GTA Business Email Security, Q4 2026: Three Months On, DMARC Enforcement Has Not Moved
We re-scanned the public DNS of the same 500 Greater Toronto Area business domains we measured in August 2026. On October 31, 2026, 20.7% of the 482 that receive email enforce DMARC, against 20.6% in August.
Reviewed by the ITRS security team · Last updated
Key findings
This is the second measurement of a fixed panel of GTA business domains. The first scan ran on August 1, 2026 (published in our GTA SMB cybersecurity report); this one ran on October 31, 2026 using the same domains and the same checks, so the two can be compared directly.
- 20.7% of 482 mail-enabled GTA business domains enforce DMARC (p=quarantine or p=reject) as of October 31, 2026, against 20.6% in August 2026.
- 465 of 481 domains (96.7%) had exactly the same DMARC status in October as in August. Two domains started enforcing and two stopped, so the enforcing share did not change.
- 46.3% still publish no DMARC record at all, and a further 33.0% publish p=none, which tells receiving servers to deliver spoofed mail anyway.
- 89 of the 159 domains on p=none (56%) do not ask for DMARC aggregate reports (no rua tag), so nobody receives the data needed to move to enforcement.
- Law firms (11.5%) and accounting firms (13.2%) enforce DMARC at under half the rate of property management companies (29.7%).
- Domains on Google Workspace enforce DMARC at 10.8%, against 27.6% on Microsoft 365, and 21.7% of Google Workspace domains publish no SPF record.
Headline figures: August vs October 2026
All domains in the sample that publish an MX record (August n=481, October n=482). Percentages are of mail-enabled domains.
| Measure | Aug 1, 2026 | Oct 31, 2026 | Change |
|---|---|---|---|
SPF record published | 91.7% | 92.7% | +1.0 pts |
DMARC record published | 52.4% | 53.7% | +1.3 pts |
DMARC enforcing (quarantine or reject) | 20.6% | 20.7% | +0.1 pts |
DMARC p=reject | 8.3% | 8.5% | +0.2 pts |
DMARC p=none (monitor only) | 31.8% | 33.0% | +1.2 pts |
No DMARC record | 47.6% | 46.3% | -1.3 pts |
DKIM found at a common selector | 52.8% | 54.4% | +1.6 pts |
SPF + DMARC + DKIM all found | 35.6% | 37.3% | +1.7 pts |
Neither SPF nor DMARC | 7.3% | 6.4% | -0.9 pts |
What changed, domain by domain
Because the panel is fixed, we can see individual movements without naming anyone. Of 481 domains that received email in both scans, 465 kept the same DMARC status.
Eight domains that had no DMARC record in August published one in October, all at p=none (monitor only). One domain went from no record straight to p=reject, one moved from p=none to p=quarantine and one tightened from p=quarantine to p=reject.
Going the other way, three domains removed their DMARC record entirely, one dropped from p=quarantine to p=none and one dropped from p=reject to p=none. Downgrades like these usually follow a mail-delivery problem, such as a new sending service that was never added to SPF or DKIM, fixed by switching protection off rather than by fixing the sender.
By sector
Sector comes from the industry tag in IT Rapid Support's regional business list. Groups under 20 domains are folded into Other. Unclassified domains have no industry tag.
| Group | Domains (n) | SPF | DMARC published | Enforcing Aug 2026 | Enforcing Oct 2026 | Change |
|---|---|---|---|---|---|---|
Legal | 96 | 94.8% | 46.9% | 11.5% | 11.5% | 0.0 pts |
Unclassified | 77 | 93.5% | 59.7% | 36.4% | 35.1% | -1.3 pts |
Accounting | 68 | 88.2% | 50.0% | 13.2% | 13.2% | 0.0 pts |
Property management | 64 | 92.2% | 65.6% | 28.1% | 29.7% | +1.6 pts |
Manufacturing | 55 | 90.9% | 69.1% | 25.5% | 25.5% | 0.0 pts |
Healthcare (medical, dental, veterinary) | 54 | 90.7% | 38.9% | 13.0% | 11.1% | -1.9 pts |
Construction & trades | 46 | 95.7% | 37.0% | 13.0% | 13.0% | 0.0 pts |
Other | 21 | 100.0% | 71.4% | 28.6% | 33.3% | +4.7 pts |
By city
City is the business address on file. Vaughan includes Woodbridge, Concord and Maple. Cities with fewer than 20 mail-enabled domains are grouped as Other. Small groups move by several points when a single domain changes, so read city figures as indicative.
| Group | Domains (n) | SPF | DMARC published | Enforcing Aug 2026 | Enforcing Oct 2026 | Change |
|---|---|---|---|---|---|---|
Vaughan (incl. Woodbridge, Concord, Maple) | 155 | 93.5% | 52.9% | 19.4% | 20.0% | +0.6 pts |
Toronto | 71 | 93.0% | 62.0% | 26.8% | 26.8% | 0.0 pts |
Other | 58 | 96.6% | 53.4% | 12.1% | 12.1% | 0.0 pts |
Burlington | 49 | 91.8% | 49.0% | 30.6% | 28.6% | -2.0 pts |
Richmond Hill | 48 | 91.7% | 39.6% | 12.5% | 12.5% | 0.0 pts |
Hamilton | 29 | 93.1% | 48.3% | 13.8% | 13.8% | 0.0 pts |
Markham | 26 | 88.5% | 57.7% | 23.1% | 26.9% | +3.8 pts |
Oakville | 23 | 91.3% | 69.6% | 39.1% | 39.1% | 0.0 pts |
Aurora | 22 | 86.4% | 59.1% | 13.6% | 9.1% | -4.5 pts |
By mail platform
Platform is inferred from MX records. Microsoft 365 handles 46.9% of the mail-enabled domains and Google Workspace 24.9%, almost identical to August. The gap in DMARC enforcement between the two platforms has not narrowed.
| Group | Domains (n) | SPF | DMARC published | Enforcing Aug 2026 | Enforcing Oct 2026 | Change |
|---|---|---|---|---|---|---|
Microsoft 365 | 225 | 98.7% | 56.4% | 27.1% | 27.6% | +0.5 pts |
Other platforms (gateways, self-hosted, web hosts) | 136 | 95.6% | 58.1% | 18.4% | 17.6% | -0.8 pts |
Google Workspace | 120 | 78.3% | 43.3% | 10.8% | 10.8% | 0.0 pts |
SPF strictness
Among mail-enabled domains, 45.0% end their SPF record with -all (hard fail) and 44.8% with ~all (soft fail). 6 domains publish more than one SPF record, which is invalid under RFC 7208 and causes SPF to fail with a permanent error.
Method
Sample: 500 domains drawn at random (seed 20260801) on August 1, 2026 from a pool of 3,160 Greater Toronto Area business domains on IT Rapid Support's regional business list. The list leans toward professional services (legal, accounting, property management) and is not a census of all GTA businesses. The October scan used the same 500 domains.
Checks: public DNS lookups only (dig): MX records, the SPF TXT record at the domain apex, the DMARC TXT record at _dmarc, and DKIM keys at 10 common selectors (selector1, selector2, google, default, k1, s1, s2, dkim, mail, zoho). No mail server was contacted and no email was sent.
Mail-enabled means the domain publishes at least one MX record; all percentages use that base. DKIM is checked only at common selectors, so the DKIM figure is a lower bound.
Timing: October 31, 2026 at 1:38 PM ET (17:38 UTC). Any domain that appeared to lose an MX, SPF or DMARC record since August was re-queried against two public resolvers (1.1.1.1 and 8.8.8.8); one of six apparent losses was a lookup timeout and was corrected.
Privacy: results are published only as aggregates. No business in the sample is named.
Download the data
Aggregate figures for both scans, by sector, city and mail platform, are available as a CSV file. Please cite as: IT Rapid Support, GTA Business Email Security Q4 2026 (DNS scan of 500 GTA business domains, October 31, 2026).
Reuse
Reuse: CC BY 4.0. The figures, tables and data in this study may be reused, with credit to IT Rapid Support Inc. and a link to this page.
Frequently asked questions
20.7% of 482 mail-enabled GTA business domains we scanned on October 31, 2026 had a DMARC policy of quarantine or reject. In August 2026 the figure was 20.6%.
Barely. DMARC records rose from 52.4% to 53.7%, but 8 of the 9 new records were set to p=none (monitor only), and the share of domains that actually block spoofed mail stayed flat.
p=none asks receiving servers to report on mail that fails authentication but still deliver it. Only p=quarantine (send to junk) or p=reject (refuse) stops a spoofed message from reaching the inbox.
In our sample, law firms (11.5%), healthcare practices (11.1%), accounting firms (13.2%) and construction (13.0%) had the lowest DMARC enforcement.
Use our email spoof check, or look up the TXT record at _dmarc.yourdomain.com. If it is missing or says p=none, your domain can be impersonated in email.
Related reading.
- ArticleThe State of GTA Small-Business Cybersecurity 2026Original 2026 research: police-reported cybercrime fell across Canada but rose 11.2% in Toronto, and only 20.6% of 481 GTA business domains enforce DMARC.
- ArticleVaughan Business Email Security Study 2026: Only 17.9% Enforce DMARCDNS measurement of SPF and DMARC records across 354 business domains located in the City of Vaughan, Ontario, drawn from OpenStreetMap features with a website or email…
- ArticleMicrosoft 365 vs Google Workspace in the GTA: What 479 Business Domains Actually RunOriginal 2026 research: 46.8% of 479 GTA business domains run Microsoft 365 and 25.1% Google Workspace, and the two enforce DMARC at very different rates.
- GuideRolling out DMARC from p=none to p=rejectPublishing a DMARC record is easy. Getting to p=reject without blocking your own invoices, newsletters and payroll notices takes an inventory, some careful DNS work and…
- ToolEmail Spoofing Check for Canadian Business DomainsHow to check the three DNS records that stop someone sending email in your name: SPF, DKIM and DMARC, using free public lookup tools or a call with us.
- ServiceBusiness email compromise responseSomeone got into a mailbox and a payment went to the wrong account, or nearly did.
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.