Defaults.Exposed › About Defaults.Exposed
About Defaults.Exposed
Who we are
Defaults.Exposed is an independent domain-security service. We measure how well the world’s websites and email are protected, explain what that means for ordinary businesses in plain language, and help any business owner check and fix their own domain, for free.
We exist because of one stubborn fact in the data: the basic protections that stop your email being forged and your customers being misled are, for the overwhelming majority of domains, simply switched off, and most owners have never been told.
The legal entity behind the service is Defaults Exposed FZ-LLC (trade licence no. 47034427, registration no. 0000004091879, Ras Al Khaimah Economic Zone, UAE; registered office: CWEP3805, Compass Building, Al Shohada Road, Al Hamra Industrial Zone-FZ, Ras Al Khaimah). Our census data is stored and processed within the EU.
Why we exist: the mission
Our mission is to make domain security visible and fixable for every business.
Domain security has stayed invisible for years for two reasons. First, it’s hidden in technical settings most owners never see and were never expected to understand. Second, the people who do understand it have mostly talked in jargon to each other, leaving out the business owner whose livelihood actually depends on it.
We’re trying to change both. The scan shows your domain’s grade at a glance, and we turn “you have a problem” into a short, clear set of steps that are free to follow.
The data: we measured the whole internet from the outside
We’ve independently graded around 332 million domains, each one checked against 33 security tests covering email authentication, encryption (TLS and certificates), web-security settings, and the domain’s own DNS (Domain Name System).
Every check is made from the outside: it is something anyone on the internet can observe, exactly what a customer’s mail server or a criminal would see. We never need access to anyone’s systems, accounts, or data to grade a domain.
The measurement is also independent: we measure the same way for everyone, with no relationship to the domains we look at.
The picture that emerged is blunt: 74.3% of graded domains score an F, the lowest grade, and fewer than 0.21% earn an A.
Why this matters to a normal business
If you run a business, a poorly protected domain costs you in everyday ways:
- Without the right settings, a criminal can send email that looks exactly like it came from you (to your customers, your staff, your suppliers) and it lands in the inbox looking genuine. That’s how fake-invoice and “urgent payment” scams work.
- When your domain gets used to trick people, or your site shows visitors a “Not secure” warning, the damage lands on your name, even when the genuine fault was a setting nobody switched on.
- Bigger customers often run a quick check on your domain before they sign, and “This domain can be spoofed” is enough to lose the contract. Your own real quotes and invoices are also more likely to be junked as spam.
The encouraging part, and the reason we built this, is that most of these problems are free and quick to fix. The usual barrier was that nobody told the owner it mattered, or how.
Who it helps
- Business owners who want a plain-English answer to “is my domain safe, and if not, what do I do?”, without needing to understand a single technical term.
- The people who manage it for them. An in-house IT person, a web developer, or an outside agency, who get a clear, specific checklist of exactly what to change, which saves everyone time.
You don’t need to be technical to use Defaults.Exposed. If you are technical, you’ll find the detail you need without the noise.
Our promise: aggregate in public, any grade on request
The figures we publish are always aggregate patterns: how whole countries, industries, and the internet as a whole are doing. We never publish a list of named domains with their grades.
A single domain’s grade is shown to whoever runs a scan of it, with no ownership check, because every check reads only what that domain already publishes to the internet. Your customers, your suppliers and a criminal can read the same records; the scan shows you what they see. Nothing in it comes from inside your systems.
Finding out what is wrong is free, and so are the fixes. Every one is written up on this site. We charge for one thing only: the A-Grade Playbook, your domain’s own steps in the order that will not break your email while you work through them.
See where your own domain stands
The headline numbers are averages. Your domain might be one of the rare few that earn an A, or one of the many that don’t. You can check it for free, see exactly which of the 33 checks you pass, and get plain-English steps to fix the ones you don’t. The check is not anonymous: we log each scan, and a completed scan is reported to Meta, and to Reddit if you came from a Reddit ad, to measure our ads. The Privacy Policy explains what we keep and how to opt out.