Email Spoofing Check for Canadian Business Domains
How to check the three DNS records that stop someone sending email in your name: SPF, DKIM and DMARC, using free public lookup tools or a call with us. In our own scan of 481 mail-enabled Greater Toronto Area business domains, only 35.6% had all three in place, and just 20.6% had DMARC set to actually block forged mail.
Print it and fill it in by hand, or work through it on screen. Want a second opinion on your answers? Call or send us a message and we will go through them with you.
Check your domain
Look up your domain's TXT records with any public DNS lookup tool, or call (289) 582-9930 and we will read them with you. You are looking for three things:
- SPF: a TXT record on your domain that starts with v=spf1
- DKIM: a key published at a selector your mail platform uses, such as selector1._domainkey for Microsoft 365 or google._domainkey for Google Workspace
- DMARC: a TXT record at _dmarc.yourdomain, and whether its policy says p=none, p=quarantine or p=reject
What Canadian business domains actually score
Most email-security statistics quoted in Canada come from American vendors measuring American domains. These do not. On 1 August 2026 IT Rapid Support ran public DNS lookups against a random sample of 500 Greater Toronto Area business domains; 481 were mail-enabled and form the denominator for every figure below.
The gap between adoption and enforcement is the whole finding. Just over half of GTA business domains publish a DMARC record, but 153 of those 252 are parked at p=none, which reports forged mail and blocks none of it. Separately, a re-scan of the same sample on 5 August 2026 found only 1.3% of 479 domains publishing an MTA-STS policy, so modern SMTP transport security is effectively absent from this market. The full GTA email authentication study publishes the method and the limits, and the platform breakdown splits the enforcement gap by Microsoft 365 versus Google Workspace.
| Measure | Result | Domains |
|---|---|---|
Publishes SPF | 91.7% | 441 of 481 domains |
Publishes DMARC | 52.4% | 252 of 481 domains |
DKIM at a common selector | 52.8% | 254 of 481 domains |
DMARC actually enforcing | 20.6% | 99 of 481 domains |
DMARC left at p=none (blocks nothing) | 31.8% | 153 of 481 domains |
SPF, DKIM and DMARC all present | 35.6% | 171 of 481 domains |
What this check looks at
Three public DNS records protect your domain from email impersonation. SPF lists the servers allowed to send mail for you. DKIM adds a tamper-proof signature to every message. DMARC ties them together and tells receiving servers to block mail that fails, but only when its policy is set to quarantine or reject. Missing or monitor-only records are the gap behind most business email compromise and invoice-redirection fraud.
We first ran this review across 118 GTA businesses in July 2026 (a separate, smaller study than the 481-domain August scan above): read the full study. For a deeper primer, see our guide to SPF, DKIM and DMARC explained, or explore our managed email security services for Toronto and GTA businesses. Email authentication is one of fifteen control areas in our IT risk self-check, which scores your wider posture and ranks what to fix first, also as a printable checklist. And if an IT provider has quoted you for fixing any of this, our managed IT quote checker scores the proposal itself against 22 things it should say, including whether email authentication is left at monitor-only.
The figures on this page come from read-only lookups of public DNS records. DKIM detection covers common selectors only and can miss custom configurations.
Email spoofing check: common questions
No. The records are public, so anyone can look them up with public lookup tools, and if you would rather we read them with you, call (289) 582-9930. There is no sign-up.
Yes. The benchmark on this page is IT Rapid Support’s own measurement of 481 mail-enabled Greater Toronto Area business domains, not a global vendor average. A .ca domain, a .com run by a Canadian company and a subdomain are all checked the same way.
SPF publishes the list of mail servers allowed to send on your behalf. DKIM adds a cryptographic signature receivers can verify. DMARC ties the two together and tells receiving mail servers what to do when a message fails: nothing, quarantine it, or reject it. Only DMARC at quarantine or reject actually blocks a forged message.
In our own scan of 481 mail-enabled GTA business domains on 1 August 2026, 52.4% published a DMARC record but only 20.6% had it set to quarantine or reject. Another 31.8% sat at p=none, which reports forged mail and blocks none of it. SPF adoption was much higher at 91.7%.
Not necessarily. A DMARC record set to p=none monitors and reports, and stops nothing. In our GTA measurement, 153 of the 252 domains with DMARC, just over 60% of them, were parked at p=none. Check which of the three states your policy is in.
It means we did not find a key at the common selectors. Some providers use custom selectors that are not discoverable from outside, so a not-detected result is a prompt to confirm rather than proof that DKIM is missing. The same limitation applies to our published research, where the DKIM figure is deliberately reported as an undercount.
Publishing SPF, enabling DKIM and moving DMARC past p=none is a short, well-understood piece of configuration work rather than a migration, and it does not require replacing your mail platform. IT Rapid Support stages it for GTA businesses so enforcement goes up without legitimate mail being blocked on the way. Call (289) 582-9930 to talk it through.
Related.
- ArticleIs Your Company Email Easy to Spoof? SPF, DKIM & DMARC ExplainedMost small businesses have never checked whether criminals can send email as their domain. A plain-English guide to SPF, DKIM, and DMARC, and how to close the gap.
- ToolHow exposed is your business to a cyber attack?Fifteen questions about the controls that decide how bad a cyber incident gets, each with four answers from strongest to weakest.
- ToolWhat is missing from your managed IT quote?Two managed IT proposals can carry the same monthly price and cover completely different things.
- ServiceCybersecurity Services in Toronto: Managed Security for GTA BusinessesWe run the day-to-day security of GTA businesses: account and email protection, endpoint detection, firewall management, alert review and incident response, with a 24/7…
Under attack right now?
Call before you reset passwords, wipe a laptop or pay anyone. A responder will help you contain the incident without destroying the evidence you will need later.