Defaults.Exposed › Research › Domain Exposure by TLD
Domain Exposure by TLD
Data as of 2026-07-28 · 112 TLDs · "spoofable" = lacks an enforcing DMARC policy (`quarantine`/`reject`). Aggregate only.
Across the whole census, 88.2% of domains can be impersonated in email, 10% accept mail with no authentication at all, and 8.5% have none of the five core protections. Here's how top-level domains compare — lower is better.
Least exposed TLDs
| # | TLD | Domains | Spoofable | Mail, no auth | Fully exposed |
|---|---|---|---|---|---|
| 1 | .ch | 1,409,983 | 66.8% | 7% | 0.5% |
| 2 | .ai | 892,694 | 70.2% | 4.7% | 4.1% |
| 3 | .nl | 3,027,676 | 70.4% | 6.9% | 0.5% |
| 4 | .pl | 1,658,199 | 71.2% | 3.2% | 0.5% |
| 5 | 106,875 | 75.9% | 10.5% | 11% | |
| 6 | .in | 2,421,232 | 77.7% | 4.9% | 3.7% |
| 7 | .de | 8,535,457 | 78.1% | 8.4% | 1.2% |
| 8 | .vip | 1,158,191 | 78.8% | 0.9% | 12.2% |
| 9 | .no | 488,542 | 80% | 14.5% | 0.5% |
| 10 | .dk | 655,290 | 80.4% | 28.1% | 0.4% |
| 11 | .co | 2,254,601 | 80.7% | 9.1% | 6.7% |
| 12 | .sk | 287,028 | 81.7% | 7% | 0.9% |
| 13 | .studio | 171,579 | 81.8% | 10.2% | 8.1% |
| 14 | .eu | 1,586,756 | 82% | 12% | 1.8% |
| 15 | .gr | 370,344 | 82.1% | 3.9% | 0.6% |
Most exposed TLDs
| # | TLD | Domains | Spoofable | Mail, no auth | Fully exposed |
|---|---|---|---|---|---|
| 1 | .xn--p1ai | 355,624 | 98.9% | 5.6% | 2.6% |
| 2 | .cyou | 255,582 | 98.8% | 4% | 11.7% |
| 3 | .cfd | 299,154 | 98.7% | 1.7% | 5% |
| 4 | .cn | 2,417,236 | 98.5% | 2.1% | 5.4% |
| 5 | .kr | 400,259 | 98.2% | 9.1% | 3.2% |
| 6 | .icu | 243,620 | 98.2% | 9.3% | 16.6% |
| 7 | .sbs | 534,349 | 97.9% | 1.8% | 6.8% |
| 8 | .lol | 334,959 | 97.5% | 2% | 8.1% |
| 9 | .bond | 126,147 | 97.4% | 1.3% | 14.9% |
| 10 | .ru | 2,952,318 | 96.9% | 8.2% | 2.7% |
| 11 | .vn | 322,458 | 95.9% | 17.1% | 8.1% |
| 12 | .cc | 1,255,034 | 95.6% | 1.5% | 6% |
| 13 | .ua | 300,982 | 95.3% | 17.7% | 1.8% |
| 14 | .buzz | 152,866 | 95.3% | 3.7% | 2.7% |
| 15 | .bet | 146,402 | 95% | 1.7% | 5% |
"Spoofable" = share of domains with no enforcing DMARC policy, so the visible "From" address can be forged. "Mail, no auth" = has MX records but no working SPF/DMARC. "Fully exposed" = zero of five core protections (SPF, enforced DMARC, DNSSEC, HTTPS, HSTS).
Averages don't tell you about your domain. Check yours free → — owner-only, with exactly what to fix.
By country · By industry · By TLD · The exposure score → · Can someone spoof your domain? →