Spoofhound research · 2026-11-08
State of DMARC 2026 — Canada
More than three in four Canadian domains can be impersonated by email.
Spoofhound scanned the Canadian web: 26,451 mail-receiving domains across the country’s popular websites and mapped local businesses in every province and territory, checked with the same engine behind our free domain check.
Check your domain — freeThe headline
More than three in four Canadian domains that receive email can be impersonated. Of 26,451 mail-receiving domains checked, 20,394 (77.1%) have no enforced DMARC policy: no record at all, monitor-only, or a broken record. Receiving mail systems are never told to block fakes sent in their name.
Three numbers carry the story:
- •22.9% enforce DMARC. That puts Canada between the US (19.4%) and the UK (24.5%), behind India (24.9%), South Africa (34.1%) and Saudi Arabia (45.7%), and ahead of France (15.7%).
- •Canadian small businesses match American ones: 18.6% against 18.5%. Businesses with one to three locations are as exposed north of the border as south of it.
- •The size gap: 18.6% against 64.0%. Businesses with ten or more locations enforce DMARC at 64.0%, and Canada’s top-100,000-ranked .ca websites at 56.7%.
The average Canadian domain scores 33.8 out of 100 on the full email-security check, and 82.6% have at least one problem worth fixing.
DMARC across the Canadian web
77% of Canadian mail-receiving domains are open to impersonation
20,394 of 26,451 checked domains have no enforced DMARC policy.
No DMARC record
Monitor only (p=none)
Broken or duplicate record
p=quarantine
p=reject
Red: receivers are never told to block fakes · Green: impostor mail is quarantined or rejected.
Four in ten Canadian domains have no DMARC record (42.3%), and a third publish one but leave it at p=none (34.3%). The monitor-only group matters most commercially. These organisations have already started and may well be receiving reports, but stopped short of the setting that actually blocks impostor mail. Finishing that job is exactly what Spoofhound does.
The rest of the stack
| Check | Finding | Domains |
|---|---|---|
| SPF | No record at all: any server anywhere may send as the domain | 3,370 (12.7%) |
| SPF | Record ends +all or ?all: published, but permits everyone anyway | 807 (3.1%) |
| Microsoft 365 DKIM | Both signing selectors broken: outgoing mail can fail authentication today | 96 |
| MTA-STS | Protects inbound mail against interception: adopted (106 of these in testing mode only) | 216 (0.8%) |
| TLS-RPT | Reports failed secure delivery: adopted | 298 (1.1%) |
| BIMI | Verified logo in the inbox: live | 302 (1.1%) |
One in eight Canadian domains has no SPF record at all, between India (11.6%) and the US (17.8%). Without SPF, a business can’t reach DMARC enforcement without breaking its own mail. The newer standards are rare: about 1 in 100 domains use MTA-STS, TLS-RPT or BIMI.
Small businesses against bigger ones
| Population | Domains checked | No DMARC record | Monitor only | Enforced |
|---|---|---|---|---|
| Canadian businesses with 1–3 locations (shops, offices, trades) | 21,063 | 46.8% | 34.0% | 18.6% |
| Canadian businesses with 4–9 locations | 387 | 10.9% | 39.5% | 48.6% |
| Canadian businesses with 10 or more locations | 292 | 5.8% | 30.1% | 64.0% |
| Canada’s top-100,000-ranked .ca websites | 402 | 10.7% | 32.3% | 56.7% |
Protection rises steadily with size, as in the US. Chains and well-known sites have largely done the work: only about one in twenty with ten or more locations lacks a DMARC record. Small businesses are the opposite, with nearly half publishing nothing and 86.4% carrying at least one email-security problem.
Who is most exposed
High-street trades protect fewer than one Canadian domain in ten
Share of each sector’s mail-receiving domains at p=quarantine or p=reject (domains checked in brackets).
Florists (244)
Hair salons (651)
Bakeries (482)
Beauty salons (687)
Bicycle shops (355)
Auto repair shops (586)
Breweries (245)
Cannabis stores (211)
Opticians (274)
Clothes shops (847)
Real estate agents (294)
Car dealers (814)
Law firms (418)
Accountants (184)
Company offices (1,274)
Financial offices (109)
Insurance agents (248)
Government offices (255)
IT companies (171)
Blue: professions that handle client money · dashed line: Canada average (22.9%).
The pattern matches the US closely. Florists, salons, bakeries and bike shops all protect fewer than one domain in ten. Real estate agents sit at 16.7%, below the national average, though they handle deposits that fake-invoice fraud targets. IT companies lead at 45.0%, and even there more than half leave their own name open.
Methodology
Population. 26,451 Canadian domains that receive email (they publish working MX records). They come from two sources:
- Canadian businesses mapped on OpenStreetMap with a website of their own, on any domain ending: 21,742 domains
- every .ca domain in the Tranco top-1-million popularity ranking: 5,353 mail-receiving domains
644 domains appear in both. Social profiles, listing sites and hosted pages the business doesn’t control are excluded.
Checks. Each domain was scanned by Spoofhound’s own engine, the same one behind the free domain check. It covers SPF, DKIM (known selectors used by major email providers Microsoft, Google, SendGrid, Mailchimp and more), DMARC, MTA-STS, TLS-RPT and BIMI. Every figure reflects a scan within the 30 days to 2026-11-08.
Honest limits.
- No separate business-only figure. Canadian government domains under .gc.ca and the provincial .gov suffixes are only 46 of the sample, and universities use plain .ca names that can’t be told apart. The headline is effectively a business figure already.
- Sample skew. The business sample covers mapped businesses with websites, which leans towards visible, consumer-facing trades. Sector figures rest on 100 to 1,300 domains each.
- DKIM. DKIM can only be confirmed present, never absent.
- What “enforced” means. p=quarantine or p=reject on the domain itself. Broken records count as unenforced, because that’s how receiving mail servers treat them.
Data © OpenStreetMap contributors (ODbL) · Tranco list by the Tranco research project.
Where does your domain sit in these numbers? Find out in 30 seconds.
Check your domain — free