Can Your Business Email Be Spoofed?
In our own scan of 481 GTA business domains, only 35.6% had all three of SPF, DKIM and DMARC in place — and just 20.6% had DMARC set to actually block forged mail. Enter your domain for a free, instant check of the three records that stop impersonation.
Reads only public DNS records. Nothing is scanned, accessed or stored.
What this check looks at
Three public DNS records protect your domain from email impersonation. SPF lists the servers allowed to send mail for you. DKIM adds a tamper-proof signature to every message. DMARC ties them together and tells receiving servers to block mail that fails — but only when its policy is set to quarantine or reject. Missing or monitor-only records are the gap behind most business email compromise and invoice-redirection fraud.
We ran this exact review across 118 GTA businesses — read the full study. For a deeper primer, see our guide to SPF, DKIM and DMARC explained, or explore our managed email security services for Toronto and GTA businesses. Email authentication is one of fourteen control areas in our free IT risk calculator, which scores your wider posture and ranks what to fix first — also entirely in your browser. And if an IT provider has quoted you for fixing any of this, our managed IT quote checker scores the proposal itself against 22 things it should say — including whether email authentication is left at monitor-only.
This tool performs read-only lookups of public DNS records via DNS-over-HTTPS. It does not access, scan, or probe any system, and results are not stored. DKIM detection covers common selectors only and can miss custom configurations.