GTA Email Spoofing Pilot, July 2026: 118 Business Domains

The headline is stark: only 40% of the businesses we checked were fully protected across all three email-authentication standards. The rest had at least one critical gap, and many had several.

1. 01

   SPF: 94% published, and that is the good news

   Sender Policy Framework (SPF) tells the world which mail servers are allowed to send on your behalf. It was the most widely adopted record we found: 94% of domains had one published. SPF alone, however, does not stop a spoofed display name or protect against every impersonation technique: it is the floor, not the ceiling.

2. 02

   DMARC: 42% have nothing at all

   DMARC is the record that ties SPF and DKIM together and tells receiving mail servers what to do with messages that fail authentication. It is the single most important anti-spoofing control, and it is where most GTA businesses fall down: only 58% had a DMARC record at all, meaning 42% have no domain-level protection against impersonation whatsoever. Worse, of the businesses that did publish DMARC, most were not actually enforcing it. The majority sat at a policy of "p=none", monitor-only, which reports spoofing but does nothing to block it. Only a small fraction had moved to "quarantine" or "reject," the policies that actually stop a forged email from reaching the inbox.

3. 03

   DKIM: roughly half

   DKIM cryptographically signs your outgoing mail so recipients can verify it genuinely came from you and was not tampered with in transit. Just over half of the domains we checked had a detectable DKIM signature on common selectors. (This is a conservative figure, DKIM can use custom selectors we would not see externally, but it still points to a wide gap.)

If your domain has no DMARC policy at enforcement, there is nothing today that stops an outsider from sending email that appears to come from your company. For any business that emails clients about payments, invoices, contracts or banking details, property managers, accounting firms, law firms, medical practices, construction and trades, that is the single most valuable gap to close. Domain spoofing is cheap for attackers and expensive for victims.

The reassuring part: the fix is fast, standard, and does not disrupt your mail flow when it is staged correctly. Publishing SPF, enabling DKIM, and rolling DMARC from monitoring to enforcement is typically a short, well-understood project, not a rip-and-replace.

You can see part of this yourself. A DMARC record lives at a TXT record on the subdomain "_dmarc.yourdomain.com" and begins with "v=DMARC1". If it is missing, or if it says "p=none", your domain is not yet protected at enforcement. SPF lives on a TXT record at your root domain and begins with "v=spf1".

Or let the tool do it. Our email spoofing check for Canadian business domains reads exactly these records and returns a plain-language grade in about ten seconds. It is ungated, no sign-up, no email address, and lets you compare your result with the benchmark from our larger 481-domain GTA measurement.

If you would rather have it checked and fixed properly, IT Rapid Support offers a non-intrusive email security and phishing protection review for GTA businesses. We assess your SPF, DKIM and DMARC posture, explain the gaps in plain language, and stage the fixes so nothing breaks. Learn more about our approach to managed cybersecurity across the GTA or call (289) 582-9930.

We reviewed the publicly published DNS records (SPF and DMARC TXT records, DKIM on common selectors, and MX routing) for 118 GTA business domains that operate email. All checks were passive DNS lookups of publicly available records: no systems were accessed, probed, or contacted. Results are reported in aggregate only; no individual organization is identified. DKIM figures are conservative because organizations may use custom selectors not visible in an external review.