. It is free, and we reply by the end of the next working day: hello@fourwindsdigital.com. Or start the free compliance check yourself.