I analyzed 38 Québec businesses: 1 in 3 is wide open to email spoofing

By Cyberbilan July 21, 2026 7 min read

In July 2026, I scanned the email security of 38 well-known Québec businesses and organizations — retailers, media, insurers, manufacturers. The finding is worrying: nearly one in three has no protection against spoofing. And since these are the biggest and best-resourced, the reality for small businesses is likely worse.

In short:

31.6% (nearly one in three) have no DMARC: anyone can send email in their name, landing in the inbox.
55.3% are not in "reject" mode: maximum spoofing protection is off.
Only 44.7% are truly protected.
Average security score: 78/100 (B) — and these are organizations with IT teams.

38active Québec businesses analyzed

31.6%no DMARC at all — wide open to spoofing

55.3%not in "reject" mode

34%site without HSTS security header

42%weak website security

78average score out of 100 (B)

What does "spoofable" actually mean?

By default, email doesn't verify who is writing. Anyone can put yourcompany.com in the "From:" field and email your customers. Three protections stop this — SPF, DKIM and above all DMARC, which acts like a bouncer at the door of mail servers worldwide:

No DMARC → no bouncer. The fake email lands straight in your customer's inbox.
DMARC "quarantine" → the bouncer sends the fake to spam (better, but your customer can still see it).
DMARC "reject" → the bouncer blocks the fake entirely. The only real protection.

Spoofing protection (DMARC) — 38 Québec businesses, July 2026

No protection (DMARC missing)31.6%

Partial protection (quarantine)23.7%

Well protected (reject)44.7%

Concretely: for nearly one business in three in this sample, a fraudster could, this afternoon, send a fake invoice to their customers in their name — and it would land in the inbox, not spam. That is exactly the entry point for CEO fraud and fake invoices.

What about the websites?

The picture isn't better for websites: 34% don't serve the HSTS security header, and 42% get a weak web security score (missing headers, incomplete HTTPS redirect). These are free settings that protect against interception and hijacking — yet almost nobody turns them on.

Why it's even worse for a small business

Remember: this sample is well-known businesses with budgets and often an IT team. If a third of them have no DMARC, picture the 8-person bakery, accounting firm or construction contractor with no IT staff. In our experience, these small businesses almost always start from zero protection. The share of spoofable small businesses in Québec is therefore very likely well above 31%.

What it means for you: Law 25, insurance, reputation

Law 25. A fake email sent in your name that traps a customer is a privacy incident that can be held against you. Having DMARC in "reject" is exactly the "reasonable security measure" the law expects.
Cyber insurance. Insurers increasingly require proof of security controls before covering a small business. A protected, documented domain is an argument at underwriting.
Reputation. The day your customers get a fake invoice "from you," your brand takes the hit — even if nothing was breached on your side.

The good news

Protecting yourself costs nothing and doesn't take weeks: DMARC, SPF and DKIM are simple DNS records. The first step is knowing where you stand — and that takes 15 seconds.

Can your business be spoofed?

Enter your domain: in 15 seconds we test your SPF, DKIM, DMARC and website — free, no signup, public data only.

Run the free check →

Method: each domain was analyzed with Cyberbilan's public scanner, which reads public information only (DNS records and site headers). No private data, no inbox access. Businesses are not named: only aggregate proportions are published. Results reproducible by anyone.