Census data: September 2026

Grade distribution

¶ The census reached 1,433 top-level domains. 497 of them clear the reporting floor and are broken out here; the remaining 936 are too small for a percentage to be stable, so they are counted in the totals but not broken out.

¶ The census has graded 316,600,902 domains (317M) drawn from 347,691,016 scanned domains (348M) across 1,433 TLDs.

¶ 74.2% of graded domains score an F, 234,955,475 domains.

¶ Fewer than 0.20% score an A or A+ (627,144 domains); an A+ is rarer still at 0.03%.

¶ 0.4% of scanned domains are dead (1,389,076 domains): the scan asked for their nameservers, got a definitive empty answer, and nothing else resolved. The share is taken over everything scanned, which is the denominator the sentence names.

Email authentication

¶ Only 11.6% of domains publish an enforcing DMARC (Domain-based Message Authentication, Reporting and Conformance) policy (quarantine or reject).

¶ 75.2% have no DMARC record at all.

¶ 47.4% publish an SPF (Sender Policy Framework) record; 52.6% publish none. 1.0% publish a record with no terminal all mechanism (usually a redirect= or include-only record, which can be valid), so 46.4% publish one that ends in an all mechanism, the figure the spf-exists methodology page counts.

¶ 50.1% of the 75,823,110 domains where DKIM (DomainKeys Identified Mail) could be determined publish a discoverable selector. It could not be determined for the other 240,777,792, because the census probes a fixed list of common selectors, so treat this as a floor rather than a DKIM adoption rate.

DNS & infrastructure

¶ Only 6.86% of domains have a valid DNSSEC (Domain Name System Security Extensions) chain; a further 0.05% are signed but broken.

¶ 1.38% publish a CAA (Certification Authority Authorization) record restricting which CAs (Certificate Authorities) may issue their certificates.

¶ 21.8% publish an AAAA (IPv6 address) record (IPv6-reachable).

TLS & web security

¶ 67.0% of domains serve over HTTPS (Hypertext Transfer Protocol Secure).

¶ Of domains serving HTTPS, 89.1% present a valid, trusted certificate (59.7% of all graded domains).

¶ 94.4% of HTTPS-serving domains negotiate TLS 1.3 (Transport Layer Security); 5.6% top out at TLS 1.2.

¶ Only 21.1% of HTTPS-serving domains send an HSTS (HTTP Strict Transport Security) header (14.1% of all graded domains).

Cite this

Statistics from the September 2026 edition of the Defaults.Exposed census. This URL is permanent: cite it and it stays good.

Defaults.Exposed, "Domain Security Census: September 2026" (as of September 5, 2026). https://defaults.exposed/data

Permalink: https://defaults.exposed/data · Licence: the 12 census export files are CC BY 4.0, free for bulk reuse and redistribution with attribution; the two summary files (census.json and tld-grades.csv) follow the site licence, which needs a licence for bulk or commercial reuse

This edition's DOI: https://doi.org/10.5281/zenodo.22690389 · All editions (concept DOI): https://doi.org/10.5281/zenodo.22690388 · Zenodo record

Full citation kit: how to cite the census, with copy-paste web/APA/Chicago/BibTeX, locked stats and a do-not-cite list

Machine-readable (14 files):

census.json · tld-grades.csv · tlds.json · checks.json · dmarc-policies.json · mx-providers.json · ns-providers.json · overlaps.json · tls-versions.json · ca-share.json · cert-problems.json · lifecycle.json · spf-errors.json · stack-headers.json

Explorer: the census explorer, filter by TLD + security check, shareable permalinks · Methodology: how the grade is calculated · Edition hub: the September 2026 census

This is the census data page. It keeps the same address every edition. The 12 raw exports above carry the same figures as this edition's Zenodo deposit, pretty-printed here for readability. Some labels and notes were corrected here after the deposit, so the wording can differ: the denominator notes on the four page-header checks, the ccTLD or gTLD kind of 40 TLDs (now the IANA delegation type), and a merged IDN (Internationalized Domain Name) key removed from the per-TLD check breakdown.