Most Alberta businesses can be impersonated by email
We measured 197 Alberta business domains in September 2026. Nearly three quarters have no working protection against someone sending email in their name.
Latest measurement 2026-09-25.
What this means in practice
DMARC is the record that tells the receiving mail server what to do with a message that claims to be from your domain but is not. Without it, or with it set to monitor only, a stranger can send an invoice from accounts@yourcompany.ca and it will arrive looking entirely normal.
That is how supplier payment fraud works. Not a technical exploit — a believable email from an address that was never protected, asking for bank details to be updated.
- 44.7% of the panel publish no DMARC record whatsoever. Anyone can send email as them today.
- A further 26.9% publish DMARC set to
p=none. That is monitoring. It reports, and permits. Many owners believe this means they are covered. - 28.4% enforce it — 40 at quarantine, 16 at reject. Only these are genuinely protected.
The platform did the easy part
The interesting result is not that businesses are careless. It is that the work which happens automatically got done, and the work requiring a decision did not.
| Mail platform | Domains | Publish SPF | Publish DMARC | Enforce DMARC |
|---|---|---|---|---|
| Microsoft 365 | 88 | 100.0% | 61.4% | 35.2% |
| other/self-hosted | 56 | 98.2% | 51.8% | 19.6% |
| Google Workspace | 46 | 91.3% | 45.7% | 21.7% |
Microsoft 365 domains publish SPF at or near 100% — it is created for you during setup. Yet as the table shows, far fewer of those same domains enforce DMARC, because DMARC requires someone to decide, publish a record, and then watch what breaks.
Across the whole panel, 97.0% publish SPF and only 28.4% enforce DMARC. The gap between those two numbers is the gap between what a platform does for you and what nobody got round to.
How this was measured
Stated in full, because a number you cannot check is worth nothing.
- What: SPF, DMARC and MX records for a locked panel of 197 Alberta business domains, drawn from chamber of commerce directories and published business listings across Strathmore, Okotoks, Chestermere, Airdrie and the Calgary region.
- How: DNS-over-HTTPS lookups of public DNS records. No email was sent, no system was accessed, and nothing was probed. This is the same information any mail server sees when deciding whether to trust a message.
- When: first measured 25 September 2026, re-measured monthly. Latest run 2026-09-25.
- Excluded: two entries that were not Alberta businesses — one internal test domain and one hosting-provider staging hostname. They are named here rather than quietly dropped.
- Enforcing means a DMARC policy of
quarantineorreject.p=noneis counted as not enforcing, because it does not stop anything.
Percentages are over all 197 domains. Numerator and denominator are the same set — which sounds obvious, and is the mistake that made an earlier draft of these figures wrong.
Why no business is named
This dataset records, for 197 identifiable Alberta businesses, whether each one can be impersonated. Published with names attached it would be a target list.
So only aggregates appear here, and the underlying data is not shared. If one of these domains is yours, you can find out in thirty seconds below — and if you would rather ask directly, ask.
Check your own domain
Free, no signup, and the result is on screen in seconds. It reports the same three records measured here, in plain English, whether or not you ever speak to us.