The Hawaiʻi Business Standard: 15 checks and how to pass each

The free reading runs 15 public checks on a business domain: forged email, security, speed, phones, search, and trust. What each means and how to fix it.

The Hawaiʻi Business Standard is 15 checks run against a business domain from the outside, using only public DNS records and public web pages. Nothing is touched. Each check is a question a customer's phone, inbox, or search engine already asks about you. Here is what each means and how to fix it.

How the reading works

Type a domain at hawaiiintelligence.com/reading. The reading looks up public mail records, loads the site over https and plain http, and requests the sitemap. Each check is pass or fail; the score is the share passed. The three highest-priority failures come back as plain fixes.

Email: can a stranger send mail as you

These two checks run only when the domain has mail servers. Otherwise they are skipped, not failed.

• Forged email rejected (DMARC). DMARC is a public record that tells inboxes what to do with mail that claims to be from your domain but fails authentication. RFC 7489 defines three settings: "none" requests no action, "quarantine" treats failing mail as suspicious, "reject" rejects it. The reading fails a domain with no record or with p=none: either way forged mail is delivered. For a customer, that is a fake invoice from "you" in their inbox. Fix: publish a DMARC record, watch it at p=none for a week, then quarantine, then reject. CISA directive BOD 18-01 required federal agencies to reach p=reject, a fair bar for a business.
• Authorized senders listed (SPF). SPF is a DNS record naming the servers allowed to send mail for your domain (RFC 7208). Fix: paste the SPF record your email provider gives you. Google's sender guidelines require SPF or DKIM from every sender, and SPF, DKIM, and DMARC from anyone sending more than 5,000 messages a day to Gmail.

Reachable, secure, and quick

• Site reachable. If https://yourdomain does not answer, the reading stops after the email checks. Nothing else matters until it does. Call your host.
• HTTP redirects to HTTPS. The reading loads http://yourdomain and checks that it lands on https. HTTPS keeps intruders from tampering with or listening to your customer's traffic (web.dev). Fix: a permanent redirect at the host.
• Server responds quickly. The reading times the first response and passes under 1,500 milliseconds. web.dev's guidance for Time to First Byte is 0.8 seconds or less. Fix: turn on caching or move to faster hosting; aim under one second.

What a phone shows

• Mobile viewport set. Without the viewport meta tag, mobile browsers draw the page at desktop width, usually about 980 pixels, then shrink it to fit (web.dev). The customer pinches to zoom. Fix: one viewport meta line in the page head with width=device-width and initial-scale=1.
• Tap-to-call phone. Wrapped in a tel: link, a phone dials the number with one tap (MDN). Fix: link the number with a tel: address, for example tel:+18085551234.

What search and shared links show

• Page title present and sized. The title is the headline of your search result. Google recommends descriptive, concise text unique to each page and warns against vague titles like "Home". Google sets no length limit but truncates to fit the device; the reading's 10 to 70 character band is a house rule for that space. Fix: name the business and the town.
• Meta description present. Google sometimes shows the meta description under your title when it describes the page better than body text; the reading wants at least 20 characters. Fix: one sentence saying what you do and where.
• One main heading. Google's starter guide says headings help people navigate; the reading asks for exactly one H1 so the page states one thing. Fix: make the H1 say what the business is; demote the rest to H2.
• Structured data for search. Google's LocalBusiness structured data states name, address, phone, and hours in a form search engines read directly. Google's introduction to structured data says it generally recommends JSON-LD. Fix: add a LocalBusiness block with name, address, telephone, and openingHoursSpecification.
• Social preview tags. The Open Graph protocol requires og:title, og:type, og:image, and og:url; with them a shared link shows a picture and headline. Fix: add og:title and og:image to every page.
• Sitemap published. A sitemap lists the pages you want found; Google limits one to 50,000 URLs or 50MB and accepts it in Search Console. Fix: publish /sitemap.xml and submit it.

Trust

• Privacy policy linked. The reading looks for any link containing "privacy". California Business and Professions Code section 22575 requires a commercial site that collects personal information from California residents to conspicuously post a privacy policy, and Hawaiʻi businesses sell to Californians daily. Fix: link a policy from the footer that says what you collect and who receives it.
• Email or contact page. The reading passes a mailto link or a link containing "contact". Fix: a contact page with phone, email, address, and hours.

What a score means

The score is passes divided by graded checks: 15 for a domain that receives email, 13 otherwise. The top three fixes are ordered by what a customer feels first: reachability, forged email, tap-to-call, https, SPF, viewport, speed, then search and trust. For the email side in depth, read the Hawaiʻi business email security report.

Questions owners ask

Does the reading touch or change anything on my site? No. It reads public DNS records like any inbox and loads public pages like any browser. It never logs in, submits a form, or writes anything.

My web person says DMARC is not needed for a small business. True? Google requires DMARC only from bulk senders, so nothing forces a small business to publish one. But without it, or at p=none, forged mail using your name is still delivered. The check grades what customers experience.

Can I fix these myself? Mostly, in an afternoon. Viewport, tel: link, title, description, H1, Open Graph, and contact link are site builder edits. DMARC and SPF are records at your registrar; your email provider gives the exact text. Redirect and speed usually mean one call to your host.

Sources

• RFC 7489, DMARC policy values. https://datatracker.ietf.org/doc/html/rfc7489 (fetched 2026-09-14)
• RFC 7208, SPF: authorized sending hosts. https://datatracker.ietf.org/doc/html/rfc7208 (fetched 2026-09-14)
• Google sender guidelines: SPF or DKIM for all; SPF, DKIM, DMARC above 5,000 messages a day. https://support.google.com/a/answer/81126 (fetched 2026-09-14)
• CISA BOD 18-01: federal p=reject and HTTPS-only. https://www.cisa.gov/news-events/directives/bod-18-01-enhance-email-and-web-security (fetched 2026-09-14)
• web.dev, Why HTTPS matters: tampering and listening. https://web.dev/articles/why-https-matters (fetched 2026-09-14)
• web.dev, Time to First Byte: 0.8 seconds or less. https://web.dev/articles/ttfb (fetched 2026-09-14)
• web.dev, Responsive design basics: 980-pixel default; the viewport tag. https://web.dev/articles/responsive-web-design-basics (fetched 2026-09-14)
• MDN, anchor element: tel: links. https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/a (fetched 2026-09-14)
• Google Search Central: title links, no length limit, truncated. https://developers.google.com/search/docs/appearance/title-link (fetched 2026-09-14)
• Google Search Central: snippets and meta descriptions. https://developers.google.com/search/docs/appearance/snippet (fetched 2026-09-14)
• Google Search Central: SEO starter guide, headings. https://developers.google.com/search/docs/fundamentals/seo-starter-guide (fetched 2026-09-14)
• Google Search Central: LocalBusiness structured data, JSON-LD example, properties. https://developers.google.com/search/docs/appearance/structured-data/local-business (fetched 2026-09-14)
• Google Search Central: introduction to structured data, JSON-LD generally recommended. https://developers.google.com/search/docs/appearance/structured-data/intro-structured-data (fetched 2026-09-14)
• Open Graph protocol: four required properties. https://ogp.me/ (fetched 2026-09-14)
• Google Search Central: sitemaps, 50MB or 50,000 URL limit, Search Console. https://developers.google.com/search/docs/crawling-indexing/sitemaps/build-sitemap (fetched 2026-09-14)
• California Business and Professions Code 22575, privacy policy posting. https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=BPC&sectionNum=22575 (fetched 2026-09-14)

Information, not legal, tax, insurance, or financial advice.