Canadian postsecondary email-authentication benchmark 2026

Source page: https://www.palisade.email/research/canada-email-authentication-2026/postsecondary
Observed postsecondary domains: 247
Rest-of-cohort comparator: 781
Disclosure policy: aggregate results only; no institution scores or rankings.

Findings
- Valid DMARC publication: 229/247 (92.7%) in the postsecondary cohort; 607/781 (77.7%) in the rest of the sourced Canadian cohort.
- Enforcement among DMARC publishers: 141/229 (61.6%) in the postsecondary cohort; 325/607 (53.5%) in the rest of the sourced Canadian cohort.
- DMARC publishers without aggregate reporting: 31/229 (13.5%) in the postsecondary cohort; 84/607 (13.8%) in the rest of the sourced Canadian cohort.
- Valid SPF publication: 232/247 (93.9%) in the postsecondary cohort; 694/781 (88.9%) in the rest of the sourced Canadian cohort.

Pitch leads
- Sector: Canadian colleges and universities published valid DMARC 15.0 percentage points more often than the rest of the sourced cohort.
- Operational: A stronger authentication baseline did not close the aggregate-reporting gap.
- Standards: Numerator-and-denominator comparisons separate record publication, enforcement and reporting.

Methodology
- The frozen 247-row postsecondary input comes from the EduCanada source used by the parent Canada benchmark.
- Public DNS observations cover the organizational website domain and may not capture alternate sending domains or third-party services.
- Rest-of-cohort results subtract the postsecondary counts and denominators from the frozen national publication.

Limitations
- This is the complete sourced EduCanada input used for the parent benchmark, not a census of every Canadian postsecondary domain.
- The study observes organizational website domains; institutions can use additional domains and third-party sending services.
- Comparisons are descriptive and do not establish that sector membership caused a configuration difference.
- Public DNS state does not prove compromise, delivery performance, incident rates or internal security maturity.

Reuse: CC BY 4.0. Attribution to Palisade and the source page is requested.