Is .com safer than .net or .org? The answer, with its denominator

If you’re asking “is .com or .net safer”, the October 2026 census has a measured answer. Of the legacy three, .com carries the lowest share of grade F domains at 73.9%, .org sits at 76.4%, and .net carries the highest at 80.3%. Each share is measured against that ending’s graded plus dead domains, and the graded counts behind them are 153,849,480 for .com, 11,192,636 for .net and 11,231,720 for .org. So on this edition .com wins the comparison, and the rest of this page explains why that result shouldn’t change which ending you register.

The three numbers, with the denominator beside them

Grade F on defaults.exposed means a domain scored below 60 out of 100. Most F domains have some controls in place: 62.89% of them score between 40 and 59, as the score bands piece shows. The F share is the cleanest single comparable between endings, because it asks the same question of each domain and lower is better.

The graded column is there because a percentage means little until you know how many domains stand behind it. The three shares describe three very different populations, and the gap between them is narrow next to what you’d find by picking two endings at random from the ones the census scanned.

One thing the table can’t tell you is anything about a single domain. An ending’s F share is a description of its owners in aggregate. Your domain is one row in that aggregate, and it can sit anywhere on the curve.

The ranking is a fact about buyers

The records published under a domain set its grade. The registry agreement for .com, .net or .org says nothing about which of those records you can publish; all of them are free and available on any ending. So when three endings run on identical rules and land on different F shares, the difference has to come from the people registering them.

That’s what the data shows across the wider census. Premium technical endings bought by developers and infrastructure teams grade better; those buyers tend to configure DNS (Domain Name System) and email as a matter of habit. At the other end sit the cheap, bulk-registered endings where most domains are parked or thrown away, and since almost nobody configures a domain they’ve forgotten about, those grade worst. The legacy three are a mix of everyone, from serious businesses to abandoned registrations, and they land in the middle of the range.

Which puts .net’s 80.3% in context: the owners of .net domains, taken together, have published fewer records than the owners of .com domains, and that’s the whole of what the number measures. Swap the two populations and the shares would swap with them, because the ending itself had nothing to do with either result.

Scale drags .com toward the average

Across all 332,492,319 graded plus dead domains in the census, 247,066,987 carry grade F, which is 74.3%. Read that beside .com’s own 73.9% and you can see what scale does. An ending of that size is the average. Its owners are so numerous and so varied that the ending’s curve resolves toward whatever the median owner did, and the median owner of a domain on the registered internet did nothing.

That’s also why .com can’t pull far ahead of the internet as a whole. Any push that improved its share would have to move an enormous number of individual owners, and no registry runs a lever that big. Smaller endings can move; .com is the baseline that everything else gets measured against.

How far a country ending can move

If you want to see how far an ending’s curve can move, look outside the legacy three. On the same basis, .nl has 4,055,303 graded domains and an F share of 41.4%. That’s a country ending whose registry has spent years pushing DNS signing and sensible defaults through its registrars, and the whole distribution shifted with it.

Put .nl’s 41.4% next to .net’s 80.3% and the differences inside the legacy three look like what they are: three samples from the same broad population, sold at similar prices to much the same people. The difference between a legacy ending and .nl is what a registry with a policy can do to an ending’s curve over a decade.

That’s still no argument for registering a .nl. The records that lifted .nl’s curve are available to you today on whichever ending you already hold, and publishing them is a decision you make once, at the DNS console, for the domain you have. The registry did the persuading in .nl’s case. On .com, .net or .org, you do it yourself, and it takes an afternoon.

How to read any ending comparison you’re shown

Registrars and hosting blogs will keep telling you one ending is safer than another. A claim like that needs to survive a few questions before you act on it.

The first is what “safer” means. It has to be something measurable, such as the share of domains at grade F or the share with DMARC (Domain-based Message Authentication, Reporting and Conformance) at enforcement. A claim that doesn’t say which measure it uses can’t be checked.

The second is the denominator. An F share for an ending with a few thousand registrations moves when a few dozen owners change a record, which is why the graded count sits beside each figure on this page.

Then there’s the edition. Census numbers move every month as domains lapse and new owners configure them, so if there’s no date on the figure you’ve no way to check it.

Last, the mechanism. If someone says .com is safer, ask what a .com can publish that a .net can’t. The answer is nothing, so whatever the comparison is measuring, it’s the people who bought each ending.

What sets a grade on any ending

The grade for a domain is the sum of what’s published under it. The census reads the same records for a .com as for a .net, and the scanner on this site reads the same ones for yours.

• SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail) and DMARC, with DMARC at enforcement, meaning p=quarantine or p=reject. A p=none record monitors and blocks nothing; the DMARC guide explains why that one token is the whole difference.
• A valid, current certificate on a modern TLS (Transport Layer Security) version, with HSTS (HTTP Strict Transport Security) so browsers stop trying plain HTTP (Hypertext Transfer Protocol) at all.
• DNSSEC (Domain Name System Security Extensions), so a resolver can tell a forged answer from a real one, and CAA (Certification Authority Authorization), so only the authority you chose can issue a certificate for your name. Both live in DNS, and the DNS guide shows what each record looks like when it’s right.
• The HTTP security headers: a content security policy, clickjacking protection, X-Content-Type-Options: nosniff and a referrer policy.

Nothing on that list costs money, and none of it depends on which ending you hold. A .net with all of it published outgrades a .com with none of it, and the census holds plenty of both.

The domain you own beats the ending you’re choosing

Which ending grades better is arguable for as long as you like, because it depends on the population you pick and the edition you read. Whether your own domain can be spoofed is knowable in seconds, and the answer is specific to you. The scan reads the records under the name you type in and tells you which line to add or change to move the grade.

If you’ve been told an ending is safer and want to test the claim against something concrete, start with can someone spoof my domain: it shows what a missing enforcement policy lets an attacker do with your name, regardless of what comes after the dot. Then run the free scan on the domain you already hold. A grade A is reachable on .com, on .net and on .org, and the route to it is the same list of free records on all three.

Figures from the defaults.exposed census, data as of 12 October 2026. Census numbers move every month; the current values are on the census data page.