Back to Blog
Cybersecurity8 min read

DMARC, DKIM, and SPF: The Email Authentication Stack Every Canadian SMB Needs

By Anton Kuznetsov

Phishing remained the leading initial attack vector in Canadian breaches for the fourth consecutive year, according to IBM's 2026 Cost of a Data Breach Report — contributing to an average breach cost of CAD $7.11 million per incident in Canada, up from $6.98 million the previous year. Yet across the broader business domain universe, fewer than 15% of domains have any DMARC record at all, and only around 2.5% enforce the strongest p=reject policy that stops spoofed email outright. (EasyDMARC 2026 DMARC Adoption Report)

Those two facts sitting next to each other describe a preventable problem. Email authentication — specifically the three-protocol stack of SPF, DKIM, and DMARC — is the foundational control that stops attackers from using your domain to impersonate your organization. It costs almost nothing to configure. The Canadian Centre for Cyber Security recommends it explicitly. And most Canadian SMBs still have not done it.

This guide explains what each protocol does, why the implementation gap matters for your business right now, and the practical steps to close it.

What SPF, DKIM, and DMARC Actually Do

The three protocols serve distinct functions and are designed to work together.

SPF (Sender Policy Framework) is a DNS TXT record on your domain that lists which mail servers are authorized to send email on your behalf. When a receiving server gets an email claiming to come from your domain, it checks your SPF record. If the sending server is not on the list, it fails SPF. SPF alone has a significant limitation: it checks the envelope-sender address (the technical MAIL FROM), not the From: address visible to recipients. Attackers can craft email that passes SPF while still spoofing the visible From field.

DKIM (DomainKeys Identified Mail) addresses the content-integrity problem. Your mail server attaches a cryptographic signature to each outgoing message using a private key you hold. The receiving server pulls your public key from DNS and validates the signature. This confirms both that the message originated from your infrastructure and that it was not modified in transit.

DMARC (Domain-based Message Authentication, Reporting & Conformance) is the enforcement and reporting layer that ties the two together. For an email to pass DMARC, it must pass either SPF or DKIM — and the domain in those checks must align with the From: address the recipient sees. DMARC tells receiving servers what to do when a message fails: p=none (take no action, just report), p=quarantine (route to spam), or p=reject (refuse delivery entirely). DMARC also sends aggregate reports to an address you configure, giving you ongoing visibility into who is sending email using your domain — including attackers.

Together, these three protocols close the attack path that makes email impersonation possible. Without them, any attacker can send a message that appears to come from your domain to your suppliers, clients, and employees.

Why This Matters for Canadian SMBs Right Now

The Canadian threat data makes a compelling case for treating email authentication as a current-quarter priority, not a backlog item.

The Canadian Anti-Fraud Centre's 2025 annual statistics recorded CAD $704 million in reported fraud losses — the highest year on record — while noting that only 5 to 10% of fraud incidents are ever reported. The true national annual loss is likely between $3.5 billion and $7 billion. Business Email Compromise, where an attacker spoofs a trusted sender to redirect payments or extract information, is among the highest-value fraud categories targeting businesses.

The CIRA 2025 Cybersecurity Survey found 43% of Canadian organizations were hit by a cyberattack in the past year, with the steepest year-over-year increase concentrated in small businesses — the segment least likely to have email authentication configured. 61% of organizations flagged AI-improved phishing emails as a heightened concern.

Business Email Compromise accounts for 58% of all financially motivated phishing breaches according to the Verizon 2026 Data Breach Investigations Report. BEC does not require malware, exploited software, or a sophisticated intrusion. It requires only that the attacker can make an email appear to come from a trusted source — exactly what proper email authentication is designed to prevent.

For context on the financial stakes: the IBM 2026 Canada report found that phishing was the leading attack vector for the fourth consecutive year and that the average Canadian breach took 205 days to detect and contain — six percent longer than the previous year. Breach costs accumulate across that entire window.

What Ottawa Says About Email Authentication

The Canadian Centre for Cyber Security is explicit. Publication ITSP.40.065 v1.1 — *Implementation guidance: email domain protection* — recommends all three protocols together and advises organizations to progress to p=reject for full protection. The companion ITSAP.60.003 quick guide provides configuration checklists for common mail environments.

The federal government mandates DMARC, SPF, and DKIM for its own email domains, requiring federal agencies to enforce at minimum p=quarantine. The same controls Ottawa requires for government communication are what the CCCS recommends for every Canadian organization. There is no enterprise size threshold that triggers this guidance — it applies equally to a 15-person professional services firm and a Crown corporation.

The Deliverability Consequence

Even if the security argument does not immediately move the urgency dial, the deliverability argument should.

As of November 2025, Google permanently rejects — 550 error — messages from bulk senders that do not comply with SPF, DKIM, and DMARC requirements. Microsoft enforced equivalent requirements for Outlook.com recipients from May 2025, with full rejection enforcement since November 2025. Yahoo mirrors Google's enforcement timeline. (Proofpoint — Stricter email authentication enforcements for Google start November 2025)

The practical result: non-compliant senders see 22% to 34% of their email silently routed to spam. If your organization is sending invoices, proposals, project updates, or client communications and has not configured email authentication, a material share of your outbound email is not arriving.

The Adoption Gap: Where SMBs Stand

The adoption data reveals the scale of the exposure. Among a large sample of business domains, fewer than 15% have any DMARC record — including p=none, which provides reporting but zero enforcement. Globally, only around 2.5% of domains enforce p=reject. (EasyDMARC 2026 DMARC Adoption Report)

The enterprise-SMB gap is stark. Fortune 500 companies have reached 95% DMARC adoption with over 80% at enforcement-level policies. Among Inc. 5000 firms — a closer proxy for growing mid-market businesses — just 15.2% are at p=reject versus 62.7% of Fortune 500 companies. The smallest businesses carry the least protection against the attack vector most likely to target them.

A Practical Implementation Roadmap

Email authentication can be configured in stages without disrupting existing mail flows.

Stage 1: Deploy SPF and DKIM (Week 1)

Log into your DNS provider and create a TXT record for your domain listing your authorized mail servers. For Microsoft 365 the record is: v=spf1 include:spf.protection.outlook.com -all. For Google Workspace: v=spf1 include:_spf.google.com -all. If you send through additional services — a marketing platform, a CRM, a ticketing system — include their authorized sending entries in the same record.

Enable DKIM signing in your email platform. In Microsoft 365: Security → Email & Collaboration → Policies & Rules → Threat Policies → DKIM. In Google Workspace: Apps → Google Workspace → Gmail → Authenticate Email. Add the CNAME records the platform generates to your DNS, then give DNS changes 24–48 hours to propagate.

Stage 2: Deploy DMARC at p=none (Week 2)

Add a DMARC TXT record at _dmarc.yourdomain.com with a monitoring-only policy: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. This takes no action on any email — it only generates reports showing every source sending mail using your domain. Let the reports accumulate for two to four weeks and review them to identify all legitimate sending sources. Ensure each one is included in your SPF record and signing with DKIM.

Stage 3: Escalate to p=quarantine, then p=reject (Weeks 4–8)

Once all legitimate sending sources pass authentication, move to p=quarantine. Monitor for any legitimate mail now landing in spam — this indicates a sending source you missed. After two to four weeks with no legitimate mail quarantined, move to p=reject. This is the enforcement state the CCCS recommends and the level required for BIMI.

Stage 4: Configure BIMI (Optional)

BIMI (Brand Indicators for Message Identification) displays your brand logo beside your email in Gmail, Apple Mail, Yahoo, and other supported inboxes. It requires p=quarantine or p=reject DMARC enforcement, plus a compliant SVG logo and a BIMI DNS record. A Common Mark Certificate (CMC) introduced in 2024–2025 widened eligibility beyond trademark-registered logos. (Red Sift — BIMI in 2026) The trust signal is visible to recipients before they open a message: your verified logo, in the inbox.

Common Mistakes That Trip Up SMBs

Using softfail (~all) instead of hardfail (-all) in SPF. Softfail marks unauthenticated mail as suspicious but delivers it. After confirming all legitimate senders are in your SPF record, switch to -all.

Leaving parking domains unprotected. Any domain your organization owns that sends no email — a legacy domain, a marketing subdomain, a country-code TLD — can be spoofed. Add a null SPF record (v=spf1 -all) and a p=reject DMARC record to each to remove the attack surface.

Staying at p=none indefinitely. Monitoring mode generates reports but provides zero protection. The goal is p=reject. Start at p=none to gather data, but set a deadline to move forward.

Not reading the reports. DMARC aggregate reports reveal active spoofing attempts against your domain in near real-time. Free tools like dmarcian parse the XML reports into readable summaries. Without reviewing them, you cannot know what unauthorized sources are impersonating you — or when to move to enforcement.

Sources

Email authentication is a one-time configuration effort that permanently closes one of the most common attack paths targeting Canadian businesses. Cloud Forces helps Canadian SMBs configure SPF, DKIM, and DMARC correctly — identifying every sending source, resolving alignment failures, and reaching p=reject enforcement without disrupting legitimate mail flows. Explore our Cybersecurity services or contact us to book a no-cost email authentication assessment.

Anton Kuznetsov
Founder & Principal Engineer

Anton Kuznetsov is the founder and principal engineer of Cloud Forces, the Toronto firm he started in 2018 to make custom software and AI practical and affordable for Canadian SMEs. He works hands-on across application development, cloud architecture, and the production systems Cloud Forces runs for its clients.

Ready to bring AI to your business?

Book a free AI Readiness Consultation — no commitment required.

Book Free Consultation