Defaults.Exposed › Census
The October 2026 domain security census
As of October 2026, 74.3% of 332M graded domains score an F in the Defaults.Exposed census of 361,301,790 scanned domains across 1,434 TLDs (Top-Level Domains).
This is the permanent home of the Defaults.Exposed domain security census: the single place that links every part of the current edition (the headline data and open downloads, the interactive explorer, the 33-check grading methodology and the MAGY sender-readiness scoreboard). The figures here are the current edition; the page keeps the same address every round, so a link or citation to it stays good.
Explore this edition
- Census data and downloads
- Census explorer Filter by TLD and security check for a quotable stat with a shareable permalink.
- Grading methodology v10 All 33 checks (24 scored and 9 informational) with stable IDs and pass/fail criteria.
- MAGY readiness scoreboard
The 2 reports
- The October 2026 edition: how 361,301,790 domains were counted
The October 2026 census scanned 632,901,201 of 649,194,272 sourced names, removed 271,599,411 that answered NXDOMAIN (Non-Existent Domain), and counts 361,301,790 domains, 332,492,319 of them graded. - How the grade is built: 33 checks, 100 points, and the 40 that email carries
A domain grade is a score out of 100 from 24 scored checks, with 40 points on email; F is the grade of 74.3% of the 332,492,319 domains that carry one.
The 33 checks
25 of the 33 checks, the ones the census measures, have a permanent, citable anchor page; the other 8 are defined on the methodology page only. 24 carry points toward the grade; 9 are informational. Full definitions and census prevalence: methodology v10 →
Email Security
- SPF record (
spf-exists) - SPF policy strength (
spf-policy-strength) - DMARC policy (
dmarc-policy) - DMARC reporting (
dmarc-reporting) - DKIM (
dkim-exists) - MX records (
mx-record) - Reverse DNS (PTR) (
reverse-dns)
TLS & Certificates
- HTTPS available (
https-available) - Certificate valid (
cert-valid) - Certificate expiry (
cert-expiry-warning) - Signature algorithm (
cert-signature-algorithm) - Key strength (
cert-key-strength) - TLS version (
tls-version) - Cipher strength (
cipher-strength) - TLS compression (
tls-compression, informational) - OCSP (Online Certificate Status Protocol) stapling (
ocsp-stapling, informational) - Secure renegotiation (
secure-renegotiation, informational)
Web Security
- HSTS (
hsts-header) - HTTP→HTTPS redirect (
http-to-https-redirect) - Content-Security-Policy (
csp-header) - Clickjacking protection (
x-frame-options) - MIME-sniffing protection (
x-content-type-options) - Referrer-Policy (
referrer-policy) - COOP (Cross-Origin-Opener-Policy) (
coop-header, informational) - CORP (Cross-Origin-Resource-Policy) (
corp-header, informational) - COEP (Cross-Origin-Embedder-Policy) (
coep-header, informational)
DNS Security
- CAA records (
caa-record) - DNSSEC (
dnssec) - Nameserver diversity (
nameserver-diversity) - SOA configuration (
soa-configuration)
Infrastructure
- IPv6 support (
ipv6-support, informational) - CDN (Content Delivery Network) / WAF (Web Application Firewall) detection (
cdn-waf-detection, informational) - Hosting provider (
hosting-provider, informational)
Open data
The aggregates, free to download and cite. Aggregates only: no individual domain is named. 520 of the 1,434 TLDs the census reached are large enough to break out; the rest are counted in the totals.
/data/census.json, census totals + grade distribution ·
/data/tld-grades.csv, per-TLD grade aggregates ·
Licence: open data
The census data page: census data and downloads. It keeps the same address every edition. Citing this census? The citation page has copy-paste formats, locked headline stats and both Zenodo DOIs.