Defaults.Exposed › Research › Domain Exposure by TLD
Domain Exposure by TLD
Data as of 2026-06-29 · 108 TLDs · "spoofable" = lacks an enforcing DMARC policy (`quarantine`/`reject`). Aggregate only.
Across the whole census, 89.4% of domains can be impersonated in email, 42.7% accept mail with no authentication at all, and 8.8% have none of the five core protections. Here's how top-level domains compare — lower is better.
Least exposed TLDs
| # | TLD | Domains | Spoofable | Mail, no auth | Fully exposed |
|---|---|---|---|---|---|
| 1 | .ch | 1,386,298 | 67.1% | 17.3% | 0.7% |
| 2 | .nl | 2,936,673 | 70.6% | 17.8% | 1% |
| 3 | .pl | 1,539,259 | 76.6% | 16.4% | 0.7% |
| 4 | .ai | 724,284 | 76.7% | 33.4% | 2.5% |
| 5 | 101,342 | 77.6% | 28.5% | 8.7% | |
| 6 | .no | 431,786 | 78.1% | 29.3% | 2.8% |
| 7 | .de | 8,732,116 | 78.6% | 24.8% | 2.5% |
| 8 | .dk | 609,198 | 80.1% | 47.3% | 1.1% |
| 9 | .in | 2,153,225 | 80.7% | 38.2% | 3.5% |
| 10 | .co | 1,972,068 | 81.5% | 34% | 5.2% |
| 11 | .gr | 356,641 | 81.7% | 16.9% | 0.5% |
| 12 | .studio | 170,845 | 81.7% | 35.8% | 7% |
| 13 | .eu | 1,544,510 | 81.8% | 29.7% | 1.8% |
| 14 | .sg | 101,012 | 82.8% | 28.6% | 1.5% |
| 15 | .sk | 277,662 | 83.3% | 17.3% | 1% |
Most exposed TLDs
| # | TLD | Domains | Spoofable | Mail, no auth | Fully exposed |
|---|---|---|---|---|---|
| 1 | .ph | 4,313,047 | 99.8% | 99% | 0.1% |
| 2 | .cyou | 239,979 | 99.1% | 68.5% | 16.2% |
| 3 | .xn--p1ai | 369,509 | 98.8% | 60.1% | 2.2% |
| 4 | .cfd | 301,103 | 98.8% | 69.6% | 3.2% |
| 5 | .cn | 2,140,750 | 98.5% | 92.4% | 5.8% |
| 6 | .bond | 113,390 | 98.5% | 85.1% | 13.8% |
| 7 | .icu | 250,248 | 98.3% | 84.6% | 20.7% |
| 8 | .kr | 377,606 | 98.1% | 58.3% | 3.8% |
| 9 | .sbs | 537,279 | 97.2% | 73.8% | 6.3% |
| 10 | .lol | 253,796 | 97.2% | 74.1% | 8.9% |
| 11 | .ru | 2,938,356 | 96.8% | 46.8% | 2.6% |
| 12 | .top | 3,213,010 | 96.8% | 87.7% | 18.8% |
| 13 | .cc | 1,153,776 | 96.2% | 78.8% | 5.9% |
| 14 | .vn | 320,457 | 96% | 59.5% | 9% |
| 15 | .ua | 300,500 | 95.4% | 42.8% | 2.3% |
"Spoofable" = share of domains with no enforcing DMARC policy, so the visible "From" address can be forged. "Mail, no auth" = has MX records but no working SPF/DMARC. "Fully exposed" = zero of five core protections (SPF, enforced DMARC, DNSSEC, HTTPS, HSTS).
Averages don't tell you about your domain. Check yours free → — owner-only, with exactly what to fix.
By country · By industry · By TLD · The exposure score → · Can someone spoof your domain? →