The State of Email Security for Los Angeles Businesses (2026)

Each cell shows the share of domains, then the count. The 95% confidence interval in the second column is the range the true figure for practices like these most likely falls in, based on all 300. With 100 domains per sector, sector figures carry a margin of error of up to about 10 percentage points.

The gap between sectors in having any DMARC record is statistically significant (chi-square test, p < 0.01): 58% of law firms have one, against 43% of medical practices and 33% of dental offices. The gap in enforcement is not (p = 0.17). Law firms (22%), medical practices (22%) and dental offices (13%) all sit within each other's margins of error.

The email platform made less difference than you might expect. 24% of practices on Microsoft 365 enforce DMARC, compared with 19% on Google Workspace and 16% on other providers or with no mail servers. Neither platform turns DMARC enforcement on for you; someone has to publish the record.

The closest public benchmark is EasyDMARC's 2026 DMARC Adoption and Enforcement Report, which checked the 1.8 million most visited websites, the Fortune 500 and the Inc. 5000 in early 2026. LA practices sit a little below the busiest websites and far behind large and fast-growing companies.

Enforcement tells the same story. EasyDMARC found 22.9% of the top 1.8 million websites at quarantine or reject; we found 19% of LA practices (15.0 to 23.8%). For a sense of what is possible, the federal government told its own agencies to reach p=reject by October 2018 under CISA Binding Operational Directive 18-01.

EasyDMARC sells DMARC services, as GlobeVM sells IT and security services. Both facts are worth knowing when you read either study.

No DMARC record

The domain gives receiving mail servers no instruction about email that fails authentication. Gmail, Outlook and others fall back on their own filters, which may or may not catch a well-made fake. The owner also gets no reports, so they can't see who sends mail in their name.

p=none

The DMARC standard defines none as a request that receivers take no specific action on failing mail. It exists so owners can collect reports before they enforce. Google and Yahoo (since February 2024) and Microsoft's Outlook.com (since May 2025) require bulk senders to publish DMARC, and p=none meets that rule. Meeting it doesn't stop spoofing.

p=quarantine and p=reject

Quarantine asks receivers to treat failing mail as suspicious, which usually means the spam folder. Reject asks them to refuse it outright. Either one is what turns DMARC from a report into protection.

SPF ending in -all or ~all

SPF lists the servers allowed to send for a domain and ends with a rule for everyone else: -all (fail) or ~all (soft fail). With an enforced DMARC policy, ~all works fine, and it is the more common choice in our sample (60% of domains with one SPF record). SPF on its own checks a hidden return address, not the From line people see, which is why it needs DMARC. An SPF record may trigger no more than 10 DNS lookups (RFC 7208); past that, the standard says receivers must treat SPF as an error. The median domain in our sample used 2.

MTA-STS and BIMI

MTA-STS tells other mail servers to deliver to you only over encrypted, verified connections (RFC 8461). BIMI lets some inboxes show your logo and requires DMARC at quarantine or reject. Each appeared on 1 of 300 domains.

Most practices can close this gap with a few DNS changes made in the right order:

1. Check your own domain. Our free email security check reads your SPF, DKIM and DMARC records with the same code we used for this study and gives you a grade and a fix list.
2. Publish one SPF record that lists every service that sends email for you, such as Microsoft 365, Google Workspace, your patient reminder or billing system and your newsletter tool. Keep it under 10 lookups.
3. Turn on DKIM signing in your email platform and in every service that sends as your domain.
4. Publish DMARC at p=none with a rua address, then read the reports for a few weeks to find every real sender.
5. Move to p=quarantine, then p=reject once every real sender passes.
6. Add MTA-STS and TLS reporting if your email carries client or patient information.

If you would rather hand it off, our email security service sets up and monitors SPF, DKIM and DMARC as part of a wider plan against phishing. We also support law firms, medical practices and dental offices across Los Angeles. For background, read why anyone can send email as your business and how business email compromise works.

Sample

We started from OpenStreetMap, a public map database, and listed every business in Los Angeles County tagged as a lawyer, dentist, doctor, clinic or allied health practice (optometry, physical therapy, audiology and speech therapy) that gives its own website. We left out government offices, universities, hospitals and health systems, community clinics, national chains based outside Los Angeles, free website hosts, businesses that aren't practices (such as med spas and document preparers) and duplicate listings. We also left out GlobeVM's own clients and every business on our own sales lists, so this data can't be used for selling.

We put the remaining domains in a fixed random order and kept the first 100 eligible domains in each sector. A domain was eligible if it existed in DNS, wasn't parked or for sale, and, where it had no mail servers, its homepage loaded. That was the only time we opened a website. Of the 400 domains in the list, 12 were skipped on the way to 300. The final sample covers 56 cities and neighborhoods across the county, from Beverly Hills and Pasadena to Torrance and Palmdale.

What we measured

• MX records, and the email provider they point to (Microsoft 365, Google Workspace or other)
• SPF: whether one record exists, how it ends (-all, ~all, ?all) and how many DNS lookups it needs
• DMARC: whether a valid record exists, its policy (none, quarantine or reject), its pct value and whether it asks for reports (rua)
• MTA-STS and TLS-RPT records, and BIMI at the default selector

We did not measure DKIM, because DNS can't list a domain's DKIM keys. When mail arrives through a security gateway such as Proofpoint or Mimecast, or another relay host, we read the platform behind it from the SPF record when that record named only Microsoft or only Google.

How we measured

Every lookup was a DNS-over-HTTPS query to Cloudflare, with Google as a backup, using the same code as our email security check. We kept to fewer than five queries per second, backed off on any error and sent no email, opened no mail server connections and ran no port scans. We measured all 300 domains three times on October 25, 2026, starting at 12:57 PM, 1:04 PM, 1:53 PM Pacific time. No SPF, DMARC, MTA-STS or BIMI result changed between runs. One domain lists mail servers from two providers at equal priority, so the provider label could change with the order DNS returned them; we used the label seen in most runs.

Statistics

Percentages are counts divided by the number of domains in the group. Confidence intervals are 95% Wilson score intervals. The overall figures pool the three sectors equally, 100 domains each, so they describe these three fields together, not every business in Los Angeles. Sector differences were tested with a chi-square test.

Limits

• OpenStreetMap lists only businesses that someone has mapped, with a website. Practices with no website, or that aren't mapped, are missing, which may make the sample more established than average.
• A business may send email from a second domain we didn't check.
• A DNS record shows the policy a business asks for, not how well its inbox filters work. Some domains at p=none may be partway through a planned move to enforcement.
• This is a snapshot of October 25, 2026. Under the updated standard, RFC 9989, the pct tag no longer exists; 2 enforced domains still used pct below 100, and we report them at the policy they publish.