The Domain Security World Cup: who lifts the trophy if the safest domains win?

Published 2026-06-27

Football is decided on grass. But what if it were decided on DNS?

We took the actual 2026 World Cup draw — the real 12 groups, all 48 teams — and applied one beautifully petty rule to every fixture:

The nation whose business domains are least exposed wins the match.

“Least exposed” means the smallest share of a country’s domains scoring grade F — effectively wide open to email spoofing. Lower is better. Every number here is real, from our census of the internet, data as of 27 June 2026, based on each country’s national domain ending.

A note on fairness: a few nations have very few businesses on their national domain ending at all — a thin, less-representative slice (most of their firms are on .com, which we can’t attribute to a country). We mark those with a † and don’t hand them the trophy on thin coverage. It’s not that we sampled them lightly — we graded nearly all of what exists; there just isn’t much. Everyone else is playing with real, robust numbers.

Kick-off.

The group stage

Top two of each group advance. ✅ = through. The percentage is the country’s grade-F share — its exposure.

Group A — ✅ Mexico (72.2%) · ✅ Czechia (77.2%) · South Africa (78.2%) · South Korea (95.2%)
Group B — ✅ Bosnia & Herzegovina (56.7%) · ✅ Switzerland (59.1%) · Qatar (74.4%) · Canada (79.8%). The group of death — two of the three least-exposed nations on Earth, drawn together.
Group C — ✅ Haiti (74.1%†) · ✅ Brazil (76.7%) · Morocco (77.7%) · Scotland (82.5%). Brazil, five-time world champions, second in their group.
Group D — ✅ Paraguay (68.4%) · ✅ Australia (75.7%) · Turkey (77.8%) · United States (88.8%). The co-hosts finish bottom of their own group.
Group E — ✅ Curaçao (60.2%†) · ✅ Ecuador (66.2%) · Ivory Coast (74.6%) · Germany (81.7%). Germany — efficient at everything except their DMARC — finish dead last.
Group F — ✅ Netherlands (66.0%) · ✅ Japan (82.0%) · Sweden (82.0%) · Tunisia (83.5%)
Group G — ✅ Egypt (65.2%) · ✅ Belgium (74.5%) · New Zealand (74.5%) · Iran (87.1%). Egypt top a group containing Belgium.
Group H — ✅ Saudi Arabia (67.6%) · ✅ Uruguay (72.9%) · Spain (75.4%) · Cape Verde (94.9%). Spain, European royalty, third and out.
Group I — ✅ Norway (64.9%) · ✅ Senegal (72.4%) · France (74.5%) · Iraq (76.4%). France, third, dumped by Norway and Senegal.
Group J — ✅ Jordan (56.8%†) · ✅ Algeria (66.6%) · Argentina (71.2%) · Austria (77.0%). The reigning world champions go out in the group.
Group K — ✅ Portugal (65.2%) · ✅ DR Congo (73.4%†) · Uzbekistan (74.0%) · Colombia (76.3%)
Group L — ✅ Croatia (65.1%) · ✅ Panama (67.6%) · Ghana (71.8%) · England (79.2%). England finish last — the most England way to exit a tournament yet devised.

The group-stage carnage, on real numbers: Germany bottom of E. England bottom of L. The USA bottom of D — at home. And Spain, France, Argentina and Brazil all failing to win a group they were seeded to stroll.

The knockout rounds

One rule, no extra time — just whoever locked their domains down harder. The favourites aren’t the names on the shirts; they’re the names at the top of the exposure table: Bosnia, Switzerland, Norway, Croatia, Portugal.

Round of 16 / quarter-finals: Brazil (76.7%) and Argentina (already gone) are nowhere. Portugal (65.2%) and Norway (64.9%) carve through the draw. Saudi Arabia (67.6%) keep going. The giants of grass keep meeting tidier, better-configured opponents and keep losing.

The semi-finals

Bosnia & Herzegovina (56.7%) 🆚 Croatia (65.1%) → a Balkan derby of well-published DNS records; Bosnia advance.
Switzerland (59.1%) 🆚 Norway (64.9%) → Switzerland edge it.

🏆 The Final

Bosnia & Herzegovina (56.7%) 🆚 Switzerland (59.1%)

The two lowest-exposure nations in the world, who were also drawn together in Group B, meet again with the trophy on the line. It comes down to 2.4 percentage points — and Bosnia leave fewer domains exposed.

Champions: 🇧🇦 Bosnia & Herzegovina. Never the favourites on grass; the most locked-down domains on the planet.

Switzerland take silver; Norway and Croatia share the bronze. (Two nations with very thin national-domain coverage ran the leaders close — Jordan (56.8%†) and Curaçao (60.2%†) — but with only a couple of thousand domains on their national ending, we don’t crown a champion on it.) The wooden spoon goes to South Korea (95.2%): a footballing nation, a domain-security relegation candidate.

The uncomfortable bit

Here’s the joke that isn’t funny: the champion still has 57% of its domains at grade F. Bosnia “won” by being the least exposed nation in the field — and most of its businesses can still be impersonated by email. There are no real winners on this leaderboard. Only degrees of exposed.

That’s the point. Domain security isn’t a footballing-pedigree thing or a wealth thing. Brazil, Argentina, France, Germany, the USA — powers on the pitch, mid-table or worse on the only metric here. It’s a configuration thing. And configuration is free to fix.

Your country didn’t lift the trophy? Your domain still can. Check it free — a minute, we only ever show your grade to you, every fix we find is free. You could be more secure than the world champions by lunchtime.

A bit of fun, built on real data and the real 2026 draw. Exposure figures are each nation’s share of grade-F domains from the Defaults.Exposed census, as of 27 June 2026, based on the country’s national domain ending; † marks nations with thin national-domain coverage (under ~5,000 domains on their national ending — a near-complete read, but too small a slice of that country’s businesses to be representative), shown for fun but not used to decide the title. See how we grade and the full country league table.