Most Greater Boston businesses leave the front door unlocked.
We checked 988 independent Greater Boston businesses in ten industries, the way a customer, an inbox and an AI tool see them. Nearly 9 in 10 haven't told email providers to block or quarantine fake mail sent in their name, and many are missing the basics people look for before they trust a business. Most of it is fixable, much of it in an afternoon.
- 59%publish no DMARC record for their email domain585 of 988, 95% CI 56 to 62%
- 89%don't block or quarantine spoofed mail (no DMARC, or monitor only)874 of 988, 95% CI 86 to 90%
- 57%link to no privacy policy from their homepage379 of 663, 95% CI 53 to 61%
- 51%send one or none of six common security headers415 of 819, 95% CI 47 to 54%
- 15%of Google business listings have no website of their own231 of 1,556, 95% CI 13 to 17%
Fall 2026 edition. Data collected October 21, 2026. Share of businesses, with sample size and 95% confidence interval.
Email: the easiest door to fake.
DMARC tells inboxes what to do with mail that pretends to come from your domain. Only 10% of businesses paired SPF with a DMARC policy that blocks or quarantines spoofed mail. The email platform made little difference: on Google Workspace or Microsoft 365, around half still had no DMARC record.
| Finding | Share | Count · 95% CI | |
|---|---|---|---|
| No DMARC recordDomain publishes no DMARC policy, so receivers have no instruction for mail that fakes it. | 59% | 585 of 988 56 to 62% | |
| DMARC missing or monitor-onlyNo DMARC, or DMARC set to p=none (reports only, blocks nothing). | 89% | 874 of 988 86 to 90% | |
| SPF plus enforced DMARCPublishes SPF and a DMARC policy of quarantine or reject. | 10% | 94 of 988 8 to 12% | |
| No SPF recordDomain lists no authorized mail senders. | 33% | 323 of 988 30 to 36% | |
| No DMARC, among domains that receive emailSame as above, limited to domains with mail (MX) records. | 53% | 424 of 796 50 to 57% |
Trust signals and the website itself.
Measured on the 819 homepages that could be read (privacy measures exclude Wix and Squarespace sites). One result stood out: 7% of sites still run only Google's retired Universal Analytics tag. Unless that old tag was quietly connected to a newer GA4 property, those businesses haven't had working Google Analytics for years.
| Finding | Share | Count · 95% CI | |
|---|---|---|---|
| No privacy policy link on homepageNo link to a privacy policy found in the homepage code. Excludes Wix and Squarespace sites, whose links we could not read reliably. | 57% | 379 of 663 53 to 61% | |
| Tracking tags, no consent toolAnalytics or ad tags present with no cookie-consent tool detected. Excludes Wix and Squarespace sites. | 51% | 335 of 663 47 to 54% | |
| Only the retired Universal Analytics tagUniversal Analytics stopped processing data in July 2023; these sites have no current Google analytics tag. | 7% | 58 of 819 6 to 9% | |
| Footer copyright 2023 or earlierAmong sites where a footer year was readable. | 20% | 81 of 406 16 to 24% | |
| Security headers grade F0 or 1 of the 6 OWASP-recommended security headers present. | 51% | 415 of 819 47 to 54% | |
| No HSTSBrowsers are not told to always use the secure (HTTPS) version. | 55% | 446 of 819 51 to 58% | |
| HTTP does not redirect to HTTPSThe plain http:// address does not forward to the secure site. | 10% | 80 of 819 8 to 12% | |
| Software version disclosedResponse headers reveal server or software version numbers. | 18% | 144 of 819 15 to 20% |
Search and AI: readiness is arriving by accident.
28% of sites publish an llms.txt file, a proposed plain-text guide for AI tools. Most sit on Wix, Shopify or GoDaddy, which create the file automatically, and the ones we opened were platform-generated. The major AI companies haven't said they use these files. Fewer than 3% block any AI crawler in robots.txt, so for most businesses the question is whether what AI tools find is accurate.
| Finding | Share | Count · 95% CI | |
|---|---|---|---|
| No structured data (reliably readable platforms)No schema markup, measured only on WordPress, Wix, Squarespace, Shopify, GoDaddy and Weebly sites. | 17% | 91 of 551 14 to 20% | |
| No meta descriptionNo summary text for search results. | 23% | 190 of 819 20 to 26% | |
| Has an llms.txt fileA plain-text guide for AI tools; spot-checks found these were generated by the site platform. | 28% | 233 of 819 26 to 32% | |
| Blocks at least one AI crawlerrobots.txt names and blocks an AI crawler such as GPTBot or ClaudeBot. | 3% | 24 of 819 2 to 4% |
The platform decides more than the owner does.
Hosted builders like Wix, Squarespace and Shopify ship security headers and structured data by default. Self-managed sites only get them when someone adds them. "Not detected" is mostly custom-built sites.
| Platform | Sites | Security headers F | No structured data | Has llms.txt |
|---|---|---|---|---|
| WordPress | 321 | 72% | 18% | 20% |
| Not detected | 221 | 59% | 51% | 17% |
| Wix | 78 | 0% | 1% | 96% |
| Squarespace | 78 | 0% | 0% | 0% |
| Shopify | 35 | 0% | 11% | 100% |
| Next.js | 22 | 82% | 46% | 27% |
| Weebly | 20 | 100% | 100% | 5% |
| GoDaddy Website Builder | 19 | 5% | 42% | 53% |
| Webflow | 15 | 67% | 73% | 13% |
By industry.
About 100 businesses per industry, so each figure carries roughly 10 points of uncertainty either way (the range under each figure). Restaurants had the highest share missing a privacy policy link, well above health practices and trades. Retailers stood out on security headers, partly because so many run on Shopify. Most other differences fall within the uncertainty.
| Industry | No DMARC | Security headers F | No privacy link | No own website |
|---|---|---|---|---|
| Restaurants & cafes100 businesses scanned | 72%63 to 80% | 41%31 to 52% | 81%70 to 89% | 8%5 to 13% |
| Auto repair & body100 businesses scanned | 69%59 to 77% | 67%55 to 77% | 72%60 to 81% | 31%25 to 38% |
| Salons, spas & fitness100 businesses scanned | 68%58 to 76% | 41%31 to 51% | 61%48 to 72% | 19%13 to 25% |
| Real estate & property100 businesses scanned | 58%48 to 67% | 61%50 to 71% | 47%36 to 59% | 11%7 to 16% |
| Child care & education100 businesses scanned | 57%47 to 66% | 47%37 to 58% | 67%54 to 78% | 19%13 to 26% |
| Health & dental100 businesses scanned | 56%46 to 65% | 52%42 to 62% | 46%35 to 57% | 8%5 to 13% |
| Trades & home services100 businesses scanned | 55%45 to 64% | 60%49 to 69% | 48%37 to 59% | 17%12 to 23% |
| Retail88 businesses scanned | 55%44 to 65% | 18%11 to 29% | 46%34 to 59% | 10%6 to 18% |
| Legal100 businesses scanned | 53%43 to 63% | 65%54 to 74% | 55%43 to 66% | 11%7 to 16% |
| Accounting, finance & insurance100 businesses scanned | 49%39 to 59% | 51%40 to 61% | 53%42 to 64% | 14%9 to 20% |
How Greater Boston compares.
National studies mostly look at the largest companies or the most-visited websites. Local, independent businesses trail them, and on website security our results track a separate national look at small-business sites closely.
| Group | What was found | Greater Boston, this study |
|---|---|---|
| Fortune 500 and Inc. 5000 | About 6% of Fortune 500 companies and 24% of Inc. 5000 companies have no DMARC record (EasyDMARC). | 59% have no DMARC record |
| 1.8 million high-traffic domains | About half publish DMARC and roughly 1 in 5 enforce it (EasyDMARC). | 12% enforce it |
| 4,688 small-business websites, nationally | About half met none of the security-header checks, and 21% disclosed software versions. | 51% fail headers, 18% disclose versions |
Check your own front door.
Free, and built on the same checks used in this study.
Who was included?
Independent, locally based businesses found through Google's local business listings, searching ten industries in 16 Greater Boston communities. National brands, franchises and chains were set aside. Of 1,556 independent listings, we drew about 100 businesses per industry at random from those with their own website, for 988 in all.
How were the checks done?
With public information only: DNS records for email, domain registration, and each homepage as served to any visitor, plus robots.txt, sitemap.xml and llms.txt. Nothing was logged into, submitted or tested. A random re-check of 40 domains matched the first scan in all 40.
How accurate are the numbers?
Each figure is a share with a 95% confidence interval. Overall figures are accurate to within about 3 percentage points and industry figures to within about 10. Treat two industries as different only when their ranges do not overlap.
What are the limits?
It isn't a random sample of every business: Google ranks listings by relevance, which favors established, well-reviewed businesses, so the real picture is probably somewhat worse. 169 sites blocked automated visits, so website figures cover the 819 that could be read. DKIM can only be found at common selector names, so it isn't reported as missing, and structured data on JavaScript-built sites can be missed. For the same reason, privacy-link and consent-tool figures exclude Wix and Squarespace sites, whose footer links and consent tools we couldn't read reliably. The confidence intervals describe statistical uncertainty only, not the effect of how the sample was drawn.
Will you name the businesses?
No. Results are published only in aggregate, and the underlying data stays private.
How often is this updated?
Quarterly. Each edition re-checks the same businesses to show whether the region is improving, and adds deeper looks at specific sectors.
Want yours fixed?
DMARC, SPF, DKIM, security headers and the privacy basics, usually done in a day without breaking your email. New editions and sector deep dives go out quarterly in Signals & Systems.
