US title & escrow agency websites: email and HTTPS, November 2026

Findings

Of the 458 domains that resolved:

71% have no DMARC enforcement (no record, or policy “none”), so DMARC doesn't block email sent in their name. 11% use the strictest policy, “reject”.
10% publish no SPF record.
Of the 387 sites with a valid HTTPS certificate, 21% use one valid for more than 100 days. Certificates issued from March 15, 2027 are limited to 100 days, so renewals come about 4 times a year.
Of the 402 homepages we checked, 41% send HSTS and 19% send a Content-Security-Policy.

What to do

Publish DMARC, watch reports for a few weeks, then move to “quarantine” or “reject”.
Turn on automatic certificate renewal in your hosting panel.
Add HSTS once HTTPS works everywhere on the site.

Check your own domain: free scan.

Method

500 domains drawn at random (seed 20261101) from 5,369 US title and escrow agency websites in Overture Maps Places (release 2026-10-21.0; CDLA-Permissive-2.0/Apache-2.0/CC0). Chains (more than 3 locations), Fidelity, First American, Stewart and Old Republic brands, title-loan and pawn shops, and closed places excluded. 458 resolved.

Passive checks only: DNS, TLS handshake, HTTP headers. robots.txt respected (homepage skipped for 51). Margin of error up to ±5 points at 95% confidence.

No domains are named. Opt-out: /bot.