GTA Business Email Security, Fall 2026: 83% of 3,648 GTA Businesses Don't Enforce DMARC

Most Greater Toronto Area businesses can still be impersonated by email. Of 3,648 mail-enabled GTA business domains checked on October 31, 2026, 83.1% do not enforce DMARC, the DNS setting that tells receiving mail servers to block messages forged in a company's name.

How this differs from our Q4 2026 study: this Fall 2026 edition is a new one-time sample of 3,648 mail-enabled domains; the Q4 2026 study re-measures a fixed panel of 500 domains to track change over time.

• 83.1% of 3,648 mail-enabled GTA business domains (3,032) do not enforce DMARC, so email that impersonates them can still be delivered to inboxes. Only 16.9% have a DMARC policy of quarantine or reject (95% confidence interval 15.7% to 18.2%).
• 49.5% of GTA business domains publish no DMARC record at all, and a further 33.1% publish p=none, which asks receiving servers to deliver failing mail anyway. Only 5.9% use the strictest setting, p=reject.
• Just 12.8% of GTA business domains (467 of 3,648) have all three email-authentication controls in place: an SPF record, a DKIM key at a common selector and an enforced DMARC policy.
• Healthcare clinics (medical, dental, physio, veterinary) enforce DMARC least often, at 12.3%, while manufacturers lead at 29.1%. Law firms sit at 18.1% and accounting and tax firms at 16.2%.
• GTA businesses whose mail runs on Google Workspace enforce DMARC at 10.3%, less than half the 23.1% rate on Microsoft 365. 19.5% of Google Workspace domains publish no SPF record, and 15.8% have neither SPF nor DMARC (Microsoft 365: 0.8%).
• 736 of the 1,207 domains on p=none (61.0%) do not request DMARC aggregate reports, so nobody receives the data needed to move safely to enforcement.
• Newer protections are almost unused: 0.4% of GTA business domains publish MTA-STS, 0.4% publish TLS reporting (TLS-RPT), 0.4% publish a BIMI logo record and 2.6% have DNSSEC-validated zones.

All 3,648 domains in the sample that publish at least one MX record, scanned October 31, 2026. Percentages are of mail-enabled domains.

Sector comes from the OpenStreetMap feature tag (for example office=lawyer or amenity=dentist) or the category on the business's public listing. Healthcare clinics include medical, dental, physiotherapy and veterinary practices.

Platform is read from each domain's MX records. Microsoft 365 handles mail for 39.4% of the sample and Google Workspace for 28.8%. Other includes secure email gateways (which often sit in front of Microsoft 365), web-host mail and self-hosted servers.

The gap starts with SPF: 98.9% of Microsoft 365 domains publish an SPF record, against 80.5% on Google Workspace, and it carries through to DMARC in every sector below.

Within every sector, domains on Microsoft 365 enforce DMARC more often than domains on Google Workspace.

Region is taken from the city on the business's public record. Vaughan is shown on its own because it is the largest group in the sample. Read regional differences as indicative: sector mix varies by region.

MTA-STS tells other mail servers to insist on encrypted delivery to your domain, and TLS-RPT sends you reports when that fails. Only 15 domains (0.4%) publish MTA-STS and 13 (0.4%) publish TLS-RPT.

BIMI shows a verified logo next to your messages in supporting inboxes, and requires an enforced DMARC policy. 15 domains (0.4%) publish a BIMI record, 7 of them with a certificate. DNSSEC, which protects DNS answers from tampering, validates for 94 domains (2.6%).

Our DMARC rollout guide explains each step. If a spoofed or compromised mailbox has already been used against your clients, our business email compromise response team is available 24/7 on (289) 582-9930.

1. 01

   Publish one SPF record

   List every service that sends mail as your domain and end the record in -all or ~all. More than one SPF record breaks SPF entirely.

2. 02

   Turn on DKIM signing

   Enable DKIM in Microsoft 365 or Google Workspace and in any marketing or billing system that sends as your domain.

3. 03

   Start DMARC at p=none with reports

   Add a rua address so you receive aggregate reports, then review them for a few weeks to find legitimate senders that fail.

4. 04

   Move to quarantine, then reject

   Once legitimate mail passes, raise the policy. Only quarantine or reject stops spoofed mail reaching the inbox.

Sample frame: every business in the five Greater Toronto Area census divisions (City of Toronto and the regions of York, Peel, Durham and Halton) that has a website on OpenStreetMap and a tag in one of six sectors, plus GTA businesses in the same sectors from public business listings (map business profiles and firms' own websites) compiled by IT Rapid Support. Listings from licensed commercial databases were excluded, as were the 500 domains of our August and October 2026 panel, so this is a new sample.

Cleaning: website addresses were reduced to the registrable domain. Social media, website-builder and booking-platform addresses, government, hospital and university domains, and chains (a domain on three or more OpenStreetMap locations) were removed. Each domain was counted once. The frame held 3,893 domains; 3,648 publish an MX record and form the base for every percentage.

Checks: public DNS lookups only (dig, via the 1.1.1.1 resolver): MX records, the SPF TXT record at the domain apex, the DMARC record at _dmarc, DKIM keys at 10 common selectors (selector1, selector2, google, default, k1, s1, s2, dkim, mail, zoho), MTA-STS at _mta-sts, TLS-RPT at _smtp._tls, BIMI at default._bimi, and DNSSEC validation (the resolver's authenticated-data flag). No mail or web server was contacted and no email was sent.

Quality control: every domain with a missing MX, SPF, DMARC or DKIM result (2,692 domains) was re-queried in full against a second resolver (8.8.8.8). No result changed.

Timing: October 31, 2026, starting 6:58 PM ET (22:58 UTC).

Robustness: the two sources give similar results. OpenStreetMap domains (n=1,187) enforce DMARC at 14.5% and listing domains (n=2,461) at 18.0%. The unweighted average across the six sectors is 18.6%.

Privacy: results are published only as aggregates, and groups under 20 domains are suppressed. No business in the sample is named, and no personal information was collected.

• Not a census. The sample covers businesses that appear on OpenStreetMap or public listings with a website. Healthcare clinics are the largest group (1,311 of 3,648), so the all-domain figures lean toward healthcare; sector tables are the better guide.
• DKIM is checked only at 10 common selectors, so the DKIM and all-three figures are lower bounds. A CNAME at a Microsoft 365 selector is counted as DKIM published even if signing has not been switched on.
• DNS shows configuration, not behaviour. A domain with an enforced DMARC policy can still be compromised through a stolen password, and a domain without one may never have been spoofed.
• Mail platform is read from MX records. Domains behind a secure email gateway are counted as Other even if the mailboxes are in Microsoft 365.
• Sector and city come from public tags and listings, which can be out of date or wrong for some businesses.
• This is a single scan. The Q4 2026 panel study tracks change over time on a different, smaller sample; the two should not be read as a trend.

Aggregate figures by sector, mail platform, region, source and sector by platform are available as a CSV file. The collection and analysis scripts are documented in the method above so the study can be repeated. Please cite as: IT Rapid Support, GTA Business Email Security, Fall 2026 edition (public DNS scan of 3,893 GTA business domains, 3,648 mail-enabled, October 31, 2026). https://itrapidsupport.com/resources/gta-email-security-fall-2026/

Reuse: CC BY 4.0. The figures, tables and data in this study may be reused, with credit to IT Rapid Support Inc. and a link to this page.