Defaults.Exposed

Defaults.Exposed › Reports

The A-Grade Elite: What the Internet's Most Secure Domains Do Differently (2026)

Published 2026-06-28

Figures as of 2026-06-28 · methodology v7. Aggregate census data — no individual business’s grade is ever published. See how we grade.

Securing a domain to an A grade puts you in the top fraction of one percent of the entire internet. Out of 260 million graded domains, only 1,202,444 (0.46%) reach a B or better, and just 0.02% — roughly 1 in 4,600 — earn an A or A+. The remarkable part is not that these domains are rare. It is that what they do differently is almost entirely free, standard, and achievable in an afternoon.

This is the playbook of the A-grade elite.

How exclusive is an A grade, really?

TierDomainsShareRarity
A or A+6,740 + 49,7620.02%~1 in 4,600
B or better1,202,4440.46%~1 in 220
C or better——~1 in 27

For context: clearing a B puts you ahead of more than 99 in every 100 domains on the internet. These are not the budgets of Fortune 500 security teams at work — they are the same DNS settings available to anyone with a domain. The elite simply turned them on.

What the internet’s most secure domains have in common

An A-grade domain is not one that did a single clever thing. It is one that closed every common gap. Across the 34 checks we grade, the top-tier domains consistently get the same fundamentals right:

1. Their email cannot be forged

The single biggest divider between an A and an F is enforced email authentication:

A domain that publishes all three, at enforcement, has shut the door on the most common attack on the internet: someone sending email as you.

2. Their website is encrypted properly — not just “has https”

Top domains don’t merely serve HTTPS; they serve it correctly:

3. Their DNS is hardened

The elite lock down the layer underneath the website:

4. They send the right security headers

The finishing touches that separate a B from an A+:

The pattern: secure domains stack small wins

No single setting earns an A. The elite win by stacking a dozen individually small, individually free configuration steps until there are no open doors left. That is genuinely good news for everyone else, because it means the path to an A is not one expensive purchase — it is a checklist.

How to join the A-grade elite

  1. Find out where you stand. Run a free check and get your grade plus a per-check breakdown of exactly what you pass and fail.
  2. Start with email. SPF, DKIM, then DMARC at enforcement — this moves the needle most and stops spoofing.
  3. Confirm TLS + HSTS, then add DNSSEC and CAA.
  4. Add the security headers to finish.
  5. Re-check. Most of these changes are live within minutes to hours.

Frequently asked questions

What makes a domain secure? Enforced email authentication (SPF + DKIM + DMARC at p=quarantine or p=reject), a valid modern TLS certificate with HSTS, DNS hardening (DNSSEC and CAA), and a complete set of HTTP security headers. A-grade domains get all of these right at once.

How many domains have an A grade? As of 2026-06-28, only 0.02% of the 260 million graded domains earn an A or A+ — about 1 in 4,600.

Is getting an A expensive? No. Almost every requirement is a free configuration change in your DNS or web server settings. The barrier is awareness, not cost.

How long does it take to secure a domain? The core fixes can usually be made in an afternoon; most propagate within minutes to a few hours.

See how close your domain is to an A

You may be one setting away from the top 0.46% — or several. Check privately and free, and get the exact list of what to fix.

Check your domain → · How we grade → · Aggregate data only; individual grades are shown only to verified owners. Data stored and processed in the EU.