NATIONAL BENCHMARK
81.3% published DMARC; 55.7% of publishers enforced
836 of 1,028 observed domains published valid DMARC. 466 of those 836 publishers used quarantine or rejection.
RESEARCH DOSSIER / 2026
Published researchReleased August 14, 2026
Canada and Quebec email-authentication benchmark 2026
Across 1,028 observed Canadian organization-domain pairs, 81.3% published valid DMARC and 55.7% of publishers enforced quarantine or rejection. The sourced cohort is a benchmark—not a representative sample of every Canadian business.
81.3%
DMARC adoption
836 of 1,028
55.7%
Enforcement among publishers
466 of 836
13.8%
Publishers without aggregate reporting
115 of 836
3.2%
SPF recursive lookup failures
30 of 926
KEY FINDINGS
Enforcement differs sharply by sector; reporting remains the municipal gap
The benchmark contains 1,030 organization-domain pairs from current official directories and organization sites. Ontario contributes the complete 2026 municipal-directory slice, so the national aggregate is descriptive and is not weighted to make provinces equally represented.
SECTOR GAP
Listed-company enforcement reached 86.4%
That was 57/66 among DMARC-publishing TSX issuers, versus 61.6% (188/305) among Ontario municipalities.
QUEBEC + REPORTING
Quebec measured 95.9% adoption and 84.0% enforcement
Quebec had 98 observations—two short of the standalone-page gate. Among municipal DMARC publishers, 25.6% (78/305) had no aggregate-reporting address.
Public DNS state does not prove compromise, delivery performance or internal security maturity. Organization website hostnames can also differ from alternate sending domains; the downloadable data defines the measured source cohort and every denominator.
SCOPE
What this study measures
- 01Federal, provincial and territorial public organizations.
- 02Municipalities, universities and colleges, health authorities and hospital systems.
- 03A 70-company slice of major Canadian-headquartered TSX issuers verified against their official websites.
RESEARCH QUESTIONS
Questions the data answers
- 01Which provinces and sectors have moved from DMARC monitoring to enforcement?
- 02How often do enforcing organizations collect aggregate reports?
- 03Where are SPF lookup and multiple-record failures concentrated?
- 04Does Quebec differ from the national cohort in measurable, defensible ways?
RELEASE RECORD
How this research became citable
August 14, 2026
Source list and licence review completed
August 14, 2026
1,030-domain verification cohort and DNS scan completed
August 14, 2026
Bilingual Quebec assets and 67-route media brief completed
August 14, 2026
Public evidence package released
The release passed the stated evidence and review gates.
DELIVERY PACKAGE
What is available
- National, provincial and sector aggregate tables.
- English and French Quebec newsroom summaries.
- Local charts supplied directly to reporters without launching thin province pages.
- A 60–100-target national, local and sector outreach brief.
Media posture
Offer national and Quebec first looks concurrently, with tailored charts rather than competing exclusives.
Résumé pour les médias québécois
Parmi 1 028 domaines observés sur 1 030 paires organisation-domaine documentées, 81,3 % publiaient un enregistrement DMARC valide et 55,7 % des domaines qui publiaient DMARC appliquaient une politique de quarantaine ou de rejet. Au Québec, 94 domaines sur 98 publiaient DMARC (95,9 %) et 79 de ces 94 domaines l’appliquaient (84,0 %). Cette cohorte documentée ne représente pas toutes les entreprises québécoises ou canadiennes; les comparaisons provinciales sous 30 observations sont supprimées et le Québec demeure sous le seuil de 100 observations exigé pour une page provinciale autonome.
Published comparisons
Groups below the 30-domain threshold are suppressed. Every visible percentage includes its numerator and denominator.
| Group | Observed | DMARC | Enforcement | No reporting | SPF lookup failure | BIMI among enforcing |
|---|---|---|---|---|---|---|
| Ontario | 556 | 74.3% (413/556) | 60.5% (250/413) | 21.8% (90/413) | 4.1% (21/508) | 4% (10/250) |
| Federal | 215 | 86.5% (186/215) | 29% (54/186) | 2.2% (4/186) | 2.8% (5/180) | 1.9% (1/54) |
| Quebec | 98 | 95.9% (94/98) | 84% (79/94) | 3.2% (3/94) | 1.1% (1/93) | 5.1% (4/79) |
| British Columbia | 37 | 94.6% (35/37) | 54.3% (19/35) | 8.6% (3/35) | 5.7% (2/35) | 10.5% (2/19) |
| Alberta | 35 | 97.1% (34/35) | 76.5% (26/34) | 11.8% (4/34) | 0% (0/33) | 0% (0/26) |
Reusable charts
SVG and PNG versions are licensed CC BY 4.0.
Methodology
- 1.Retain row-level source URLs, source dates, licence notes and verification status for every organization-domain pair. Federal mappings come from the official departments and agencies directory cross-checked against organization reference data.
- 2.Use official organization website hostnames as scan targets. Consolidate health facilities at the system level while retaining legitimately shared domains across distinct organizations.
- 3.Suppress provincial or sector metrics below 30 observations; keep standalone province pages unpublished unless they meet the stricter 100-domain gate.
Measurement record
- Corpus and observations
- 1,028 observed of 1,030
- Scan window
- Aug 14, 2026, 07:29 PM UTC to Aug 14, 2026, 07:29 PM UTC
- Scanner version
- 2.0.0
- MX classifier version
- 2026-08-14.2
Pinned source snapshot
752a2bfa077085a2a10e7fb50ef1b2e8e95538d04bb3c98314c98a32c6626d85Limitations
- — The cohort is a sourced benchmark, not a representative sample of every Canadian business.
- — Ontario contributes the complete official 2026 municipal-directory slice and therefore has substantially more observations than other provinces. National figures are not province-weighted.
- — The health-system and 70-company TSX slices cover selected major organizations, not every Canadian health provider or listed issuer.
- — An official organization website hostname may differ from alternate mail or campaign sending domains. The study measures the published DNS state of the sourced hostname only.
- — DNS state does not measure phishing incidents, mail delivery or internal controls.
Source record
Government of Canada organization reference data
Active federal-organization inventory; organization-specific hostnames were supplied by the official departments and agencies directory.
Government of Canada departments and agencies
Current official organization links used for federal hostname mappings.
Ontario municipality directory
Official 2026 organization names and municipal website links; one incorrect county link was corrected against the county's official homepage and recorded in source QA.
Statistics Canada healthcare-facilities database
Starting inventory for health systems and facilities.
TMX listed-company directory
Current-listing verification for a 70-company slice of major Canadian-headquartered issuers; every domain was checked against the official company site.
Publication policy
Publish aggregate results only. No province receives an indexable page until it independently clears the observation, findings, sourcing and outreach gates.