{ "$schema": "https://www.enuclea.com/schemas/digital-trust-audit-v1.json", "metadata": { "title": "Fredericksburg Regional Digital Trust Audit (2026) — Sector Benchmarks", "slug": "fredericksburg-regional", "cohort": "Fredericksburg Regional Chamber list, local SMB universe", "published_by": "Enuclea LLC", "published_at": "2026-08-23T09:00:00Z", "audit_year": 2026, "geography": "Fredericksburg region, Virginia", "sample_size": 629, "chamber_identities": 728, "scope": "Unique local small-to-midsize businesses. Fortune 500 chains, duplicate regional-bank branches, and government agencies separated. Providers scored on the same instruments and held out of the community mean.", "methodology": "Non-intrusive public DNS: SPF (RFC 7208), DKIM selector presence (RFC 6376), DMARC policy (RFC 7489), DNSBL/IP reputation where an outbound identity was visible. No mail sent. No mailbox accessed. Point-in-time snapshot.", "unit_of_analysis": "Primary published sending domain per unique local entity", "enforced_definition": "DMARC p=quarantine or p=reject. p=none is monitoring, not protection.", "community_kpis": { "mean_score": 68.1, "median_score": 67.0, "grade": "C+", "grade_label": "Basic authentication / monitoring", "good_band_floor": 80, "delta_vs_good_band": -11.9, "active_spoof_protection_pct": 27.2, "vulnerable_to_impersonation_pct": 72.8, "missing_dkim_pct": 50.2, "spf_published_pct": 77.5, "dnsbl_blacklisted_pct": 17.9 }, "free_mail": { "chamber_identities": 728, "combined_free_mail_users": 127, "combined_free_mail_pct_of_chamber": 17.4, "pure_free_mail": 79, "pure_free_mail_pct_of_chamber": 10.9, "shadow_mail": 48, "shadow_mail_pct_of_chamber": 6.6, "shadow_mail_pct_of_community_629": 7.6, "note": "The 629 community scorecard is custom-domain SMBs (728 chamber identities minus 79 pure free-mail minus 20 government entities). 48 shadow-mail firms remain inside the 629." }, "grade_distribution": { "A_plus": 65, "A": 17, "B": 173, "C": 201, "D": 94, "F": 79 }, "notes": [ "Community mean 68.1 excludes the 19 IT/MSP providers so that cohort does not inflate the regional number.", "Do not treat 68.1 vs Stafford 2026 (59.96) as a trend. Different geography and n.", "Named private firms are not in this public payload. Provider rows stay in the private run file." ] }, "providers": { "held_out_from_community_mean": true, "it_msp_aggregate": { "sector_id": "it-providers-msps", "title": "Fredericksburg Regional IT & Managed Service Providers", "cohort_description": "Commercial MSPs, IT consulting firms, and computer-service providers operating in the regional market. Same DNS instruments as the community scorecard. Held out of the 629 mean.", "total_providers_audited": 19, "scores": { "mean": 77.3, "median": 78.0, "min": 55, "max": 100, "benchmark_delta_vs_community": 9.2 }, "grade_distribution": { "A_plus": 3, "A": 3, "B": 5, "C": 6, "D": 2, "F": 0 }, "adoption_metrics": { "dmarc_enforced_n": 8, "dmarc_enforced_pct": 42.1, "dmarc_monitoring_n": 6, "dmarc_monitoring_pct": 31.6, "dmarc_missing_n": 5, "dmarc_missing_pct": 26.3, "open_to_spoof_n": 11, "open_to_spoof_pct": 57.9, "dkim_present_n": 15, "dkim_present_pct": 78.9, "missing_dkim_n": 4, "missing_dkim_pct": 21.1, "spf_published_n": 15, "spf_published_pct": 78.9, "spf_strict_hardfail_n": 10, "spf_strict_hardfail_pct": 52.6 }, "key_insights": [ "Highest mean in the study (77.3), still 11 of 19 domains open to impersonation.", "8 of 19 enforce (p=quarantine or p=reject). 6 of 19 monitor at p=none. 5 of 19 publish no DMARC.", "4 of 19 have no DKIM public key. 4 of 19 publish no SPF.", "Gap is policy, not tooling. These firms already live on M365 or equivalent." ] } }, "sectors": [ { "sector_id": "technology-defense", "sector_name": "Technology & Defense", "in_community_sample": true, "total_businesses": 25, "share_of_community_pct": 4.0, "scores": { "mean": 76.0, "median": 80.0, "benchmark_delta_vs_community": 7.9 }, "adoption_metrics": { "dmarc_enforced_n": 10, "dmarc_enforced_pct": 40.0, "dmarc_monitoring_pct": 28.0, "dmarc_missing_n": 8, "dmarc_missing_pct": 32.0, "missing_dkim_pct": 28.0, "dnsbl_blacklisted_pct": 16.0 }, "why_it_matters": "Proximity to Quantico, Dahlgren, and federal primes makes email a high-value attack surface. Spoofed domains mimic familiar program managers, not spam. Invoices, visit requests, and CUI-adjacent files routinely move over email.", "why_the_data_looks_different": "Most firms already sit on M365 or Google Workspace. The gap is enforcement, not capability: 32% publish no DMARC and 16% show DNSBL hits. A high mean still leaves an open impersonation window." }, { "sector_id": "financial-services", "sector_name": "Financial Services", "in_community_sample": true, "total_businesses": 61, "share_of_community_pct": 9.7, "scores": { "mean": 73.1, "median": 77.0, "benchmark_delta_vs_community": 5.0 }, "adoption_metrics": { "dmarc_enforced_n": 29, "dmarc_enforced_pct": 47.5, "dmarc_monitoring_pct": 24.6, "dmarc_missing_n": 17, "dmarc_missing_pct": 27.9, "missing_dkim_pct": 41.0, "dnsbl_blacklisted_pct": 18.0 }, "why_it_matters": "Wiring details, tax documents, and updated-banking notes routinely move over email. BEC in this vertical is a funds-out problem, not a brand problem.", "why_the_data_looks_different": "Regional enforcement leader at 47.5%. 41% still send without DKIM because secondary senders — newsletters, billing portals — are often never aligned to the firm domain. Ahead on policy, behind on sender inventory." }, { "sector_id": "non-profit-community", "sector_name": "Non-Profit & Community", "in_community_sample": true, "total_businesses": 33, "share_of_community_pct": 5.2, "scores": { "mean": 68.5, "median": 65.0, "benchmark_delta_vs_community": 0.4 }, "adoption_metrics": { "dmarc_enforced_n": 6, "dmarc_enforced_pct": 18.2, "dmarc_monitoring_pct": 36.3, "dmarc_missing_n": 15, "dmarc_missing_pct": 45.5, "missing_dkim_pct": 45.5, "dnsbl_blacklisted_pct": 15.2 }, "why_it_matters": "Forged appeal mail and fake board messages convert because audiences want to help. Donor, volunteer, and grant-officer trust makes the domain a moral credential.", "why_the_data_looks_different": "Only 18.2% enforce. Many orgs inherit donated Workspace tenants, volunteer DNS admins, or mail set up years ago. The mailbox works, so nobody owns the records that make it trustworthy." }, { "sector_id": "healthcare-medical", "sector_name": "Healthcare & Medical", "in_community_sample": true, "total_businesses": 57, "share_of_community_pct": 9.1, "scores": { "mean": 68.1, "median": 68.0, "benchmark_delta_vs_community": 0.0 }, "adoption_metrics": { "dmarc_enforced_n": 21, "dmarc_enforced_pct": 36.8, "dmarc_monitoring_pct": 21.1, "dmarc_missing_n": 24, "dmarc_missing_pct": 42.1, "missing_dkim_pct": 56.1, "dnsbl_blacklisted_pct": 21.1 }, "why_it_matters": "Spoofed clinic domains are used for payment diversion and billing fraud. Patients cannot distinguish a real clinic from a lookalike domain.", "why_the_data_looks_different": "56.1% lack DKIM. Practice-management and patient-messaging vendors send as the clinic without aligned signatures. DNSBL at 21.1% is second-worst in the study." }, { "sector_id": "general-commercial", "sector_name": "General Commercial", "in_community_sample": true, "total_businesses": 313, "share_of_community_pct": 49.8, "scores": { "mean": 68.0, "median": 67.0, "benchmark_delta_vs_community": -0.1 }, "adoption_metrics": { "dmarc_enforced_n": 81, "dmarc_enforced_pct": 25.9, "dmarc_monitoring_pct": 34.8, "dmarc_missing_n": 123, "dmarc_missing_pct": 39.3, "missing_dkim_pct": 49.5 }, "why_it_matters": "Quotes, invoices, and shipping updates set community trust. Lookalike domains are indistinguishable from legitimate local businesses.", "why_the_data_looks_different": "DNS treated as a website setting rather than an identity control. Moving this cohort moves the regional grade." }, { "sector_id": "construction-trades", "sector_name": "Construction & Trades", "in_community_sample": true, "total_businesses": 44, "share_of_community_pct": 7.0, "scores": { "mean": 65.5, "median": 65.0, "benchmark_delta_vs_community": -2.6 }, "adoption_metrics": { "dmarc_enforced_n": 6, "dmarc_enforced_pct": 13.6, "dmarc_monitoring_pct": 34.1, "dmarc_missing_n": 23, "dmarc_missing_pct": 52.3, "dnsbl_blacklisted_pct": 22.7 }, "why_it_matters": "Draw requests, change orders, and supplier invoices are routine wire events. Invoice-swap fraud thrives on large, expected payments.", "why_the_data_looks_different": "Lowest DMARC enforcement in the study and the worst DNSBL rate. Field-first model: Gmail for the owner, custom domain on the truck wrap, no DNS owner." }, { "sector_id": "professional-services", "sector_name": "Professional Services (Legal / CPA)", "in_community_sample": true, "total_businesses": 57, "share_of_community_pct": 9.1, "scores": { "mean": 65.0, "median": 67.0, "benchmark_delta_vs_community": -3.1 }, "adoption_metrics": { "dmarc_enforced_n": 10, "dmarc_enforced_pct": 17.5, "dmarc_monitoring_pct": 45.7, "dmarc_missing_n": 21, "dmarc_missing_pct": 36.8, "missing_dkim_pct": 61.4, "dnsbl_blacklisted_pct": 12.3 }, "why_it_matters": "Attorneys and CPAs sell confidentiality. Clients treat firm email as authoritative. Unsealed mail is a professional-identity failure.", "why_the_data_looks_different": "DKIM is the fault: 61.4% send unsigned despite most firms already on M365. DNSBL is best in the study (12.3%) — clean reputation without a seal." }, { "sector_id": "hospitality-dining-retail", "sector_name": "Hospitality, Dining & Retail", "in_community_sample": true, "total_businesses": 39, "share_of_community_pct": 6.2, "scores": { "mean": 63.7, "median": 65.0, "benchmark_delta_vs_community": -4.4 }, "adoption_metrics": { "dmarc_enforced_n": 8, "dmarc_enforced_pct": 20.5, "dmarc_monitoring_pct": 28.2, "dmarc_missing_n": 20, "dmarc_missing_pct": 51.3, "missing_dkim_pct": 64.1, "dnsbl_blacklisted_pct": 10.3 }, "why_it_matters": "Reservations, gift-card, and invoice messages are high-conversion lures. Lookalike domains are easy to believe given public-facing brands and staff turnover.", "why_the_data_looks_different": "Lowest mean in the region. 64.1% missing DKIM is the widest sealing gap in the study. POS, reservation, and marketing platforms often send as the venue without alignment." } ] }