What do firms show from outside, place by place?
Each page below gives, for one province, state or city, the share of firms that have no published rule telling mail servers to refuse mail forged in their name, that have a look-alike of their domain registered and live, and that have a firm email address in monitored breach databases.
Sample: 3,124 firms read from public records between 19 April 2026 and 17 October 2026.
Last read from the sources at the foot of this page.
of the firms we read have no published rule telling mail servers to refuse mail forged in their name.
What share of every firm in this data set show each sign?
| Sign | Here | Firms that answered | Every place |
|---|---|---|---|
| No published rule to refuse forged mail | 76.6% | 3,108 | 76.6% |
| No DMARC record | 45.8% | 3,108 | 45.8% |
| DMARC at p=none, which asks for reports and refuses nothing | 30.9% | 3,108 | 30.9% |
| A look-alike of the domain registered and live | 44.7% | 2,548 | 44.7% |
| A firm email address in monitored breach databases | 24.4% | 1,575 | 24.4% |
The last column repeats the figure, so the table reads the same way as each place's page.
Which places have their own figures?
A place has its own page only where enough firms were read there to publish.
- Alberta
- Accounting firms in Alberta
- Calgary, Alberta
- Insurance brokerages in Alberta
- Law firms in Alberta
- Manitoba
- Law firms in Manitoba
- Michigan
- New York
- Accounting firms in New York
- Buffalo, New York
- Law firms in New York
- Rochester, New York
- Nova Scotia
- Halifax, Nova Scotia
- Ontario
- Accounting firms in Ontario
- Insurance brokerages in Ontario
- Law firms in Ontario
- Mississauga, Ontario
- Ottawa, Ontario
- Toronto, Ontario
- Pennsylvania
- Law firms in Pennsylvania
- Pittsburgh, Pennsylvania
How were these figures counted?
Every figure is counted from our own outside readings of public records. No system was accessed and no log-in was used.
Each firm counts once, at one finished reading, as a rule its most recent. Test, demonstration and seeded records, readings of households, our own domains and firms that asked not to be counted are left out.
A firm's place is the province or state, and the city, recorded with its reading. A city is counted only where it is in our table of named cities.
A firm counts towards a figure only where that check returned an answer. A lookup that went unanswered is not counted as a missing record.
A look-alike is counted by the method of our look-alike study: a registered, live name made from the firm's domain that does not point at the firm's own server and is not the same name on another ending.
An address is counted only where every lookup in the breach databases answered. It does not mean the firm itself was breached.
A province, state or city is published only where the firms read there number at least 100, and a line of work in a province or state only where they number at least 50. A figure is shown only where as many firms answered its check. Where a figure could be worked out by subtraction from the province's or state's own, the smallest one is left out as well.
These are the firms LeakTrace has read from outside. They are not a census of the place, and being counted does not make a firm a client.
The figures were computed on 17 October 2026 by one command and stored with their date. This page shows the stored figures and computes nothing when it loads.
Where does this come from?
- LeakTrace index: method and figuresgetleaktrace.comRead 17 October 2026
- LeakTrace research: the look-alike study's methodgetleaktrace.comRead 17 October 2026
See what is open before anyone else does.
We read your domain from outside and show each way in with a check anyone can re-run.