POSTSECONDARY RESEARCH / CANADA 2026
Across 247 observed college and university domains, 92.7% published valid DMARC. Adoption and enforcement were higher than in the rest of the sourced Canadian cohort—but the aggregate-reporting gap was nearly identical.
WHY THIS MATTERSWhen a forged campus message fails aligned authentication, a missing or monitoring-only policy leaves receivers without the institution’s requested quarantine or rejection action. This DNS observation is not evidence that an institution experienced a fraudulent message.
92.7%
Valid DMARC publication
229 of 247
61.6%
Enforcement among DMARC publishers
141 of 229
13.5%
DMARC publishers without aggregate reporting
31 of 229
93.9%
Valid SPF publication
232 of 247
WHY THIS MATTERS
College and university domains are trusted by students, staff, applicants, families and research partners. A missing or monitoring-only policy leaves less protection at participating receivers when a forged message fails aligned authentication.
Learn how DMARC evaluates a message →01 / DOMAIN IDENTITY
An attacker can send a message that displays the organization's exact domain in the From line. Without a valid DMARC record, participating receivers have no DMARC handling request from that domain owner when aligned SPF and DKIM fail.
02 / PRACTICAL HARM
A forged message could imitate a registrar, financial-aid office, IT help desk or tuition notice to seek credentials or redirect a payment. The DNS measurement does not show that any institution experienced such an incident.
THREE DIFFERENT DNS STATES
Risk, not incident evidence: this DNS state does not prove spoofing, fraud, compromise or weak internal controls. DMARC also does not stop lookalike domains, abuse of a compromised legitimate account or every phishing technique.
THE CENTRAL FINDING
Valid DMARC publication was 15.0 percentage points higher than in the rest of the sourced cohort, and enforcement among publishers was 8.1 points higher. Yet 31 of 229 postsecondary DMARC publishers lacked an aggregate-reporting address—13.5%, versus 13.8% elsewhere.
Measured numerator / denominator
Measured numerator / denominator
Measured numerator / denominator
Measured numerator / denominator
“Rest of cohort” is calculated by subtracting the postsecondary numerators and denominators from the frozen national publication. It contains 781 observed domains. These are descriptive differences, not evidence that sector membership caused them.
WHAT THE COHORT CONTAINS
The input is the 247-row college and university slice used in the parent Canada benchmark, sourced from EduCanada and measured at the organizational website domain. Ontario contributed 74 rows and Quebec 73; region counts describe cohort composition, not regional performance.
Results are aggregate-only. Palisade does not publish institution scores, infer compromise, or claim the observed website domain captures every sending service or alternate domain an institution uses.
Review the official EduCanada sourceCITE & REUSE
The aggregate sector slice, rest-of-cohort comparator and reusable chart are released under CC BY 4.0. The parent Canada report remains the canonical national study.
Suggested citation
Palisade. “Canadian postsecondary email-authentication benchmark 2026.” 2026-08-16. https://www.palisade.email/research/canada-email-authentication-2026/postsecondary
