Defaults.Exposed › Data
Domain security statistics
As of August 2026, 78.3% of 377M graded domains score an F, and fewer than 0.15% score an A — Defaults.Exposed census of 432,115,044 domains across 890 TLDs.
Every figure below is dated and individually linkable. Numbers are recomputed each month from the live census; download the underlying aggregates as /data/census.json or /data/tld-grades.csv.
Grade distribution
As of August 2026
¶ As of August 2026, Defaults.Exposed has graded 376,928,750 domains (377M) drawn from a census of 432,115,044 registered domains (432M) across 890 TLDs.
¶ 78.3% of graded domains score an F — 295,157,813 domains.
¶ Fewer than 0.15% score an A or A+ (549,635 domains); an A+ is rarer still at 0.02%.
¶ 24.5% of registered domains no longer resolve (92,327,088 dead domains).
Email authentication
As of August 2026
¶ Only 9.3% of domains publish an enforcing DMARC policy (quarantine or reject).
¶ 80.0% have no DMARC record at all, leaving them open to email spoofing.
¶ 38.8% publish an SPF record; 61.2% publish none.
¶ 49.8% have a discoverable DKIM selector.
DNS & infrastructure
As of August 2026
¶ Only 5.0% of domains have a valid DNSSEC chain; a further 0.0% are signed but broken.
¶ 1.5% publish a CAA record restricting which CAs may issue their certificates.
¶ 23.8% publish an AAAA record (IPv6-reachable).
TLS & web security
As of August 2026
¶ 61.4% of domains serve over HTTPS.
¶ Of domains serving HTTPS, 90.5% present a valid, trusted certificate (55.5% of all graded domains).
¶ 94.9% of HTTPS-serving domains negotiate TLS 1.3; 5.1% top out at TLS 1.2.
¶ Only 18.8% of HTTPS-serving domains send an HSTS header (11.5% of all graded domains).
Cite this
Statistics current as of August 2026. Please cite Defaults.Exposed and link the source page.
Defaults.Exposed, "Domain Security Census" (as of August 2026). https://defaults.exposed/data
Permalink: https://defaults.exposed/data · Machine-readable: /data/census.json, /data/tld-grades.csv, /methodology/v8/checks.json · Licence: open data
Per-statistic permalinks: /stats — one dated, citable page per figure · Check registry: /methodology/v8 · MAGY sender-baseline readiness: /magy-readiness
Methodology: how we grade the internet. Updated monthly.