San Diego business websites: email and HTTPS, November 2026

Findings

Of the 412 domains that resolved:

82% have no DMARC enforcement (no record, or policy “none”), so DMARC doesn't block email sent in their name. 7% use the strictest policy, “reject”.
33% publish no SPF record.
Of the 364 sites with a valid HTTPS certificate, 19% use one valid for more than 100 days. Certificates issued from March 15, 2027 are limited to 100 days, so renewals come about 4 times a year.
Of the 361 homepages we checked, 48% send HSTS and 25% send a Content-Security-Policy.

What to do

Publish DMARC, watch reports for a few weeks, then move to “quarantine” or “reject”.
Turn on automatic certificate renewal in your hosting panel.
Add HSTS once HTTPS works everywhere on the site.

Check your own domain: free scan.

Method

500 domains drawn at random (seed 20261101) from 69,638 San Diego County business websites in Overture Maps Places (release 2026-10-21.0; CDLA-Permissive-2.0/Apache-2.0/CC0). Chains (more than 3 locations), brands, .gov/.edu/.mil and closed places excluded. 412 resolved.

Passive checks only: DNS, TLS handshake, HTTP headers. robots.txt respected (homepage skipped for 49). Margin of error up to ±5.2 points at 95% confidence.

No domains are named. Opt-out: /bot.