{ "source": "Defaults.Exposed grading methodology", "methodologyVersion": "v10", "url": "https://defaults.exposed/methodology", "license": "https://defaults.exposed/license", "censusAsOf": "2026-09-05", "gradedDomains": 316600902, "checkCount": 34, "scored": 25, "informational": 9, "categories": [ "Email Security", "TLS & Certificates", "Web Security", "DNS Security", "Infrastructure" ], "gradeBands": { "A+": 95, "A": 90, "B": 80, "C": 70, "D": 60, "F": 0 }, "noDataRule": "Every check returns pass | fail | N/A. N/A (\"couldn't determine\": timeout, SERVFAIL, redacted source) is excluded from the scoring denominator, never counted as a failure. \"Determined absent\" is a real fail.", "notes": [ "Check definitions are stable for methodology v10. Prevalence figures are pinned to the September 2026 census and will not change; the next edition publishes its own registry at its own URL.", "Prevalence is aggregate-only across the whole census, never an individual domain's result.", "prevalence: null means the public census rollup does not publish a trustworthy per-check figure for that check." ], "checks": [ { "id": "spf-exists", "name": "SPF record", "category": "Email Security", "status": "scored", "whatItTests": "Stops criminals sending email that looks like it's from you, and helps your mail reach the inbox.", "pass": "The domain publishes exactly one syntactically valid SPF TXT record (v=spf1 …).", "fail": "No SPF record is published, or the published record does not parse.", "example": "v=spf1 include:_spf.google.com -all", "url": "https://defaults.exposed/methodology/spf-exists", "fixUrl": "https://defaults.exposed/fix/spf", "prevalence": { "asOf": "2026-09-05", "label": "publish a syntactically valid SPF record", "numerator": 146987360, "denominator": 316600902, "denominatorLabel": "graded domains", "percent": 46.4267, "note": "Invalid (unparseable) SPF records are counted separately and excluded from this pass share." } }, { "id": "spf-policy-strength", "name": "SPF policy strength", "category": "Email Security", "status": "scored", "whatItTests": "A weak SPF only warns; a strict one actually blocks forgeries.", "pass": "The SPF record ends in a hardfail all-mechanism (-all), telling receivers to reject unauthorized senders.", "fail": "The record ends in ~all (softfail), ?all (neutral), or +all (permits anyone), or no SPF exists.", "example": "v=spf1 include:_spf.example-mailer.com -all", "url": "https://defaults.exposed/methodology/spf-policy-strength", "fixUrl": "https://defaults.exposed/fix/spf", "prevalence": { "asOf": "2026-09-05", "label": "publish SPF with a hardfail (-all) policy", "numerator": 57704425, "denominator": 316600902, "denominatorLabel": "graded domains", "percent": 18.2262, "note": "Softfail (~all) records count toward SPF presence but not full policy strength." } }, { "id": "dmarc-policy", "name": "DMARC policy", "category": "Email Security", "status": "scored", "whatItTests": "The instruction that tells mail providers to reject impersonated email, the core anti-spoofing control.", "pass": "A valid DMARC record at _dmarc. with an enforcing policy (p=quarantine or p=reject).", "fail": "No DMARC record, an unparseable record, or a monitor-only policy (p=none) which observes but does not block.", "example": "v=DMARC1; p=reject; rua=mailto:dmarc@example.com", "url": "https://defaults.exposed/methodology/dmarc-policy", "fixUrl": "https://defaults.exposed/fix/dmarc", "prevalence": { "asOf": "2026-09-05", "label": "publish an enforcing DMARC policy (p=quarantine or p=reject)", "numerator": 36598025, "denominator": 316600902, "denominatorLabel": "graded domains", "percent": 11.5597, "note": "A further share publish a monitor-only p=none record; that counts as a DMARC record but not enforcement." } }, { "id": "dmarc-reporting", "name": "DMARC reporting", "category": "Email Security", "status": "scored", "whatItTests": "Reports who's sending mail as you, so you spot abuse and misconfiguration.", "pass": "The DMARC record includes an aggregate-report address (rua=mailto:…) so the owner receives spoofing reports.", "fail": "The DMARC record has no rua reporting address, or no DMARC record exists.", "example": "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com", "url": "https://defaults.exposed/methodology/dmarc-reporting", "fixUrl": "https://defaults.exposed/fix/dmarc", "prevalence": { "asOf": "2026-09-05", "label": "publish a DMARC record with an aggregate-reporting (rua) address", "numerator": 31037403, "denominator": 316600902, "denominatorLabel": "graded domains", "percent": 9.8033 } }, { "id": "dkim-exists", "name": "DKIM", "category": "Email Security", "status": "scored", "whatItTests": "A cryptographic signature proving mail is genuinely from you; boosts deliverability.", "pass": "A DKIM public key is discoverable at a common selector under _domainkey..", "fail": "No DKIM selector is observable at the probed selectors.", "example": "selector1._domainkey.example.com TXT \"v=DKIM1; k=rsa; p=MIIBIjANBg…\"", "url": "https://defaults.exposed/methodology/dkim-exists", "fixUrl": "https://defaults.exposed/fix/dkim", "prevalence": { "asOf": "2026-09-05", "label": "publish one", "numerator": 37999462, "denominator": 75823110, "denominatorLabel": "domains where a DKIM selector could be determined", "percent": 50.1159, "note": "The census probes a fixed list of common selectors, so a domain signing under an unguessed selector reads as not-determinable, never as absent. Treat this as a floor." } }, { "id": "mx-record", "name": "MX records", "category": "Email Security", "status": "scored", "whatItTests": "Whether your domain is correctly set up to receive email at all.", "pass": "The domain publishes at least one resolvable MX record.", "fail": "No MX records are published (mail to the domain cannot be routed normally).", "example": "example.com. 3600 IN MX 10 mail.example.com.", "url": "https://defaults.exposed/methodology/mx-record", "fixUrl": "https://defaults.exposed/fix/mx", "prevalence": { "asOf": "2026-09-05", "label": "publish at least one MX record", "numerator": 173282307, "denominator": 316600902, "denominatorLabel": "graded domains", "percent": 54.7321 } }, { "id": "reverse-dns", "name": "Reverse DNS (PTR)", "category": "Email Security", "status": "scored", "whatItTests": "Helps your mail server look legitimate so messages aren't junked.", "pass": "The domain's mail-relevant IP has a PTR (reverse DNS) record.", "fail": "No PTR record exists for the address.", "example": "10.0.113.203.in-addr.arpa. PTR mail.example.com.", "url": "https://defaults.exposed/methodology/reverse-dns", "fixUrl": "https://defaults.exposed/fix/reverse-dns", "prevalence": { "asOf": "2026-09-05", "label": "have a PTR (reverse DNS) record", "numerator": 134848964, "denominator": 173216907, "denominatorLabel": "domains with a mail-relevant address", "percent": 77.8498 } }, { "id": "https-available", "name": "HTTPS available", "category": "TLS & Certificates", "status": "scored", "whatItTests": "Without it, browsers warn visitors \"Not secure\" and they leave.", "pass": "The site serves content over HTTPS (TLS handshake completes and a response is returned).", "fail": "The site is reachable over plain HTTP only, or HTTPS connections fail.", "example": "https://example.com/ → HTTP 200 over TLS", "url": "https://defaults.exposed/methodology/https-available", "fixUrl": "https://defaults.exposed/fix/https", "prevalence": { "asOf": "2026-09-05", "label": "serve over HTTPS", "numerator": 212154494, "denominator": 316600902, "denominatorLabel": "graded domains", "percent": 67.0101 } }, { "id": "cert-valid", "name": "Certificate valid", "category": "TLS & Certificates", "status": "scored", "whatItTests": "A trusted, correctly-issued certificate; an invalid one throws scary browser warnings.", "pass": "The presented certificate chain validates to a trusted root, matches the hostname, and is within its validity period.", "fail": "The certificate is self-signed, expired, name-mismatched, or otherwise fails validation.", "example": "CN=example.com, issued by a publicly trusted CA, chain validates", "url": "https://defaults.exposed/methodology/cert-valid", "fixUrl": "https://defaults.exposed/fix/certificate", "prevalence": { "asOf": "2026-09-05", "label": "present a valid, trusted certificate", "numerator": 189117751, "denominator": 212154494, "denominatorLabel": "HTTPS-serving domains", "percent": 89.1415 } }, { "id": "cert-expiry-warning", "name": "Certificate expiry", "category": "TLS & Certificates", "status": "scored", "whatItTests": "A certificate about to expire takes your site offline with a full-page warning.", "pass": "The certificate's notAfter date is comfortably in the future (not expired, not inside the imminent-expiry window).", "fail": "The certificate is expired or expires imminently.", "example": "Not After: a date well beyond the scan date", "url": "https://defaults.exposed/methodology/cert-expiry-warning", "fixUrl": "https://defaults.exposed/fix/certificate", "prevalence": null }, { "id": "cert-signature-algorithm", "name": "Signature algorithm", "category": "TLS & Certificates", "status": "scored", "whatItTests": "Uses a modern, unbroken signing algorithm (not legacy SHA-1).", "pass": "The certificate is signed with a modern algorithm (SHA-256 family or better).", "fail": "The certificate is signed with a deprecated algorithm such as SHA-1 or MD5.", "example": "Signature Algorithm: sha256WithRSAEncryption", "url": "https://defaults.exposed/methodology/cert-signature-algorithm", "fixUrl": "https://defaults.exposed/fix/certificate", "prevalence": null }, { "id": "cert-key-strength", "name": "Key strength", "category": "TLS & Certificates", "status": "scored", "whatItTests": "Adequate key length so the encryption can't be brute-forced.", "pass": "The certificate public key meets modern strength baselines (e.g. RSA ≥ 2048-bit or an equivalent EC key).", "fail": "The key is below the baseline (e.g. RSA 1024-bit).", "example": "Public key: RSA 2048-bit (or EC P-256)", "url": "https://defaults.exposed/methodology/cert-key-strength", "fixUrl": "https://defaults.exposed/fix/certificate", "prevalence": null }, { "id": "tls-version", "name": "TLS version", "category": "TLS & Certificates", "status": "scored", "whatItTests": "Modern TLS (1.2/1.3); old versions are broken and fail security reviews.", "pass": "The server negotiates TLS 1.2 or TLS 1.3.", "fail": "Only legacy protocol versions (TLS 1.0/1.1 or older) are negotiated.", "example": "Negotiated protocol: TLS 1.3", "url": "https://defaults.exposed/methodology/tls-version", "fixUrl": "https://defaults.exposed/fix/tls", "prevalence": { "asOf": "2026-09-05", "label": "negotiate TLS 1.2 or 1.3", "numerator": 212154494, "denominator": 212154494, "denominatorLabel": "HTTPS-serving domains", "percent": 100, "note": "This is a share of the handshakes the census completed, not of every HTTPS host. The scanner offers only TLS 1.2 and 1.3, so a host that speaks nothing newer than TLS 1.0/1.1 fails the handshake and drops out of the HTTPS-serving population entirely rather than appearing here as a failure; legacy-only shares are therefore not enumerable in this rollup." } }, { "id": "cipher-strength", "name": "Cipher strength", "category": "TLS & Certificates", "status": "scored", "whatItTests": "Strong encryption protecting data in transit.", "pass": "The negotiated cipher suite is a modern AEAD suite (e.g. AES-GCM or ChaCha20-Poly1305).", "fail": "A weak or deprecated cipher (RC4, 3DES, export-grade, CBC-only legacy suites) is negotiated.", "example": "Cipher: TLS_AES_128_GCM_SHA256", "url": "https://defaults.exposed/methodology/cipher-strength", "fixUrl": "https://defaults.exposed/fix/tls", "prevalence": null }, { "id": "tls-compression", "name": "TLS compression", "category": "TLS & Certificates", "status": "informational", "whatItTests": "Compression disabled to avoid a known attack class (CRIME).", "pass": "TLS-level compression is disabled.", "fail": "TLS compression is enabled.", "example": "Compression: NONE", "url": "https://defaults.exposed/methodology/tls-compression", "fixUrl": "https://defaults.exposed/fix/tls", "prevalence": null }, { "id": "ocsp-stapling", "name": "OCSP stapling", "category": "TLS & Certificates", "status": "informational", "whatItTests": "Faster, more private certificate-revocation checks.", "pass": "The server staples a current OCSP response into the TLS handshake.", "fail": "No OCSP response is stapled (clients must query the CA themselves).", "example": "OCSP response: stapled, status good", "url": "https://defaults.exposed/methodology/ocsp-stapling", "fixUrl": "https://defaults.exposed/fix/tls", "prevalence": null }, { "id": "secure-renegotiation", "name": "Secure renegotiation", "category": "TLS & Certificates", "status": "informational", "whatItTests": "Protects against a TLS renegotiation attack.", "pass": "The server supports the secure renegotiation extension (RFC 5746).", "fail": "Only legacy (insecure) renegotiation is supported.", "example": "Secure Renegotiation IS supported", "url": "https://defaults.exposed/methodology/secure-renegotiation", "fixUrl": "https://defaults.exposed/fix/tls", "prevalence": null }, { "id": "hsts-header", "name": "HSTS", "category": "Web Security", "status": "scored", "whatItTests": "Forces the secure padlock every visit so customers can't be downgraded to an insecure connection.", "pass": "The site sends a Strict-Transport-Security header with a meaningful max-age.", "fail": "No HSTS header is sent over HTTPS.", "example": "Strict-Transport-Security: max-age=31536000; includeSubDomains", "url": "https://defaults.exposed/methodology/hsts-header", "fixUrl": "https://defaults.exposed/fix/hsts", "prevalence": { "asOf": "2026-09-05", "label": "send an HSTS header", "numerator": 44684372, "denominator": 212154494, "denominatorLabel": "HTTPS-serving domains", "percent": 21.0622 } }, { "id": "http-to-https-redirect", "name": "HTTP→HTTPS redirect", "category": "Web Security", "status": "scored", "whatItTests": "Sends visitors who arrive on http straight to the secure version.", "pass": "Requests to http:// are redirected (301/302/307/308) to the https:// origin.", "fail": "Plain-HTTP requests are served content without redirecting to HTTPS.", "example": "http://example.com/ → 301 → https://example.com/", "url": "https://defaults.exposed/methodology/http-to-https-redirect", "fixUrl": "https://defaults.exposed/fix/https", "prevalence": null }, { "id": "csp-header", "name": "Content-Security-Policy", "category": "Web Security", "status": "scored", "whatItTests": "Reduces the chance a hacked or injected script steals customer data off your site.", "pass": "The site sends an effective Content-Security-Policy header.", "fail": "No CSP header is sent.", "example": "Content-Security-Policy: default-src 'self'", "url": "https://defaults.exposed/methodology/csp-header", "fixUrl": "https://defaults.exposed/fix/csp", "prevalence": { "asOf": "2026-09-05", "label": "send an effective Content-Security-Policy header", "numerator": 12734849, "denominator": 125815036, "denominatorLabel": "domains whose page returned a 2xx response", "percent": 10.1219, "note": "The four response-header checks are evaluated only where the page answered directly with a 2xx status; redirects, errors and unanswered fetches return N/A and are never counted as a failure, so this denominator is smaller than the graded population and the share of all graded domains is lower." } }, { "id": "x-frame-options", "name": "Clickjacking protection", "category": "Web Security", "status": "scored", "whatItTests": "Stops attackers embedding your site to trick your customers into clicking things.", "pass": "The site sends X-Frame-Options (DENY/SAMEORIGIN) or a CSP frame-ancestors directive.", "fail": "Neither header is sent, the site can be framed by any origin.", "example": "X-Frame-Options: DENY", "url": "https://defaults.exposed/methodology/x-frame-options", "fixUrl": "https://defaults.exposed/fix/clickjacking", "prevalence": { "asOf": "2026-09-05", "label": "send clickjacking protection (X-Frame-Options or CSP frame-ancestors)", "numerator": 19226529, "denominator": 125815036, "denominatorLabel": "domains whose page returned a 2xx response", "percent": 15.2816 } }, { "id": "x-content-type-options", "name": "MIME-sniffing protection", "category": "Web Security", "status": "scored", "whatItTests": "Stops browsers mis-reading files in ways attackers can abuse.", "pass": "The site sends X-Content-Type-Options: nosniff.", "fail": "The header is absent.", "example": "X-Content-Type-Options: nosniff", "url": "https://defaults.exposed/methodology/x-content-type-options", "fixUrl": "https://defaults.exposed/fix/mime-sniffing", "prevalence": { "asOf": "2026-09-05", "label": "send X-Content-Type-Options: nosniff", "numerator": 22381337, "denominator": 125815036, "denominatorLabel": "domains whose page returned a 2xx response", "percent": 17.7891 } }, { "id": "referrer-policy", "name": "Referrer-Policy", "category": "Web Security", "status": "scored", "whatItTests": "Controls what address info leaks to other sites when visitors click away.", "pass": "The site sends a Referrer-Policy header.", "fail": "The header is absent.", "example": "Referrer-Policy: strict-origin-when-cross-origin", "url": "https://defaults.exposed/methodology/referrer-policy", "fixUrl": "https://defaults.exposed/fix/referrer-policy", "prevalence": { "asOf": "2026-09-05", "label": "send a Referrer-Policy header", "numerator": 9952036, "denominator": 125815036, "denominatorLabel": "domains whose page returned a 2xx response", "percent": 7.9101 } }, { "id": "coop-header", "name": "COOP (Cross-Origin-Opener-Policy)", "category": "Web Security", "status": "informational", "whatItTests": "Advanced isolation that hardens against cross-site data leaks.", "pass": "The site sends a Cross-Origin-Opener-Policy header.", "fail": "The header is absent.", "example": "Cross-Origin-Opener-Policy: same-origin", "url": "https://defaults.exposed/methodology/coop-header", "fixUrl": "https://defaults.exposed/fix/cross-origin-headers", "prevalence": null }, { "id": "corp-header", "name": "CORP (Cross-Origin-Resource-Policy)", "category": "Web Security", "status": "informational", "whatItTests": "Advanced isolation that hardens against cross-site data leaks.", "pass": "The site sends a Cross-Origin-Resource-Policy header.", "fail": "The header is absent.", "example": "Cross-Origin-Resource-Policy: same-origin", "url": "https://defaults.exposed/methodology/corp-header", "fixUrl": "https://defaults.exposed/fix/cross-origin-headers", "prevalence": null }, { "id": "coep-header", "name": "COEP (Cross-Origin-Embedder-Policy)", "category": "Web Security", "status": "informational", "whatItTests": "Advanced isolation that hardens against cross-site data leaks.", "pass": "The site sends a Cross-Origin-Embedder-Policy header.", "fail": "The header is absent.", "example": "Cross-Origin-Embedder-Policy: require-corp", "url": "https://defaults.exposed/methodology/coep-header", "fixUrl": "https://defaults.exposed/fix/cross-origin-headers", "prevalence": null }, { "id": "caa-record", "name": "CAA records", "category": "DNS Security", "status": "scored", "whatItTests": "Stops anyone but your chosen provider issuing SSL certificates for your domain.", "pass": "The domain publishes at least one CAA record restricting certificate issuance.", "fail": "No CAA records are published (any CA may issue).", "example": "example.com. IN CAA 0 issue \"letsencrypt.org\"", "url": "https://defaults.exposed/methodology/caa-record", "fixUrl": "https://defaults.exposed/fix/caa", "prevalence": { "asOf": "2026-09-05", "label": "publish a CAA record", "numerator": 4325806, "denominator": 313913664, "denominatorLabel": "graded domains", "percent": 1.378 } }, { "id": "dnssec-ds", "name": "DNSSEC (DS)", "category": "DNS Security", "status": "scored", "whatItTests": "Stops attackers hijacking your domain to send visitors to a fake copy of your site.", "pass": "A DS record exists at the parent zone, anchoring the DNSSEC chain of trust.", "fail": "No DS record exists (the zone is unsigned from the parent’s view), or the chain is broken.", "example": "example.com. IN DS 12345 13 2 A1B2C3…", "url": "https://defaults.exposed/methodology/dnssec-ds", "fixUrl": "https://defaults.exposed/fix/dnssec", "prevalence": { "asOf": "2026-09-05", "label": "have a valid, fully validating DNSSEC chain", "numerator": 21732692, "denominator": 316600902, "denominatorLabel": "graded domains", "percent": 6.8644, "note": "The census reports DNSSEC as a single signed-and-validating measure: not split into DS vs DNSKEY. A further share are signed but broken." } }, { "id": "dnssec-dnskey", "name": "DNSSEC (DNSKEY)", "category": "DNS Security", "status": "scored", "whatItTests": "The signing key that makes DNSSEC protection actually work.", "pass": "The zone publishes DNSKEY records that validate against the DS record.", "fail": "DNSKEY is missing or does not validate (signed-but-broken).", "example": "example.com. IN DNSKEY 257 3 13 mdsswUyr…", "url": "https://defaults.exposed/methodology/dnssec-dnskey", "fixUrl": "https://defaults.exposed/fix/dnssec", "prevalence": { "asOf": "2026-09-05", "label": "have a valid, fully validating DNSSEC chain", "numerator": 21732692, "denominator": 316600902, "denominatorLabel": "graded domains", "percent": 6.8644, "note": "The census reports DNSSEC as a single signed-and-validating measure: not split into DS vs DNSKEY. A further share are signed but broken." } }, { "id": "nameserver-diversity", "name": "Nameserver diversity", "category": "DNS Security", "status": "scored", "whatItTests": "Multiple independent nameservers so one outage doesn't take you offline.", "pass": "The domain delegates to two or more nameservers with meaningful diversity.", "fail": "A single nameserver (or no redundancy) serves the zone.", "example": "NS: ns1.example-dns.com, ns2.example-dns.net", "url": "https://defaults.exposed/methodology/nameserver-diversity", "fixUrl": "https://defaults.exposed/fix/nameservers", "prevalence": null }, { "id": "soa-configuration", "name": "SOA configuration", "category": "DNS Security", "status": "scored", "whatItTests": "A correctly configured DNS \"start of authority\" record.", "pass": "The zone’s SOA record exists with sane timing values (refresh/retry/expire/minimum).", "fail": "The SOA record is missing or misconfigured.", "example": "example.com. IN SOA ns1.example.com. hostmaster.example.com. ( … )", "url": "https://defaults.exposed/methodology/soa-configuration", "fixUrl": "https://defaults.exposed/fix/nameservers", "prevalence": null }, { "id": "ipv6-support", "name": "IPv6 support", "category": "Infrastructure", "status": "informational", "whatItTests": "Reachable over the modern internet protocol.", "pass": "The domain publishes an AAAA record (IPv6 address).", "fail": "No AAAA record is published.", "example": "example.com. IN AAAA 2001:db8::1", "url": "https://defaults.exposed/methodology/ipv6-support", "fixUrl": "https://defaults.exposed/fix/ipv6", "prevalence": { "asOf": "2026-09-05", "label": "publish an AAAA (IPv6) record", "numerator": 69055623, "denominator": 316600902, "denominatorLabel": "graded domains", "percent": 21.8116, "note": "AAAA-presence measured from raw DNS records, scaled to the deduped graded denominator." } }, { "id": "cdn-waf-detection", "name": "CDN / WAF detection", "category": "Infrastructure", "status": "informational", "whatItTests": "Whether a content-delivery network / web-application firewall is protecting your site.", "pass": "Informational fingerprint: reports which CDN/WAF (if any) fronts the site; never moves the grade.", "fail": "Not applicable (informational: no fail state).", "example": "Response fingerprint indicates a CDN in front of the origin", "url": "https://defaults.exposed/methodology/cdn-waf-detection", "fixUrl": "https://defaults.exposed/fix/infrastructure", "prevalence": null }, { "id": "hosting-provider", "name": "Hosting provider", "category": "Infrastructure", "status": "informational", "whatItTests": "Identifies where your site is hosted.", "pass": "Informational fingerprint: reports the hosting provider/ASN; never moves the grade.", "fail": "Not applicable (informational: no fail state).", "example": "Origin IP resolves to a hosting provider ASN", "url": "https://defaults.exposed/methodology/hosting-provider", "fixUrl": "https://defaults.exposed/fix/infrastructure", "prevalence": null } ] }