Q1 2026 Report

The Canadian Email Authentication Benchmark

Tracking SPF, DKIM, and DMARC adoption across thousands of Canadian domains.

Read the Benchmark Get DMARC Monitoring — $20/mo

Current Snapshot

2,590 domains scanned

SPF present78%

2,020 of 2,590 domains

DMARC present43%

1,102 of 2,590 domains

DMARC record43%

1,1,102 of 2,590 domains

DMARC enforced17%
433 of 2,590 domains — 83% have no enforcement against email impersonation

Data derived from publicly observable DNS records. No internal systems accessed.

What the Benchmark Shows

Email authentication adoption and enforcement across Canadian organizations.

Adoption Rates

SPF configured78%

DMARC configured43%

DMARC present43%

Enforcement

14%

of domains enforce DMARC

(p=quarantine or p=reject)

p=reject7.2%

p=quarantine9.5%

p=none (monitor only)25.8%

No DMARC at all57.5%

Overall Result

56% FAIL1,454 domains

35% PARTIAL907 domains

9% PASS229 domains

A domain passes when SPF, DKIM, and DMARC are all configured with DMARC enforcement set to quarantine or reject.

Sector & City Insights

Breakdown by industry vertical and geographic region.

Industry Concentration

Healthcare represents 53% of sourced leads

Healthcare7,848

Long-Term Care1,404

Community Support759

Retirement Homes698

Clinics / Family Medicine678

Mental Health264

Professional Services521

Many operate under PIPEDA and PHIPA, requiring safeguards for personal and health information.

Top Cities

Toronto, ON

441

Mississauga, ON

327

Calgary, AB

312

Barrie, ON

311

Brampton, ON

308

Vancouver, BC

287

Edmonton, AB

264

Ottawa, ON

231

Winnipeg, MB

198

Hamilton, ON

176

Methodology

Sources

Yellow Pages (public business directories) 7,731
ODHF / Statistics Canada (healthcare facilities) 6,824
Discovery scans 94

Scan Method

DNS TXT record lookups for SPF, DKIM, DMARC
DKIM checked against common selectors (google, default, selector1, selector2, k1)
MX record analysis for provider detection
Quarterly cadence (next: Q2 2026)

Limitations

External DNS signals only. No access to internal mail systems, logs, or configuration panels.
DKIM detection is limited to common selectors; organizations using non-standard selectors may be undercounted.
ODHF healthcare facilities often lack published websites. Domain resolution is ongoing for 4,195 remaining records.
Results reflect publicly observable state at time of scan and may change.