La Presse: two thirds of 410 Quebec domains can be impersonated by email

On February 3, 2025, La Presse published an investigation by Jean-Hugues Roy: Le nom d’agences du gouvernement peut être usurpé — government agency names can be impersonated. The article is in French. This is a summary in our own words; the original is linked at the bottom and is worth reading in full.

Disclosure: I was interviewed for that article — Jean-François Bourdeau, founder of LastSpam and the person behind DMARC Guy.

What La Presse checked

The newspaper looked up the DMARC setting of 410 domain names among the most used in Quebec: large companies, government agencies and educational institutions.

• 202 had a DMARC policy that tells receiving mail servers to take no action on a doubtful message. In DMARC terms, that is p=none.
• 61 had no DMARC record at all.
• Together, that is 263 of 410 — about two thirds — whose name can be used on a forged email.

Sixty of those domains belong to the Quebec government, and more than 100 are federal, including the domain of Parliament itself, parl.gc.ca (fixed since — see below). La Presse names several others. We do not repeat them here: that list is from February 2025, and some may have been fixed since.

What the two governments answered

Quebec. The Ministère de la Cybersécurité et du Numérique told La Presse it was aware of the situation. In its view this is not a new vulnerability but an incomplete DMARC configuration; each department and agency is responsible for its own systems, and workshops had been held in the previous months to remind them of it.

Ottawa. The office of the Speaker of the House of Commons confirmed that the protection was not turned on, and called that a "business decision" (our translation) made to avoid interrupting the delivery of legitimate email. It added that work was under way to turn it on without that side effect.

Update, October 2, 2026: the House of Commons did what it said it would. parl.gc.ca now publishes p=reject, the strictest DMARC policy. It can be done.

The reporter tried it

La Presse did not stop at reading DNS records. Its reporter sent himself about half a dozen emails in the name of government agencies that had no DMARC, including one that appeared to come from an employee of Parliament.

Not every mail program let them through — Outlook seemed better at catching them. That is what a missing policy means in practice: the domain's owner has given no instruction, so each receiving system decides on its own. Some catch the forgery. Some deliver it.

No fraud using this technique had been recorded in Quebec at the time. I told the reporter I was sure it had happened anyway: it takes no special talent, only someone motivated and comfortable with the technology.

Not only in Quebec

The article gives two examples from elsewhere:

• South Australia. On January 17, 2025, the state police warned that people were receiving fraudulent emails demanding payment of a fine. The sender's address ended in the police force's real domain name.
• United States. In May 2024 the FBI, the State Department and the NSA said North Korean intelligence services had used the same weakness to pose as real experts. We wrote about that advisory here: NSA warns of North Korean hackers exploiting weak DMARC email policies.

The House of Commons gave the honest answer

Leaving the protection off so as not to lose legitimate email is the real reason most domains sit at p=none, in government and everywhere else. Nobody has the full list of tools that send email in the organization's name — the newsletter, the invoicing system, the CRM, the web form — so nobody dares to turn on blocking.

That fear is reasonable. Turning on p=reject without that list does break legitimate mail. But staying at p=none forever is not the fix either: it reports the forgery and stops none of it.

⚠️ Do not paste p=reject into your DNS today if your domain has never had DMARC. Start at p=none with a rua address, read the reports until every tool that legitimately sends in your name passes, then move up to p=quarantine and to p=reject. p=none is the starting point, not the destination — see p=none: the DMARC policy that looks compliant and stops nothing.

If the missing piece is the list itself, that is what the Email Source Map is for: What actually sends email as your domain?

Eighteen months later

In August 2026 we ran our own count on a different set — 296 Quebec organizations in nine sectors. We found much the same: 72% did not block email impersonation.

Check your domain now →

Source

• La Presse, Jean-Hugues Roy, February 3, 2025 (in French): https://www.lapresse.ca/actualites/2025-02-03/arnaques-par-courriel/le-nom-d-agences-du-gouvernement-peut-etre-usurpe.php