We measured 604 Canadian small-business domains. Most of them can be spoofed.

Almost every article about DMARC quotes a global adoption statistic from a vendor report. We wanted a number for the specific population a Canadian small business actually belongs to, measured directly rather than cited, so we measured it ourselves and are publishing the method along with the result.

Two independent samples, measured from the outside using only information these domains publish to the entire internet. No site is named anywhere in this report.

What was measured

Four checks, all of them things any stranger can look up about your domain without your permission and without touching your server in any unusual way:

1. Email spoofing exposure - the public SPF and DMARC records in DNS, and whether the DMARC policy actually enforces anything.
2. HTTPS certificate - offered during an ordinary handshake: is the chain trusted, does it match the hostname, when does it expire.
3. Domain registration - the public RDAP record: when does the registration lapse.
4. Reachability - does the site answer over HTTPS, and does plain HTTP redirect to it.

Three of those four carry a date, which is the reason this is a recurring problem rather than a one-off audit: certificates now live ninety days or less, registrations lapse annually, and SPF records get rewritten during mail migrations and quietly revert. Nobody is told when any of it changes.

Sample A: 522 sites built by 141 web agencies

We started from Canadian web design and marketing agencies, took the client sites each one publishes in its own portfolio, and measured those. 78 of the 141 agencies had a readable portfolio. That produced 533 measurement events over 522 distinct domains - the gap is client sites claimed by two different agencies, and the rates below are per distinct domain, not per event. A further 73 listed sites could not be measured at all and are excluded rather than counted as clean.

The two email lines are the story. 364 of 522 domains (69.7%) have no enforcing DMARC policy, and it splits almost evenly: 178 never published a DMARC record, and 186 published one and left it at p=none, which reports and enforces nothing. The second group is the interesting one. Those domains did not miss the memo - they acted on it and stopped at the step that protects nobody, which is the shape of a job started and not finished.

The attribution problem, and what it does to the number

A portfolio page is a marketing claim, not a work record. When we required documentary evidence that the agency actually built the site before crediting it, the sample dropped from 522 to 267 attributed sites - roughly half - of which 210 had a finding, a rate of 78.7%. The stricter sample gives a higher rate than the loose one, so the headline is not an artifact of counting sites the agencies never touched.

0 clean sheets out of 29

Restricting to agencies where we could measure at least five client sites leaves 29 agencies. Not one of them had every client site clean. We expected a spread - some agencies careful about this, some not - and there wasn't one. The most defensible reading is that this simply is not on anybody's build checklist: DNS email policy sits outside what a website project is understood to cover, so it is nobody's job by default. We are not claiming these agencies were negligent, and we are not naming any of them.

Sample B: an independent 83-domain small-business sweep

Measured 2026-08-01 against a separate list of Ontario small businesses, with the same code. It is a different population reached a different way, which is the only reason it is worth reporting next to Sample A.

• 67 of 83 (80.7%) spoofable - no enforcing DMARC.
• 41 (49.4%) had no DMARC record at all; 29 (34.9%) had one stuck at p=none.
• 13 (15.7%) published no SPF record.
• 3 (3.6%) were broken for visitors on the day of measurement - certificate or reachability, not a future risk.
• 4 (4.8%) had a certificate or registration due to lapse shortly.
• 69 of 83 (83.1%) had at least one finding.

By industry - read the sample sizes first

Splitting 83 domains four ways leaves slices too small to carry a confident rate. We publish them with their sample sizes rather than either hiding them or dressing them up. Our in-house minimum for quoting a rate is 25; rows below it are marked.

Do not read an industry ranking into that table. With slices this size the differences between them are well inside the noise; the only thing it supports is that no industry in the sample was in good shape.

Check your own domain

You do not have to take any of this on faith, and you should not. The same code that produced these tables runs as a free page - type a domain, get the same four findings in plain English, no signup and no email address. It works on any domain, including ones you do not own, which is how you can sanity-check our numbers against businesses you know.

Run the free perimeter check → Or use any third-party DMARC checker you like and compare - the underlying records are public, so every tool should agree.

How you fix it

For most small businesses this is two DNS records, not a project:

1. SPF - one TXT record listing the services allowed to send as you, ending in ~all or -all. Ending in +all permits the entire internet and is worse than having none.
2. DMARC - a TXT record at _dmarc.yourdomain.com. Start at p=none with a reporting address, read the reports until you recognise every legitimate sender, then move to p=quarantine and then p=reject.

Step two is where this data says people stop. Publishing p=none and never advancing it is the single most common state in both samples - the record exists, checkers report "DMARC found", and nothing is enforced.

If that is all you need, do it and you are done. It is a one-time fix and we would rather say so than pretend otherwise.

Method, and the controls that make it checkable

Everything here comes from public data: DNS TXT lookups over DoH, the certificate offered in a normal TLS handshake, a public RDAP registration lookup, and one ordinary page request. Nothing was scanned, probed, guessed or logged into. No site received anything it would not receive from a visitor.

The measuring code runs two controls on every sweep, and a failure on either side aborts the run and prints no rates at all:

• Positive control - expired.badssl.com, wrong.host.badssl.com, self-signed.badssl.com — a public test harness of deliberately broken certificates — plus a DMARC name that cannot exist. All must come back detected. A blind instrument reports a healthy market exactly the same way a healthy market does, so without this side a zero proves nothing.
• Negative control - google.com, paypal.com, cloudflare.com — all of which publish an enforcing DMARC policy and valid certificates. All must come back clean. Without this side, an over-eager instrument would put a false accusation in front of a stranger.

Limitations, stated plainly

Figures on this page are generated directly from the stored raw measurement files and re-verified by an automated control on every operating cycle; if the underlying data changed and this page did not, the control fails. Generated 2026-08-25T23:35:11Z.