ONTARIO RESEARCH / CANADA 2026
Across 556 observed Ontario organization domains, 74.3% published valid DMARC. This is a sourced benchmark dominated by the official municipal directory—not a representative sample of every Ontario organization.
WHY THIS MATTERSWhen a forged public-service message fails aligned authentication, a missing or monitoring-only policy leaves receivers without the municipality’s requested quarantine or rejection action. This DNS observation is not evidence that a false notice was sent or delivered.
74.3%
DMARC adoption
413 of 556
60.5%
Enforcement among DMARC publishers
250 of 413
21.8%
DMARC publishers without aggregate reporting
90 of 413
4.1%
SPF publishers with recursive lookup failures
21 of 508
WHY THIS MATTERS
Municipal and public-service domains carry unusual trust: residents expect them to send tax, permit, payment, emergency and service notices. A missing or monitoring-only policy leaves less protection at participating receivers when a forged message fails aligned authentication.
Learn how DMARC evaluates a message →01 / DOMAIN IDENTITY
An attacker can send a message that displays the organization's exact domain in the From line. Without a valid DMARC record, participating receivers have no DMARC handling request from that domain owner when aligned SPF and DKIM fail.
02 / PRACTICAL HARM
A forged message appearing to come from a municipality or public body could redirect a payment, steal a portal password, or circulate a false service or emergency notice. The DNS measurement does not show that any such message was sent or delivered.
THREE DIFFERENT DNS STATES
Risk, not incident evidence: this DNS state does not prove spoofing, fraud, compromise or weak internal controls. DMARC also does not stop lookalike domains, abuse of a compromised legitimate account or every phishing technique.
FOUR DISTINCT FINDINGS
The reporting gap moves in the other direction: 90 of 413 Ontario DMARC publishers had no aggregate-reporting address, compared with 25 of 423 in the rest of the sourced Canadian cohort. These comparisons are descriptive and reflect a materially different cohort mix.
Every percentage shows its measured denominator
Every percentage shows its measured denominator
Every percentage shows its measured denominator
Every percentage shows its measured denominator
“Rest of cohort” is calculated by subtracting the Ontario numerators and denominators from the frozen national publication. It contains 472 observed domains.
WHAT THE COHORT CONTAINS
439 of 556 Ontario observations (79.0%) are municipalities from Ontario's official directory. The remaining rows come from the Canada report's sourced public-institution, education, health-system and listed-company inputs.
That coverage supports a strong Ontario municipal-operations story. It does not support claims about every Ontario business, every sending domain, incident rates, compromise, delivery performance or the quality of internal controls.
Review the official Ontario sourceCITE & REUSE
The Ontario slice, rest-of-cohort comparator and publication-gate evidence are released under CC BY 4.0. The source report remains the canonical national study.
Suggested citation
Palisade. “Ontario email-authentication benchmark 2026.” 2026-08-16. https://www.palisade.email/research/canada-email-authentication-2026/ontario
