Free Email Spoofing Check for Canadian Business Domains
Enter your domain for a free, instant read of the three DNS records that stop someone sending email in your name: SPF, DKIM and DMARC. No sign-up, no email address, no sales call. In our own scan of 481 mail-enabled Greater Toronto Area business domains, only 35.6% had all three in place, and just 20.6% had DMARC set to actually block forged mail.
Reads only public DNS records. Nothing is scanned, accessed or stored.
What Canadian business domains actually score
Most email-security statistics quoted in Canada come from American vendors measuring American domains. These do not. On 1 August 2026 IT Rapid Support ran public DNS lookups against a random sample of 500 Greater Toronto Area business domains; 481 were mail-enabled and form the denominator for every figure below.
| Measure | Result | Domains |
|---|---|---|
| Publishes SPF | 91.7% | 441 of 481 domains |
| Publishes DMARC | 52.4% | 252 of 481 domains |
| DKIM at a common selector | 52.8% | 254 of 481 domains |
| DMARC actually enforcing | 20.6% | 99 of 481 domains |
| DMARC left at p=none (blocks nothing) | 31.8% | 153 of 481 domains |
| SPF, DKIM and DMARC all present | 35.6% | 171 of 481 domains |
The gap between adoption and enforcement is the whole finding. Just over half of GTA business domains publish a DMARC record, but 153 of those 252 are parked at p=none, which reports forged mail and blocks none of it. Separately, a re-scan of the same sample on 5 August 2026 found only 1.3% of 479 domains publishing an MTA-STS policy, so modern SMTP transport security is effectively absent from this market. The full GTA email authentication study publishes the method and the limits, and the platform breakdown splits the enforcement gap by Microsoft 365 versus Google Workspace.
What this check looks at
Three public DNS records protect your domain from email impersonation. SPF lists the servers allowed to send mail for you. DKIM adds a tamper-proof signature to every message. DMARC ties them together and tells receiving servers to block mail that fails — but only when its policy is set to quarantine or reject. Missing or monitor-only records are the gap behind most business email compromise and invoice-redirection fraud.
We ran this exact review across 118 GTA businesses — read the full study. For a deeper primer, see our guide to SPF, DKIM and DMARC explained, or explore our managed email security services for Toronto and GTA businesses. Email authentication is one of fifteen control areas in our free IT risk calculator, which scores your wider posture and ranks what to fix first — also entirely in your browser. And if an IT provider has quoted you for fixing any of this, our managed IT quote checker scores the proposal itself against 22 things it should say — including whether email authentication is left at monitor-only.
This tool performs read-only lookups of public DNS records via DNS-over-HTTPS. It does not access, scan, or probe any system, and results are not stored. DKIM detection covers common selectors only and can miss custom configurations.
Free email spoofing check: common questions
Is this email spoofing check free?
Yes. The check is free and ungated: no sign-up, no email address, no credit card and no sales call. It runs in your browser, reads only public DNS records, and returns the result immediately.
Does it work for Canadian business domains?
Yes. It works on any domain, and it was built for Canadian business domains specifically — the benchmark it grades you against is IT Rapid Support’s own measurement of 481 mail-enabled Greater Toronto Area business domains, not a global vendor average. A .ca domain, a .com run by a Canadian company, and a subdomain all work the same way.
What do SPF, DKIM and DMARC actually do?
SPF publishes the list of mail servers allowed to send on your behalf. DKIM adds a cryptographic signature receivers can verify. DMARC ties the two together and tells receiving mail servers what to do when a message fails — nothing, quarantine it, or reject it. Only DMARC at quarantine or reject actually blocks a forged message.
How many Canadian businesses have DMARC set to enforce?
In our own scan of 481 mail-enabled GTA business domains on 1 August 2026, 52.4% published a DMARC record but only 20.6% had it set to quarantine or reject. Another 31.8% sat at p=none, which reports forged mail and blocks none of it. SPF adoption was much higher at 91.7%.
I have a DMARC record. Does that mean my domain is protected?
Not necessarily. A DMARC record set to p=none monitors and reports, and stops nothing. In our GTA measurement, 153 of the 252 domains with DMARC — just over 60% of them — were parked at p=none. This tool reads your policy and tells you which of the three states you are in.
Do you store the domain I check?
No. The lookups run from your browser against public DNS over HTTPS. Nothing is scanned, accessed or probed, no result is written to our systems, and there is no record of what you looked up.
What does it mean if DKIM is not detected?
It means we did not find a key at the common selectors we probe. Some providers use custom selectors that are not discoverable from outside, so a not-detected result is a prompt to confirm rather than proof that DKIM is missing. The same limitation applies to our published research, where the DKIM figure is deliberately reported as an undercount.
What does it cost to fix the gaps this finds?
Publishing SPF, enabling DKIM and moving DMARC past p=none is a short, well-understood piece of configuration work rather than a migration, and it does not require replacing your mail platform. IT Rapid Support stages it for GTA businesses so enforcement goes up without legitimate mail being blocked on the way. Call (289) 582-9930 to talk it through.