Defaults.Exposed › Research › Domain Exposure by Industry
Domain Exposure by Industry
Data as of 2026-07-28 · 12 industries · "spoofable" = lacks an enforcing DMARC policy (`quarantine`/`reject`). Aggregate only.
Across the whole census, 88.2% of domains can be impersonated in email, 10% accept mail with no authentication at all, and 8.5% have none of the five core protections. Here's how industry domain endings compare — lower is better.
| # | Industry | Domains | Spoofable | Mail, no auth | Fully exposed |
|---|---|---|---|---|---|
| 1 | AI / Technology | 892,694 | 70.2% | 4.7% | 4.1% |
| 2 | Healthcare | 52,355 | 77.5% | 4.5% | 7.3% |
| 3 | Legal | 21,474 | 80.7% | 9.1% | 10.5% |
| 4 | Creative | 171,579 | 81.8% | 10.2% | 8.1% |
| 5 | Agencies | 107,110 | 83.3% | 8.7% | 7.4% |
| 6 | Retail | 4,791,823 | 84.9% | 3.1% | 9.6% |
| 7 | Technology | 1,308,343 | 85.7% | 7.6% | 6.5% |
| 8 | Software | 1,794,899 | 86.5% | 4.2% | 6.8% |
| 9 | Finance | 28,030 | 86.6% | 7% | 8.5% |
| 10 | Media | 87,454 | 87.8% | 8.5% | 7.2% |
| 11 | Design | 100,032 | 88.1% | 9.9% | 8.3% |
| 12 | Gaming | 57,218 | 88.2% | 5.8% | 7.1% |
"Spoofable" = share of domains with no enforcing DMARC policy, so the visible "From" address can be forged. "Mail, no auth" = has MX records but no working SPF/DMARC. "Fully exposed" = zero of five core protections (SPF, enforced DMARC, DNSSEC, HTTPS, HSTS). The domain ending is a proxy for the country/sector, not company registration.
Averages don't tell you about your domain. Check yours free → — owner-only, with exactly what to fix.
By country · By industry · By TLD · The exposure score → · Can someone spoof your domain? →