Cyber Security Awareness Month 2026: how easy is it to fake a Lower Mainland business's email?
Week 1 of Canada's Cyber Month is about spotting fake messages. We checked 3,392 local business domains to see how many leave their address open to faking.
Cyber Security Awareness Month 2026 starts this Thursday, October 1, and this year’s theme from Get Cyber Safe, the federal campaign led by the Communications Security Establishment (CSE), is “Your best defence is you.” Week 1 is about recognizing phishing, fake messages and AI-powered scams, and pausing to check before you click or reply.
Checking a message is harder when the From line shows a real company’s address. Whether a scammer can put your address on a fake invoice and get it delivered depends on a few public DNS records, which makes them central to business email security in Vancouver and across the Lower Mainland. The Canadian Anti-Fraud Centre says spear phishing, where the sender’s address appears to be the real address of the company being impersonated, caused $67.9 million in reported losses in 2025, second only to investment fraud.
Business email security in the Lower Mainland, city by city
When we checked the public DNS records of 3,392 businesses across 12 industries in the Lower Mainland in September 2026, 81% had no DMARC protection being enforced. These are businesses we researched, not a random sample, and the table shows the nine cities where we checked 100 or more.
| City | Businesses checked | No DMARC | Not enforced | No SPF |
|---|---|---|---|---|
| Vancouver | 1,248 | 50% | 79% | 22% |
| Burnaby | 445 | 59% | 84% | 21% |
| Surrey | 326 | 53% | 81% | 18% |
| Langley (Township) | 283 | 53% | 79% | 12% |
| Coquitlam | 170 | 61% | 89% | 22% |
| North Vancouver | 137 | 39% | 82% | 13% |
| Langley (City) | 133 | 44% | 74% | 19% |
| Richmond | 119 | 55% | 82% | 18% |
| New Westminster | 116 | 42% | 78% | 14% |
| All businesses we checked | 3,392 | 52% | 81% | 19% |
“Not enforced” means the business either has no DMARC record or has one set to monitor only (p=none). Either way, when someone sends a fake email using that business’s address, its DNS gives the receiving mail server no instruction to block the message. Our DMARC guide for BC small businesses explains the settings and how to move from one to the next.
Coquitlam had the weakest numbers of the nine. Of the 170 businesses we checked there, 61% had no DMARC record at all and 89% weren’t enforced, which leaves 11% set to quarantine or reject. Burnaby came second on both measures, with 59% of 445 businesses missing a DMARC record and 84% not enforced.
By industry, law firms (75% not enforced) and insurance brokerages (71%) did best, while real estate (86%) and dental offices (85%) did worst. Veterinary clinics came in at 93%, but we only checked 46 of them, so treat that figure as directional.
What the Cyber Centre says you need
The Canadian Centre for Cyber Security covers this in ITSP.40.065, its email domain protection guidance. It says complete protection means using all three protocols (SPF, DKIM and DMARC) and setting them to tell receiving servers to reject messages that fail. It also says none and quarantine can help you gather information and set up your systems, but “only a policy of reject at 100% will prevent all illegitimate messages from being delivered.” Of all the businesses we checked, 7% had a reject policy.
The same guidance says adding a reporting address (the rua= tag) to your DMARC record is “strongly encouraged.” Those reports show which services are sending mail with your domain in the From line. Of the 1,620 DMARC records we found, 775 (48%) had no reporting address, so nobody receives those reports.
What Gmail, Yahoo and Microsoft require
Google announced new Gmail sender rules on October 3, 2023. Since February 1, 2024, its email sender guidelines have required everyone sending to personal Gmail accounts to use SPF or DKIM, and anyone sending 5,000 or more messages a day to Gmail to add DMARC as well (a p=none policy is enough). Google’s sender FAQ says Gmail started ramping up enforcement in November 2025, including temporary and permanent rejections. Yahoo’s rules took effect in February 2024, with SPF or DKIM for all senders and DMARC for bulk senders. Microsoft set rules for Outlook.com, Hotmail, Live and MSN addresses in spring 2025, and since May 5, 2025 domains sending 5,000 or more messages to those addresses must pass SPF, DKIM and DMARC or get rejected with error 550 5.7.515.
Those inboxes are where a lot of local business mail lands. In the City of Coquitlam’s business licence open data, 3,826 of the 9,476 licences with an email on file (40%) list a Gmail address. If you send fewer than 5,000 messages a day, the DMARC requirement doesn’t apply to you, but Google recommends every sender set up all three and says mail that fails authentication from a domain with no DMARC policy might be rejected or sent to spam.
A Cyber Security Awareness Month 2026 checklist for this week
- Look up your domain’s DMARC record with a free lookup tool (our DMARC post links to two). No record, or
p=none, puts you in the not-enforced group. - Confirm you have an SPF record. We found 19% of businesses with none, plus 62 whose record ends in
?all, which tells receiving servers not to judge the mail either way. - Find the
rua=address in your DMARC record and the person who reads it. If there’s no address, add one. - List every service that sends email as your business, such as Microsoft 365 or Google Workspace, accounting software, a newsletter tool and your website form. For any domain you own that never sends mail, the Cyber Centre recommends records that reject all mail claiming to come from it.
- Tell staff that any request to change banking or payment details gets confirmed by phone, using a number you already had on file, before anyone pays. That check catches lookalike domains and hacked mailboxes, which DMARC doesn’t stop.
Week 3 of Cyber Month, October 19 to 25, is also Small Business Week in Canada. If you publish a record with a reporting address this week, you’ll have about three weeks of reports by then to see whether your own mail passes.
Umbrella IT has looked after email security for Metro Vancouver businesses since starting in Burnaby in 2013, and reading DMARC reports is part of our cybersecurity service.
Common questions
When is Cyber Security Awareness Month 2026?
It runs through October every year, and Get Cyber Safe leads it in Canada. Week 2 covers passwords and MFA, and Week 3 covers protecting your information.
Does my small business need DMARC to send email to Gmail or Outlook.com?
The firm DMARC requirement at Gmail, Yahoo and Outlook.com applies to senders of 5,000 or more messages. Everyone sending to Gmail and Yahoo needs SPF or DKIM, and Google recommends all three for every domain.
Does DMARC stop all phishing email?
No. At reject it blocks mail that fakes your exact domain, but lookalike domains and hacked mailboxes get past it, so staff checks still matter.
If you’d like us to look up your domain’s records and tell you where you stand, book a free IT assessment.
Want this checked against your own setup?
Book a free IT assessment and a senior tech will review where your business stands, with no obligation.