Vaughan Business Email Security Study 2026: Only 17.9% Enforce DMARC

Of the 290 mail-enabled Vaughan business domains we checked on 4 October 2026:

• 82.1% of mail-enabled Vaughan business domains (238 of 290) do not enforce DMARC. For those domains, a receiving mail server has no instruction from the owner to refuse or quarantine a message that fails authentication.
• Nearly half, 48.6%, publish no DMARC record at all. Another 33.1% publish one set to p=none, which asks receivers to take no action.
• Of the 96 domains at p=none, 64 (66.7%) also have no reporting address (rua). Those records neither block spoofed mail nor tell the owner it is happening.
• SPF is the part most businesses have: 89.0% publish an SPF record. But 10 domains (3.4%) publish two SPF records, which makes SPF invalid under the standard, and another 10 end their record with ?all, which tells receivers nothing.
• Only 14 domains, 4.8%, have reached p=reject, the setting that tells receivers to refuse failing mail outright.

We also classified each domain's mail platform from its MX records. Microsoft 365 handled mail for 88 domains (30.3%), Google Workspace for 80 (27.6%), and 122 used other hosts, mostly web hosting companies and email security gateways.

DMARC matters because of how payment fraud works. In business email compromise, which the Canadian Anti-Fraud Centre calls payment redirection fraud, a criminal sends an email that looks like it comes from a supplier, a director or a lawyer and asks for banking details to be changed or an urgent payment released. When the domain in the From line has no enforcing DMARC policy, the receiving server has nothing from the owner telling it to refuse a forged message, so the forgery is judged on the receiver's own filtering alone.

The losses are not abstract. Data from the Canadian Anti-Fraud Centre shows Canadians lost over $704 million to fraud in 2025, and the Competition Bureau's Fraud Prevention Month release notes that only 5% to 10% of frauds are reported. A Vaughan distributor whose customers pay invoices by email, a Woodbridge law office handling closing funds or a Concord contractor taking deposits is exactly the kind of business a forged email is designed to imitate.

There is also a deliverability reason, separate from fraud. The three largest consumer mailbox providers now require authentication:

• Google requires every sender to Gmail accounts to set up SPF or DKIM, and senders of more than 5,000 messages a day to also publish DMARC, at a minimum of p=none, with the From domain aligned (Google email sender guidelines).
• Yahoo requires SPF or DKIM from all senders, and from bulk senders both SPF and DKIM plus a valid DMARC policy of at least p=none (Yahoo Sender Hub).
• Microsoft began enforcing SPF, DKIM and DMARC (at least p=none) on 5 May 2025 for domains sending more than 5,000 messages a day to Outlook.com, Hotmail and Live addresses, rejecting non-compliant mail (Microsoft Defender for Office 365 blog).

Sources. We built the list from OpenStreetMap, the open map database, querying through the public Overpass API for every mapped feature inside the City of Vaughan administrative boundary with a website or email tag. That returned 936 map features on 4 October 2026. We reduced each website or email address to its domain and removed features tagged as a national brand or chain, schools, places of worship, government and other public bodies, social media and website-builder platforms, domains appearing at more than three Vaughan locations, and a short manual list of remaining chains, charities and out-of-area domains. That left 354 unique business domains, from restaurants, dental clinics and salons to manufacturers, distributors and professional offices.

DNS checks. For each domain we queried public DNS on 4 October 2026, starting 13:07 UTC (9:07 AM ET), using the dig tool against public resolvers (Cloudflare 1.1.1.1, with Google 8.8.8.8 as fallback). We read the MX records to decide whether the domain receives mail (a domain with no MX, or a null MX, was counted as not mail-enabled; 64 of 354), the TXT records at the domain for SPF (v=spf1), and the TXT records at _dmarc for DMARC. DMARC policy was read from the p= tag; SPF was classified by its final all mechanism. Nothing was sent to any business and no system was probed beyond public DNS. Anyone can repeat a single check with our email spoofing check.

Limitations. OpenStreetMap is volunteer-mapped, so the sample over-represents shops, restaurants, clinics and businesses that have a website and that someone has mapped; it is not a random sample of all Vaughan businesses, and large industrial firms are under-represented. A business whose mail domain differs from its website domain was measured on the website domain. We did not check DKIM, because DKIM keys live at selector names that cannot be listed from outside, and a DMARC record says what the owner asked for, not what every receiver does. Platform and business-type subgroups are small. DNS changes daily, so these figures describe 4 October 2026 only.

If your domain is among the 82.1% that do not enforce DMARC, the fix is a few DNS records and some patience. Done in this order, legitimate mail keeps arriving the whole way through.

• Check where you stand. Run your domain through our email spoofing check or ask whoever manages your DNS to show you the SPF and _dmarc records. Note whether DMARC is missing, at p=none or enforcing.
• List every service that sends email as your domain. Microsoft 365 or Google Workspace, plus the ones people forget: the accounting package that emails invoices, the newsletter tool, the booking system, the website contact form, the scanner that emails PDFs.
• Publish one correct SPF record and turn on DKIM. One SPF record only, including each legitimate sender, ending in ~all or -all. Enable DKIM signing in Microsoft 365 or Google Workspace and in each third-party sender that supports it.
• Publish DMARC at p=none with a reporting address, then read the reports. The rua address is the part two thirds of Vaughan's p=none domains are missing. A few weeks of reports show which legitimate senders still fail, so you can fix them before enforcing.
• Move to quarantine, then reject. Once the reports show your own mail passing, step up to p=quarantine and then p=reject. Recheck whenever you add a new email tool.