The October 2026 edition: how 361,301,790 domains were counted

The figure of 361,301,790 domains counts the domains this edition of the defaults.exposed census scanned and found to exist. Three independent feeds supplied the names. Before the scan the census set aside the names that a wildcarded top-level domain invents on demand. After the scan it removed every name that answered with “no such name”. So the number describes one edition’s scanned universe, produced on a stated date by a stated method, and it won’t support a wider claim than that.

It isn’t the size of the internet. Many registries publish no zone file, and a name no feed has observed can’t be counted. What the number comes with is a ledger you can check, in the order it happened: a sourced total, two removals and one addition before the scan, the total that went through the scan, one subtraction after it, and four dispositions that account for each name left.

Where the names came from

Three feeds contribute names. Zone files give the registered names for the top-level domains whose registries publish them, which is the closest thing to a registry-issued list that exists. DNS (Domain Name System) measurement data adds names observed in active resolution, which reaches domains under registries that don’t publish. Web crawl data brings in hostnames from crawled pages and from the web graph of links between them. That adds names neither of the others has seen, including under country-code TLDs with no public zone at all.

The three lists overlap heavily, so the census unions them and a name that appears in all three counts once. The census counts registrable domains, so a hostname from the crawl counts once, for the domain it sits under. That deduplicated union came to 649,194,272 names. The figure sits at the top of the ledger, and you shouldn’t quote it on its own, because a large part of it doesn’t exist.

The census also normalises each name to one form. An internationalised domain can arrive from one feed in Unicode and from another in its punycode encoding, and those are the same registration. That step is the ledger’s smallest subtraction: 28,452 names had arrived twice, once in each encoding, and were collapsed to one.

Before the scan: 16,500,126 wildcard phantoms

A few registries configure their top-level zone with a wildcard. A query for any name under that TLD then returns an address, whether or not anyone registered the name. Under such a TLD the DNS can’t say no. A name nobody registered resolves, would get scanned, and would get a grade for a website that is really the registry’s catch-all page. Left in, those names inflate the total and distort the grade shares of the TLD they sit under.

In the October edition nine TLDs behaved this way, and the census excluded the names under them wholesale. That removed 16,500,126 wildcard phantoms before the scan. The census then recovered 235,507 names under those wildcarded TLDs and carried them into the scan. That is the ledger’s one addition.

What went into the scan: 632,901,201 names

Sourced, minus the 16,500,126 wildcard phantoms and the 28,452 duplicate encodings, plus the 235,507 recovered names, gives the 632,901,201 names the scan ran against: 649,194,272 − 16,500,126 − 28,452 + 235,507 = 632,901,201.

This edition had no existence pass before the scan. Every one of those 632,901,201 names went to the scanner, including names that no longer exist. The scan ran in three passes from 2026-10-11 to 2026-10-12. The first pass covers the full list and either grades a domain or parks it. The later passes return to the parked domains, so that a single timed-out name server doesn’t decide a domain’s result for a month.

After the scan: 271,599,411 names that don’t exist

A registered domain has a delegation at its parent, so a query for it returns something, even if that something is only a referral or an empty answer. A name that sat in a zone file until it expired, or that a crawl saw in a link that was already stale, returns NXDOMAIN (Non-Existent Domain), the authoritative “no such name”.

271,599,411 of the scanned names answered NXDOMAIN, and the census removed them after the scan. The headline counts only names that exist, so these names aren’t counted as scanned, graded or dead, and they sit in no share on this site. No other line in the ledger is as large, which is why a raw feed total is the wrong number to cite. Zone files carry names right up to the moment they’re dropped. Crawl data carries links to sites that shut years ago. A measurement feed remembers names it resolved once. Each feed recorded a name as it stood on its own day, and the scan checks the whole list in a single edition.

What was left: 361,301,790 domains across 1,434 TLDs

The 632,901,201 scanned names, minus the 271,599,411 NXDOMAIN names, leave the scanned universe of 361,301,790 domains across 1,434 top-level domains. The whole ledger in one line: 649,194,272 − 16,500,126 − 28,452 + 235,507 − 271,599,411 = 361,301,790. That’s the number in the title. Cite it with the word “scanned” next to it.

Each figure on this page carries the edition’s date for that reason. The scanned universe is a fact about that edition. Run the same three feeds and the same steps a month later and each line will shift, which is why the edition is stated alongside the number wherever it’s quoted.

A scanned domain and a graded domain are different things

Scanning a domain means running the checks against it, from the delegation up through the DNS records that govern mail and the web server’s certificate and headers. Grading it means those checks returned enough to score. Confusing those two verbs is how a citation goes wrong, so the census records a disposition for each scanned domain, and there are four of them.

Graded, 329,604,717 domains (91.2%): the checks ran and the scorer had enough to grade. Indeterminate, 15,201,942: the domain answered, and after every pass the checks still hadn’t returned enough to grade. Unreachable, 13,607,529: the name is delegated, and nothing behind that delegation answered the scanner in any pass. Dead, 2,887,602 (0.80% of scanned): the scan asked for the domain’s name servers and got a definitive empty answer, and no address or mail record resolved either, so no record of any kind can be read.

Everywhere else on this site, “graded domains” means the 332,492,319 that carry a grade: this graded disposition plus the dead ones. Dead is the one bucket outside the graded disposition with a definite answer. The census grades a dead domain F, because a domain in that state has published no protection of any kind. Unreachable sounds like a scanner fault, yet the domain’s own configuration can put it there. A domain whose DNSSEC (Domain Name System Security Extensions) chain is broken answers SERVFAIL (Server Failure) to any resolver that validates, and that failure puts a registered, paid-for domain into unreachable through no fault of the scan. Name servers that time out and firewalls that drop the scanner’s source ranges do the same, and the later passes exist to give those domains another chance before the bucket is final.

Your own domain has a disposition in this edition. The free scan runs the same checks the census ran, against today’s records rather than the census snapshot, so you can see which bucket you’d land in now and why.

Two denominators, and which one your percentage needs

Shares on the data page rest on one of two bases. A share needs the base it was computed on beside it, or it misleads in the same way as the sourced total quoted alone.

Grade shares, the proportion of domains at A+, A, B, C, D or F, use 332,492,319 as the denominator. That is the graded domains plus the dead ones, because a dead domain carries an F and belongs in the distribution. The headline per-check shares, SPF (Sender Policy Framework), DMARC (Domain-based Message Authentication, Reporting and Conformance), DNSSEC and MX (Mail Exchange) among them, use the same 332,492,319: a dead domain publishes no records, so it counts as having none. Some checks need something to inspect and run on a subset. A DKIM (DomainKeys Identified Mail) check needs a selector to look up and a TLS (Transport Layer Security) check needs a server that completed a handshake, so their n is smaller, and the data page states the n for each check beside its result.

So a sentence about the share of domains at F needs “of the 332,492,319 domains carrying a grade” beside it. A sentence about a single check needs the base that check was counted on: the same 332,492,319 for the headline email and DNS checks, or the smaller n printed beside a check that runs on a subset. The DMARC page shows what that check reads from a record and what its states mean, and the TLS page does the same for the handshake, which is why the two are counted on different bases.

The wording to use when you cite it

Write the number with its verb and its date: “the defaults.exposed census scanned 361,301,790 domains across 1,434 TLDs, as of 12 October 2026”. If the point you’re making is about grades, cite the graded plus dead base. If it’s about one check, cite that check’s n. Don’t describe the scanned universe as the number of domains on the internet. Don’t set it against an earlier edition’s total either, because the feeds, the wildcard list and the method all move between editions, and the difference would reflect those changes as much as any change in the internet.

The full ledger, each check’s n and the machine-readable files behind them are on the census data page, refreshed when the next edition runs. Link to that page when you’re citing the figure, and to this one when you’re explaining the method.

Figures from the defaults.exposed census, data as of 12 October 2026. Census numbers move every month; the current values are on the census data page.