Southwest Michigan email security report: 2026 edition

To cite: Parallax Intelligence DNS check, October 2026. 79.2% of 847 businesses that email from their own domain (1,527 checked) have no DMARC enforcement. Full citation and reuse terms are in how to cite this study.

Key findings

The check found that only 176 of the 847 businesses that email from their own domain publish a DMARC policy that asks receivers to quarantine or reject forged mail. The rest fall into three groups, shown in the table below.

• Most of the gap is no record at all. 390 of the 847 publish nothing, so receivers get no instruction from the business either way.
• Monitoring only is common. 275 of the 847 have started with p=none, which sends reports but blocks nothing. It is a sensible first step that too often becomes the last one.
• Google Workspace domains are the least protected. 91% of the 355 Workspace businesses in the check have no enforcement, against 68.1% of the 304 on Microsoft 365.
• No county stands out as safe. Every county with 20 or more businesses in the check is above two in three unprotected.

Source: data from this study, DNS checked October 15, 2026. See the method.

What does "no enforcement" mean?

A DMARC record is a small DNS setting that tells a receiving mail server what to do with a message that fails authentication. Set it to enforce, and a forged email claiming to be from your business gets rejected or sent to spam. Leave it missing, or set to "monitor only," and the receiving server has to make its own call with no instruction from you. Large providers run their own spam and spoofing checks, so not every forgery lands, but nothing you published asks them to stop it. Of the 847 Southwest Michigan businesses in this check that email from their own domain, 390 publish no DMARC record at all, 275 have one that enforces nothing, and 6 publish a broken record that receivers ignore.

The numbers by county

County rows cover 768 of the 847 own-domain businesses. Four counties had fewer than 20 in the check, so we give them as counts, not percentages: St. Joseph 14 of 15, Barry 10 of 11, Cass 9 of 11, Branch 5 of 6. Another 36 businesses have no county on record (32 without enforcement).

Source: data from this study, DNS checked October 15, 2026. See the method.

Every county in the table except Van Buren comes in above three out of four businesses unprotected. Allegan and Berrien are the least protected; Van Buren, at 24 of 35, has the strongest numbers, on a small count.

Who runs the email, by provider

Google Workspace and Microsoft 365 together run 659 of the 847 own-domain businesses we checked. Neither platform turns on DMARC enforcement by default; a business has to set it up, which is exactly the gap this report measures. Workspace domains were the least protected of any provider.

Source: data from this study, DNS checked October 15, 2026. See the method.

Why this matters for a small business

Email impersonation is the front door for invoice fraud and payment scams. The FBI's Internet Crime Complaint Center calls business email compromise one of the most financially damaging online crimes, and it usually starts with a message that looks like it came from a real, trusted business. On top of that, Google now requires senders to authenticate their email or risk landing in spam, even when the message is genuine. Both problems share one fix: turn on enforcement.

What this means in plain English

• Find out which group you are in. A one-minute lookup tells you whether your domain has no record, a monitor-only record or a real policy. Our free email security check does it with no signup.
• p=none is a starting line, not a finish line. Monitoring mode is the right first step, because the reports show you every service that sends mail as you. The point is to read them and move on to quarantine, then reject.
• Don't jump straight to reject. List everything that sends as your domain first: invoicing, website forms, a newsletter tool, a scheduling app. Skip that and the policy blocks your own real mail.
• If mail is already bouncing, read the bounce. Paste the error into Postmortem Report, our free tool that explains what a rejection message means and what failed.
• If you want it handled, our DMARC audit service starts with a free audit of your SPF, DKIM and DMARC, then rolls the fix out over a few weeks so your email keeps working the whole time.

How to cite this study

Reporters, chambers, trade groups and other sites are welcome to quote any figure on this page with credit and a link. A short version:

79.2% of 847 businesses that email from their own domain (1,527 checked) have no DMARC enforcement, according to a Parallax Intelligence DNS check of Southwest Michigan businesses in October 2026.

Full citation:

Parallax Intelligence Partnership, LLC. "Southwest Michigan Email Security Report: 2026 Edition." DNS data collected October 15, 2026. https://parallaxintelligence.ai/resources/southwest-michigan-email-security-report/

Three things keep a quote accurate:

• Keep the denominator with the percentage: "79.2% of 847 businesses that email from their own domain (1,527 checked)."
• Say "no DMARC enforcement," not "no DMARC." Many of these businesses publish a monitor-only record.
• Give the date. This is a DNS reading from October 15, 2026, and records change.

Source: data from this study, DNS checked October 15, 2026. See the method.

Questions about the data, or a county figure you need for a story? Reach us through the contact page. We share aggregates only and will not identify a business.

How we measured this

The sample

The study covers 1,527 businesses with their own website in 11 Southwest Michigan counties: Kent, Calhoun, Ottawa, Kalamazoo, Berrien, Allegan, Van Buren, St. Joseph, Barry, Cass and Branch. 808 came from OpenStreetMap business listings in those counties, leaving out healthcare, cannabis, banks and credit unions, nonprofits, churches, schools, government offices and chains. The other 719 are local businesses from a list we had compiled earlier. It is not a random sample, so read the figures as "of the 847 we checked," not as a count of every business in the region.

What we checked, and when

The DNS sweep ran on October 15, 2026. For every domain we looked up the mail server (MX) records, the SPF record, the DMARC record at _dmarc (following CNAMEs, and applying a parent domain's subdomain policy where one applies), and DKIM keys on common selector names. This edition reports DMARC policy because DMARC is the record that tells a receiver what to do when a message fails. SPF and DKIM were read but are not reported as figures: a missing DKIM key can't be proven from outside, since a business can sign with a selector name we didn't try.

Who counts as "emails from its own domain"

A business counts when its domain's MX points at a real mailbox provider or paid mail gateway, or its contact address is on that domain. Of the 1,527, 848 met that bar, and one of those had a DMARC lookup fail twice, which leaves the 847 every percentage on this page is out of. The rest were left out: 409 have no mail on the domain at all, 168 have only a web host's default mail server with no sign the business uses it, 87 run their email from a consumer mailbox such as Gmail (which is covered by the mailbox provider's own policy, so we don't count it as unprotected), and 15 had lookups fail twice or listed a domain that isn't the business's own. Failed lookups were excluded, never guessed.

What "no enforcement" covers

No DMARC record, a record set to p=none, or a broken record. Broken means the domain publishes two DMARC records, which the DMARC standard (RFC 7489) says leaves the message with no DMARC policy applied, or a record with no usable policy. A quarantine or reject policy set to cover none of a domain's mail (pct=0) would also count; the check found none.

How we verified it

Every one of the 848 own-domain DMARC results was looked up again against Google's public DNS resolver and read by a separate parser that shares no code with the sweep: 848 of 848 matched. A random 20 of the newest additions were re-checked against Cloudflare's resolver, and 20 of 20 matched on mail provider and DMARC policy. This is a point-in-time snapshot of public DNS records, not a claim that any business was breached, and we never name an individual business. This edition covers Q4 2026 and replaces the August 2026 edition, which counted every domain with any mail server and put the figure higher.

Questions about this report

What is DMARC?

DMARC is a DNS record that tells email servers what to do with a message that claims to be from your domain but fails authentication. It's free to set up and most business email platforms support it, but it isn't turned on by default.

What does "no enforcement" mean?

It means a business either has no DMARC record at all, or has one set to "monitor only" (p=none), which watches for forged email but does not block any of it. Both leave the door open for spoofing.

Is my business named in this report?

No. This report only publishes county and provider level figures. We never name, list, or identify an individual business.

How was this data collected?

We ran a live DNS lookup against each domain's published DMARC policy and mail server records. Every number on this page comes from that audit, not a survey or a third-party estimate.

Which email providers had the least protection?

Google Workspace. 91% of the 355 Workspace businesses we checked (323) have no DMARC enforcement, against 68.1% of 304 on Microsoft 365. Neither platform turns on enforcement out of the box; the domain owner has to set it up.

What should I do if my domain has no enforcement?

Run a free check to see where your domain stands, then set your DMARC record to p=quarantine or p=reject once you've confirmed your legitimate mail sources. A one-minute check tells you which state you're in.

Source: data from this study, DNS checked October 15, 2026. See the method.