LeakTrace Research · The index · Q4 2026
The LeakTrace index: what professional firms show from outside.
Counted from our own outside readings. No firm is named. Each figure is the share of firms where a check returned an answer, with the number of firms beside it. A figure that would rest on fewer than 30 firms is not published.
- Published as
- Q4 2026
- Computed
- 8 October 2026
- Readings dated
- 13 May 2026 to 8 October 2026
- Firms counted
- 1864
- Smallest sample
- 30 firms
01 · Email in the firm's name
Can a stranger send email in the firm's name?
A public record called DMARC tells mail servers what to do with a message that claims to come from a firm and fails the checks. No record gives no instruction. Monitor mode sends reports and blocks nothing. Quarantine sends the message to spam. Reject refuses it.
41.8%Publish no DMARC recordof 1848 firms
32.5%Publish DMARC in monitor mode (p=none), which blocks nothingof 1848 firms
74.4%Cannot stop a stranger sending email in their name (either of the two rows above)of 1848 firms
16.3%Have forged email sent to spam (p=quarantine)of 1848 firms
9.4%Have forged email refused (p=reject)of 1848 firms
12.6%Publish no list of allowed mail senders (no SPF record)of 1849 firms
02 · The firm's name and addresses
Firm addresses in monitored breach databases.
19.9%Have a firm email address in monitored breach databasesAt least one email address at the firm's domain is present in monitored breach databases. It does not mean the firm itself was breached.of 649 firms
03 · By sector
The same figures, sector by sector.
| Sector | Cannot stop email sent in their name | Forged email refused | Address in breach databases |
|---|---|---|---|
| Law firms762 firms | 71.3%of 759 | 10.8%of 759 | 16.4%of 269 |
| Accounting firms453 firms | 74.6%of 453 | 8.2%of 453 | 23.4%of 175 |
| Dental practices251 firms | 88.4%of 241 | 2.1%of 241 | Not published |
| Insurance brokerages160 firms | 59.7%of 159 | 15.7%of 159 | 15.5%of 71 |
| Physiotherapy clinics77 firms | 80.3%of 76 | 14.5%of 76 | 25.0%of 36 |
| Optometry clinics39 firms | 66.7%of 39 | 10.3%of 39 | Not published |
| Veterinary clinics38 firms | 97.3%of 37 | 2.7%of 37 | Not published |
| Real estate brokerages34 firms | 88.2%of 34 | 8.8%of 34 | Not published |
A figure marked not published would rest on fewer than 30 firms.
04 · By country
Canada and the United States.
| Country | Cannot stop email sent in their name | Forged email refused | Address in breach databases |
|---|---|---|---|
| Canada1245 firms | 73.5%of 1240 | 10.3%of 1240 | 17.2%of 384 |
A figure marked not published would rest on fewer than 30 firms.
05 · Method
How the figures are counted.
- Everything is read from public sources. No system was accessed and no log-in was used.
- Each firm counts once, at its most recent finished reading.
- Test, demonstration and seeded records, readings of households, our own domains and reserved example domains are left out.
- Only professional firms are counted: law, accounting, insurance, real estate, mortgage, financial advice, consulting, and health practices such as dental, physiotherapy, optometry, pharmacy and veterinary clinics.
- A firm counts towards a figure only where that check returned an answer. A lookup that went unanswered is not counted as a missing record.
- Country is read from the province or state recorded with the reading.
- A figure that would rest on fewer than 30 firms is not published and is not stored. Where one could be worked out by subtraction, the next smallest figure is left out as well.
- These are the firms LeakTrace has read from outside. They are not a national sample, and being counted does not make a firm a client.
- The index uses only measures that hold up when checked a second way.
- Email records are compared against an independent lookup in our accuracy test.
- An address is counted only when the breach-database lookup answered.
- A measure is published only when at least 500 firms have an answer for it. A measure with fewer readings behind it is held back until it has them.
- Findings read from a website's own responses are left out, because bot protection in front of a site can change what an outside read sees.
- The figures are computed by one command and stored with their date. This page shows the stored figures and computes nothing when it loads.
06 · Why these records matter
$3,046,598,558
Reported losses to business email fraud in one year, as recorded by the FBI IC3 2025 Internet Crime Report.