Québec, France or USA: who protects their email best?

By Cyberbilan July 21, 2026 5 min read

After my study of 38 Québec businesses, one question stood out: does Québec protect its email better or worse than France and the United States? I analyzed 35 large, well-known businesses and organizations across the three regions. Verdict: US brands lead clearly — and Québec, despite a good overall score, leaves a door wide open.

In short:

🇺🇸 United States: 100% of the large brands analyzed are in DMARC "reject" (maximum protection).
🇨🇦 Québec: 62.5% in "reject" — but 1 in 4 (25%) has no DMARC. Average score: 83/100 (A).
🇫🇷 France: 54.5% in "reject", the lowest of the three.
And these are the large businesses. Small businesses almost always do worse.

The ranking: % in DMARC "reject"

Reminder: "reject" mode is the only one that actually blocks a fraudster trying to write in your name. Without it, spoofing goes through (to the inbox, or at best to spam).

Large businesses in DMARC "reject" (maximum protection) — July 2026

🇺🇸 United States100%

🇨🇦 Québec62.5%

🇫🇷 France54.5%

100%🇺🇸 US brands in "reject" (8 of 8)

83🇨🇦 Québec average score /100 (A)

25%🇨🇦 of QC businesses with no DMARC

54.5%🇫🇷 of FR brands in "reject"

The United States leads by far

Every US brand we could analyze was in "reject". No coincidence: since 2024, Google and Yahoo require DMARC from bulk senders, and the US ecosystem (with the BIMI brand logo) pushed hard. As a result, spoofing is locked down among big US players.

Québec: good on the surface, fragile where it matters

Québec does well on the overall score (83/100, A) and website security (75% serve the HSTS header). But on what matters most — blocking spoofing — one business in four has nothing at all. A nice façade, but the front door to fraud stays wide open for 25% of them.

France comes last

At 54.5% in "reject", large French businesses are the least protected of the three against direct spoofing — though many are in "quarantine" (fakes go to spam rather than being blocked).

Why this concerns you

Remember: these figures are the large businesses, with IT teams. If a quarter of Québec's biggest have no DMARC, the share among small businesses with no IT staff is far higher. A fake email sent in your name that traps a customer means a fake invoice, a privacy incident (Law 25) and a hit to your reputation — whatever your size.

The good news

Moving to DMARC "reject" costs nothing: they are simple DNS records. Big US brands did it; a small business can too. The first step is knowing where you stand.

Can your business be spoofed?

Enter your domain: in 15 seconds we test your SPF, DKIM, DMARC and website — free, no signup, public data only.

Run the free check →

Method and limits: 35 large, well-known businesses and organizations analyzed (Québec 16, France 11, USA 8) with Cyberbilan's public scanner, using public information only (DNS and site headers), in July 2026. The sample is deliberately made of large brands (not small businesses) and is modest in size: read it as a trend, not a census. Several US giants (FedEx, Best Buy, Ford…) block automated scanners and were excluded. Businesses are not named; results reproducible by anyone.