Can a small Canadian firm be impersonated by email?
77% of small Canadian professional firms with a website have not told anyone to stop it. Measured across 3,821 firm domains — 3,313 of them receiving email — on 11 August 2026. Here is the method, the arithmetic, and what it does and does not prove.
What we measured, in plain terms
The “from” address on an email is not checked by anything. It is simply text the sender types in, the way you write a return address on an envelope — and a stranger can write yours.
This is worth being precise about, because most people picture a lookalike address
like yourfirm-ca.com and assume they would notice. That is a different,
easier attack. Here the address is exactly right. A message can
arrive showing your managing partner’s real address, at your real domain, with
nothing misspelled — sent by someone with no access to your systems at all.
The attack this enables is not technical. It is an email that appears to come from a firm’s own partner, to its own bookkeeper, changing the wire details on a real transaction that is already underway. Nothing has to be hacked: the message is genuinely delivered, from outside, wearing the firm’s name — and for a firm holding client funds in trust, the money moves before anyone thinks to phone and check.
The one thing that stops it is a public note the firm attaches to its own domain, telling every mail server in the world what to do with messages that claim to be from the firm but did not come from its systems. That note is called DMARC, and it can say one of three things: reject them, send them to junk, or — none — do nothing at all and just keep count.
We measured which of those three states each firm publishes. Nothing more: it is one public lookup per firm, the same one any mail server does.
The results
77% of small Canadian professional firms with a website have no enforced DMARC — anyone can send email that appears to come from them.
Results by sector
“No enforced DMARC” means no record at all, or a record set to p=none.
n is the number of firms we measured; the firm count is how many exist nationally.
| Sector | No enforced DMARC | n measured | Small firms in Canada | Statistics Canada industry |
|---|---|---|---|---|
| Clinics and health practices | 81.7% | 2,264 | 103,768 | Ambulatory health care [621] |
| Law firms | 73.1% | 409 | 22,189 | Legal services [5411] |
| Accounting practices | 72.4% | 225 | 22,434 | Accounting, tax, bookkeeping [5412] |
| Wealth / portfolio management | 69.2% | 169 | 14,056 | Investment activities [523] |
| Insurance | 58.5% | 246 | 10,753 | Insurance carriers, related [524] |
What each firm publishes
| DMARC policy | Firms | Share | What it does |
|---|---|---|---|
No DMARC record at all | 1,573 | 47.5% | Nothing published. Anyone can send mail as them. |
p=none | 998 | 30.1% | A record exists and collects reports, but instructs receivers to reject nothing. |
p=quarantine | 482 | 14.5% | Failing mail goes to spam. Counted as protected. |
p=reject | 259 | 7.8% | Failing mail is refused outright. Counted as protected. |
p=<unrecognised> | 1 | 0.03% | A record exists but its p= value is not one RFC 7489 defines, so a receiver cannot act on it and it protects nothing — counted with the unprotected. Derived: 3,313 less the four measured rows above. The measurement code now counts these directly. |
And us
We publish an enforcing DMARC policy, so the same lookup that fails for 77% of the firms above passes for this domain. Check it the way you would check them:
dig +short TXT _dmarc.cyberlegionnaire.com
Not counted in any figure on this page. This domain is not in the sampling frame — it is a security vendor, not one of the five professional sectors measured — and putting the publisher inside its own sample would change the denominator and break the digest that fixes the dataset.
Want this run against your own firm?
No cost, no obligation — you keep the findings either way.
Get your free Security SnapshotMethod and data — check us
Everything above is reproducible from what follows. If you only want one check, run the dig command against your own domain.
How 77% is calculated
We measured each sector separately, then combined them. Combining requires a weight.
Every reasonable weighting lands between 71% and 78%. We publish the one weighted by Statistics Canada’s count of real small firms in each sector — 76.9%, rounded to 77% — because those weights come from a census of firms, not from anything we chose. (Weighting by our own sample instead gives 77.6%.)
Weights: Statistics Canada, Canadian Business Counts (product 33101095, reference period 2025-07), employer businesses with 1–49 employees.
Method
Three DNS lookups per domain: the DMARC record, the SPF record, and whether the domain receives mail at all. No connection is made to any firm’s website or mail server. Nothing is probed, submitted or guessed — DNS is a public directory service, and reading it is what it exists for.
The sample frame is every Canadian law firm, accounting practice, clinic, insurance office and wealth manager that OpenStreetMap records with a website, deduplicated to one entry per organisational domain. One national tax franchise appeared 21 times, and left in, a handful of chains would have dominated a statistic about small firms.
Firms whose domain receives no mail are excluded from every percentage — 508 of the 3,821 — because a domain with no mailbox cannot be spoofed into one. Including them would have inflated our own headline.
We publish aggregates only — never which firms failed. A named list of firms with a weakness is a target list, and we will not produce one. That includes yours, if we ever measure it.
We do not publish the list of domains we tested either, and for the same reason rather than a different one. The test is a single public lookup: anyone holding that list could reproduce the per-firm results in about twenty seconds, which makes the list of firms measured and the list of firms exposed the same document. So this page is built to be checked rather than re-run — the method is one command you can point at any domain including ours, every input and exclusion is described above, and the digest below fixes the dataset as of the measurement date so the numbers cannot have been tuned after we saw them.
Of the same 3,313 firms, 287 publish no SPF record and 1,589 publish ~all,
which asks receivers to accept suspicious mail anyway. Only 1,437 publish -all.
What this does and does not prove
It is a snapshot, not a monitor
Measured on 11 August 2026. DNS changes daily, so a firm that failed then may pass now. Every figure carries its date, and the study is re-run rather than quietly edited.
It covers firms with a public domain
We can only check a firm whose domain we can find, so the sample is firms with a website. It is also Canada only, and only the five sectors listed above — we do not extrapolate past either.
Sources
| Source | What we used it for |
|---|---|
| Statistics Canada — Canadian Business Counts | The weights: how many employer businesses with 1–49 employees exist in each sector. Product 33101095, reference 2025-07. |
| OpenStreetMap contributors | The sampling frame, queried via the Overpass API. Open Database Licence — © OpenStreetMap contributors. |
Want these checks run against your own firm?
No cost, no obligation — you keep the findings either way.
Get your free Security Snapshot