GTA Business Email Security, Q4 2026: Three Months On, DMARC Enforcement Has Not Moved

This is the second measurement of a fixed panel of GTA business domains. The first scan ran on August 1, 2026 (published in our GTA SMB cybersecurity report); this one ran on October 31, 2026 using the same domains and the same checks, so the two can be compared directly.

How this differs from our Fall 2026 study: the Q4 2026 study re-measures a fixed panel of 500 domains to track change over time; the Fall 2026 edition is a new one-time sample of 3,648 mail-enabled domains.

• 20.7% of 482 mail-enabled GTA business domains enforce DMARC (p=quarantine or p=reject) as of October 31, 2026, against 20.6% in August 2026.
• 465 of 481 domains (96.7%) had exactly the same DMARC status in October as in August. Two domains started enforcing and two stopped, so the enforcing share did not change.
• 46.3% still publish no DMARC record at all, and a further 33.0% publish p=none, which tells receiving servers to deliver spoofed mail anyway.
• 89 of the 159 domains on p=none (56%) do not ask for DMARC aggregate reports (no rua tag), so nobody receives the data needed to move to enforcement.
• Law firms (11.5%) and accounting firms (13.2%) enforce DMARC at under half the rate of property management companies (29.7%).
• Domains on Google Workspace enforce DMARC at 10.8%, against 27.6% on Microsoft 365, and 21.7% of Google Workspace domains publish no SPF record.

All domains in the sample that publish an MX record (August n=481, October n=482). Percentages are of mail-enabled domains.

Because the panel is fixed, we can see individual movements without naming anyone. Of 481 domains that received email in both scans, 465 kept the same DMARC status.

Eight domains that had no DMARC record in August published one in October, all at p=none (monitor only). One domain went from no record straight to p=reject, one moved from p=none to p=quarantine and one tightened from p=quarantine to p=reject.

Going the other way, three domains removed their DMARC record entirely, one dropped from p=quarantine to p=none and one dropped from p=reject to p=none. Downgrades like these usually follow a mail-delivery problem, such as a new sending service that was never added to SPF or DKIM, fixed by switching protection off rather than by fixing the sender.

Sector comes from the industry tag in IT Rapid Support's regional business list. Groups under 20 domains are folded into Other. Unclassified domains have no industry tag.

City is the business address on file. Vaughan includes Woodbridge, Concord and Maple. Cities with fewer than 20 mail-enabled domains are grouped as Other. Small groups move by several points when a single domain changes, so read city figures as indicative.

Platform is inferred from MX records. Microsoft 365 handles 46.9% of the mail-enabled domains and Google Workspace 24.9%, almost identical to August. The gap in DMARC enforcement between the two platforms has not narrowed.

Among mail-enabled domains, 45.0% end their SPF record with -all (hard fail) and 44.8% with ~all (soft fail). 6 domains publish more than one SPF record, which is invalid under RFC 7208 and causes SPF to fail with a permanent error.

Sample: 500 domains drawn at random (seed 20260801) on August 1, 2026 from a pool of 3,160 Greater Toronto Area business domains on IT Rapid Support's regional business list. The list leans toward professional services (legal, accounting, property management) and is not a census of all GTA businesses. The October scan used the same 500 domains.

Checks: public DNS lookups only (dig): MX records, the SPF TXT record at the domain apex, the DMARC TXT record at _dmarc, and DKIM keys at 10 common selectors (selector1, selector2, google, default, k1, s1, s2, dkim, mail, zoho). No mail server was contacted and no email was sent.

Mail-enabled means the domain publishes at least one MX record; all percentages use that base. DKIM is checked only at common selectors, so the DKIM figure is a lower bound.

Timing: October 31, 2026 at 1:38 PM ET (17:38 UTC). Any domain that appeared to lose an MX, SPF or DMARC record since August was re-queried against two public resolvers (1.1.1.1 and 8.8.8.8); one of six apparent losses was a lookup timeout and was corrected.

Privacy: results are published only as aggregates. No business in the sample is named.

Aggregate figures for both scans, by sector, city and mail platform, are available as a CSV file. Please cite as: IT Rapid Support, GTA Business Email Security Q4 2026 (DNS scan of 500 GTA business domains, October 31, 2026).

Reuse: CC BY 4.0. The figures, tables and data in this study may be reused, with credit to IT Rapid Support Inc. and a link to this page.