{
  "source": "Defaults.Exposed grading methodology",
  "methodologyVersion": "v7",
  "url": "https://defaults.exposed/methodology/v7",
  "license": "https://defaults.exposed/license",
  "censusAsOf": "2026-07-28",
  "gradedDomains": 275666275,
  "checkCount": 34,
  "scored": 25,
  "informational": 9,
  "categories": [
    "Email Security",
    "TLS & Certificates",
    "Web Security",
    "DNS Security",
    "Infrastructure"
  ],
  "gradeBands": {
    "A+": 95,
    "A": 90,
    "B": 80,
    "C": 70,
    "D": 60,
    "F": 0
  },
  "noDataRule": "Every check returns pass | fail | N/A. N/A (\"couldn't determine\": timeout, SERVFAIL, redacted source) is excluded from the scoring denominator — never counted as a failure. \"Determined absent\" is a real fail.",
  "notes": [
    "Check definitions are stable for methodology v7; prevalence figures refresh with each census.",
    "Prevalence is aggregate-only across the whole census — never an individual domain's result.",
    "prevalence: null means the public census rollup does not publish a per-check figure for that check."
  ],
  "checks": [
    {
      "id": "spf-exists",
      "name": "SPF record",
      "category": "Email Security",
      "status": "scored",
      "whatItTests": "Stops criminals sending email that looks like it's from you, and helps your mail reach the inbox.",
      "pass": "The domain publishes exactly one syntactically valid SPF TXT record (v=spf1 …).",
      "fail": "No SPF record is published, or the published record does not parse.",
      "example": "v=spf1 include:_spf.google.com -all",
      "url": "https://defaults.exposed/methodology/v7/spf-exists",
      "fixUrl": "https://defaults.exposed/en/fix/spf",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "publish a syntactically valid SPF record",
        "numerator": 138744955,
        "denominator": 275666275,
        "denominatorLabel": "graded domains",
        "percent": 50.3308,
        "note": "Invalid (unparseable) SPF records are counted separately and excluded from this pass share."
      }
    },
    {
      "id": "spf-policy-strength",
      "name": "SPF policy strength",
      "category": "Email Security",
      "status": "scored",
      "whatItTests": "A weak SPF only warns; a strict one actually blocks forgeries.",
      "pass": "The SPF record ends in a hardfail all-mechanism (-all), telling receivers to reject unauthorized senders.",
      "fail": "The record ends in ~all (softfail), ?all (neutral), or +all (permits anyone), or no SPF exists.",
      "example": "v=spf1 include:_spf.example-mailer.com -all",
      "url": "https://defaults.exposed/methodology/v7/spf-policy-strength",
      "fixUrl": "https://defaults.exposed/en/fix/spf",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "publish SPF with a hardfail (-all) policy",
        "numerator": 55335121,
        "denominator": 275666275,
        "denominatorLabel": "graded domains",
        "percent": 20.0732,
        "note": "Softfail (~all) records count toward SPF presence but not full policy strength."
      }
    },
    {
      "id": "dmarc-policy",
      "name": "DMARC policy",
      "category": "Email Security",
      "status": "scored",
      "whatItTests": "The instruction that tells mail providers to reject impersonated email — the core anti-spoofing control.",
      "pass": "A valid DMARC record at _dmarc.<domain> with an enforcing policy (p=quarantine or p=reject).",
      "fail": "No DMARC record, an unparseable record, or a monitor-only policy (p=none) which observes but does not block.",
      "example": "v=DMARC1; p=reject; rua=mailto:dmarc@example.com",
      "url": "https://defaults.exposed/methodology/v7/dmarc-policy",
      "fixUrl": "https://defaults.exposed/en/fix/dmarc",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "publish an enforcing DMARC policy (p=quarantine or p=reject)",
        "numerator": 32637258,
        "denominator": 275666275,
        "denominatorLabel": "graded domains",
        "percent": 11.8394,
        "note": "A further share publish a monitor-only p=none record; that counts as a DMARC record but not enforcement."
      }
    },
    {
      "id": "dmarc-reporting",
      "name": "DMARC reporting",
      "category": "Email Security",
      "status": "scored",
      "whatItTests": "Reports who's sending mail as you, so you spot abuse and misconfiguration.",
      "pass": "The DMARC record includes an aggregate-report address (rua=mailto:…) so the owner receives spoofing reports.",
      "fail": "The DMARC record has no rua reporting address, or no DMARC record exists.",
      "example": "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com",
      "url": "https://defaults.exposed/methodology/v7/dmarc-reporting",
      "fixUrl": "https://defaults.exposed/en/fix/dmarc",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "publish a DMARC record with an aggregate-reporting (rua) address",
        "numerator": 28008788,
        "denominator": 275666275,
        "denominatorLabel": "graded domains",
        "percent": 10.1604
      }
    },
    {
      "id": "dkim-exists",
      "name": "DKIM",
      "category": "Email Security",
      "status": "scored",
      "whatItTests": "A cryptographic signature proving mail is genuinely from you; boosts deliverability.",
      "pass": "A DKIM public key is discoverable at a common selector under _domainkey.<domain>.",
      "fail": "No DKIM selector is observable at the probed selectors.",
      "example": "selector1._domainkey.example.com TXT \"v=DKIM1; k=rsa; p=MIIBIjANBg…\"",
      "url": "https://defaults.exposed/methodology/v7/dkim-exists",
      "fixUrl": "https://defaults.exposed/en/fix/dkim",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "have a discoverable DKIM selector",
        "numerator": 37762161,
        "denominator": 73825298,
        "denominatorLabel": "graded domains",
        "percent": 51.1507,
        "note": "Selector discovery is best-effort: an unobserved selector does not prove DKIM is unused, so this is a lower bound."
      }
    },
    {
      "id": "mx-record",
      "name": "MX records",
      "category": "Email Security",
      "status": "scored",
      "whatItTests": "Whether your domain is correctly set up to receive email at all.",
      "pass": "The domain publishes at least one resolvable MX record.",
      "fail": "No MX records are published (mail to the domain cannot be routed normally).",
      "example": "example.com. 3600 IN MX 10 mail.example.com.",
      "url": "https://defaults.exposed/methodology/v7/mx-record",
      "fixUrl": "https://defaults.exposed/en/fix/mx",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "publish at least one MX record",
        "numerator": 163083218,
        "denominator": 163230702,
        "denominatorLabel": "graded domains",
        "percent": 99.9096
      }
    },
    {
      "id": "reverse-dns",
      "name": "Reverse DNS (PTR)",
      "category": "Email Security",
      "status": "scored",
      "whatItTests": "Helps your mail server look legitimate so messages aren't junked.",
      "pass": "The domain's mail-relevant IP has a PTR (reverse DNS) record.",
      "fail": "No PTR record exists for the address.",
      "example": "10.0.113.203.in-addr.arpa. PTR mail.example.com.",
      "url": "https://defaults.exposed/methodology/v7/reverse-dns",
      "fixUrl": "https://defaults.exposed/en/fix/reverse-dns",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "have a PTR (reverse DNS) record",
        "numerator": 123435576,
        "denominator": 161866528,
        "denominatorLabel": "graded domains",
        "percent": 76.2576
      }
    },
    {
      "id": "https-available",
      "name": "HTTPS available",
      "category": "TLS & Certificates",
      "status": "scored",
      "whatItTests": "Without it, browsers warn visitors \"Not secure\" and they leave.",
      "pass": "The site serves content over HTTPS (TLS handshake completes and a response is returned).",
      "fail": "The site is reachable over plain HTTP only, or HTTPS connections fail.",
      "example": "https://example.com/ → HTTP 200 over TLS",
      "url": "https://defaults.exposed/methodology/v7/https-available",
      "fixUrl": "https://defaults.exposed/en/fix/https",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "serve over HTTPS",
        "numerator": 210439319,
        "denominator": 275666275,
        "denominatorLabel": "graded domains",
        "percent": 76.3384
      }
    },
    {
      "id": "cert-valid",
      "name": "Certificate valid",
      "category": "TLS & Certificates",
      "status": "scored",
      "whatItTests": "A trusted, correctly-issued certificate; an invalid one throws scary browser warnings.",
      "pass": "The presented certificate chain validates to a trusted root, matches the hostname, and is within its validity period.",
      "fail": "The certificate is self-signed, expired, name-mismatched, or otherwise fails validation.",
      "example": "CN=example.com, issued by a publicly trusted CA, chain validates",
      "url": "https://defaults.exposed/methodology/v7/cert-valid",
      "fixUrl": "https://defaults.exposed/en/fix/certificate",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "present a valid, trusted certificate",
        "numerator": 191943322,
        "denominator": 210439319,
        "denominatorLabel": "HTTPS-serving domains",
        "percent": 91.2108
      }
    },
    {
      "id": "cert-expiry-warning",
      "name": "Certificate expiry",
      "category": "TLS & Certificates",
      "status": "scored",
      "whatItTests": "A certificate about to expire takes your site offline with a full-page warning.",
      "pass": "The certificate's notAfter date is comfortably in the future (not expired, not inside the imminent-expiry window).",
      "fail": "The certificate is expired or expires imminently.",
      "example": "Not After: a date well beyond the scan date",
      "url": "https://defaults.exposed/methodology/v7/cert-expiry-warning",
      "fixUrl": "https://defaults.exposed/en/fix/certificate",
      "prevalence": null
    },
    {
      "id": "cert-signature-algorithm",
      "name": "Signature algorithm",
      "category": "TLS & Certificates",
      "status": "scored",
      "whatItTests": "Uses a modern, unbroken signing algorithm (not legacy SHA-1).",
      "pass": "The certificate is signed with a modern algorithm (SHA-256 family or better).",
      "fail": "The certificate is signed with a deprecated algorithm such as SHA-1 or MD5.",
      "example": "Signature Algorithm: sha256WithRSAEncryption",
      "url": "https://defaults.exposed/methodology/v7/cert-signature-algorithm",
      "fixUrl": "https://defaults.exposed/en/fix/certificate",
      "prevalence": null
    },
    {
      "id": "cert-key-strength",
      "name": "Key strength",
      "category": "TLS & Certificates",
      "status": "scored",
      "whatItTests": "Adequate key length so the encryption can't be brute-forced.",
      "pass": "The certificate public key meets modern strength baselines (e.g. RSA ≥ 2048-bit or an equivalent EC key).",
      "fail": "The key is below the baseline (e.g. RSA 1024-bit).",
      "example": "Public key: RSA 2048-bit (or EC P-256)",
      "url": "https://defaults.exposed/methodology/v7/cert-key-strength",
      "fixUrl": "https://defaults.exposed/en/fix/certificate",
      "prevalence": null
    },
    {
      "id": "tls-version",
      "name": "TLS version",
      "category": "TLS & Certificates",
      "status": "scored",
      "whatItTests": "Modern TLS (1.2/1.3); old versions are broken and fail security reviews.",
      "pass": "The server negotiates TLS 1.2 or TLS 1.3.",
      "fail": "Only legacy protocol versions (TLS 1.0/1.1 or older) are negotiated.",
      "example": "Negotiated protocol: TLS 1.3",
      "url": "https://defaults.exposed/methodology/v7/tls-version",
      "fixUrl": "https://defaults.exposed/en/fix/tls",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "negotiate TLS 1.2 or 1.3",
        "numerator": 210439319,
        "denominator": 210439319,
        "denominatorLabel": "HTTPS-serving domains",
        "percent": 100,
        "note": "Negotiated-version distribution: the remainder is unidentified negotiations; legacy 1.0/1.1 shares are not enumerable in this rollup."
      }
    },
    {
      "id": "cipher-strength",
      "name": "Cipher strength",
      "category": "TLS & Certificates",
      "status": "scored",
      "whatItTests": "Strong encryption protecting data in transit.",
      "pass": "The negotiated cipher suite is a modern AEAD suite (e.g. AES-GCM or ChaCha20-Poly1305).",
      "fail": "A weak or deprecated cipher (RC4, 3DES, export-grade, CBC-only legacy suites) is negotiated.",
      "example": "Cipher: TLS_AES_128_GCM_SHA256",
      "url": "https://defaults.exposed/methodology/v7/cipher-strength",
      "fixUrl": "https://defaults.exposed/en/fix/tls",
      "prevalence": null
    },
    {
      "id": "tls-compression",
      "name": "TLS compression",
      "category": "TLS & Certificates",
      "status": "informational",
      "whatItTests": "Compression disabled to avoid a known attack class (CRIME).",
      "pass": "TLS-level compression is disabled.",
      "fail": "TLS compression is enabled.",
      "example": "Compression: NONE",
      "url": "https://defaults.exposed/methodology/v7/tls-compression",
      "fixUrl": "https://defaults.exposed/en/fix/tls",
      "prevalence": null
    },
    {
      "id": "ocsp-stapling",
      "name": "OCSP stapling",
      "category": "TLS & Certificates",
      "status": "informational",
      "whatItTests": "Faster, more private certificate-revocation checks.",
      "pass": "The server staples a current OCSP response into the TLS handshake.",
      "fail": "No OCSP response is stapled (clients must query the CA themselves).",
      "example": "OCSP response: stapled, status good",
      "url": "https://defaults.exposed/methodology/v7/ocsp-stapling",
      "fixUrl": "https://defaults.exposed/en/fix/tls",
      "prevalence": null
    },
    {
      "id": "secure-renegotiation",
      "name": "Secure renegotiation",
      "category": "TLS & Certificates",
      "status": "informational",
      "whatItTests": "Protects against a TLS renegotiation attack.",
      "pass": "The server supports the secure renegotiation extension (RFC 5746).",
      "fail": "Only legacy (insecure) renegotiation is supported.",
      "example": "Secure Renegotiation IS supported",
      "url": "https://defaults.exposed/methodology/v7/secure-renegotiation",
      "fixUrl": "https://defaults.exposed/en/fix/tls",
      "prevalence": null
    },
    {
      "id": "hsts-header",
      "name": "HSTS",
      "category": "Web Security",
      "status": "scored",
      "whatItTests": "Forces the secure padlock every visit so customers can't be downgraded to an insecure connection.",
      "pass": "The site sends a Strict-Transport-Security header with a meaningful max-age.",
      "fail": "No HSTS header is sent over HTTPS.",
      "example": "Strict-Transport-Security: max-age=31536000; includeSubDomains",
      "url": "https://defaults.exposed/methodology/v7/hsts-header",
      "fixUrl": "https://defaults.exposed/en/fix/hsts",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "send an HSTS header",
        "numerator": 40232423,
        "denominator": 210439319,
        "denominatorLabel": "HTTPS-serving domains",
        "percent": 19.1183
      }
    },
    {
      "id": "http-to-https-redirect",
      "name": "HTTP→HTTPS redirect",
      "category": "Web Security",
      "status": "scored",
      "whatItTests": "Sends visitors who arrive on http straight to the secure version.",
      "pass": "Requests to http://<domain> are redirected (301/302/307/308) to the https:// origin.",
      "fail": "Plain-HTTP requests are served content without redirecting to HTTPS.",
      "example": "http://example.com/ → 301 → https://example.com/",
      "url": "https://defaults.exposed/methodology/v7/http-to-https-redirect",
      "fixUrl": "https://defaults.exposed/en/fix/https",
      "prevalence": null
    },
    {
      "id": "csp-header",
      "name": "Content-Security-Policy",
      "category": "Web Security",
      "status": "scored",
      "whatItTests": "Reduces the chance a hacked or injected script steals customer data off your site.",
      "pass": "The site sends an effective Content-Security-Policy header.",
      "fail": "No CSP header is sent.",
      "example": "Content-Security-Policy: default-src 'self'",
      "url": "https://defaults.exposed/methodology/v7/csp-header",
      "fixUrl": "https://defaults.exposed/en/fix/csp",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "send an effective Content-Security-Policy header",
        "numerator": 10409054,
        "denominator": 275666275,
        "denominatorLabel": "graded domains",
        "percent": 3.776
      }
    },
    {
      "id": "x-frame-options",
      "name": "Clickjacking protection",
      "category": "Web Security",
      "status": "scored",
      "whatItTests": "Stops attackers embedding your site to trick your customers into clicking things.",
      "pass": "The site sends X-Frame-Options (DENY/SAMEORIGIN) or a CSP frame-ancestors directive.",
      "fail": "Neither header is sent — the site can be framed by any origin.",
      "example": "X-Frame-Options: DENY",
      "url": "https://defaults.exposed/methodology/v7/x-frame-options",
      "fixUrl": "https://defaults.exposed/en/fix/clickjacking",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "send clickjacking protection (X-Frame-Options or CSP frame-ancestors)",
        "numerator": 15615625,
        "denominator": 275666275,
        "denominatorLabel": "graded domains",
        "percent": 5.6647
      }
    },
    {
      "id": "x-content-type-options",
      "name": "MIME-sniffing protection",
      "category": "Web Security",
      "status": "scored",
      "whatItTests": "Stops browsers mis-reading files in ways attackers can abuse.",
      "pass": "The site sends X-Content-Type-Options: nosniff.",
      "fail": "The header is absent.",
      "example": "X-Content-Type-Options: nosniff",
      "url": "https://defaults.exposed/methodology/v7/x-content-type-options",
      "fixUrl": "https://defaults.exposed/en/fix/mime-sniffing",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "send X-Content-Type-Options: nosniff",
        "numerator": 20058145,
        "denominator": 275666275,
        "denominatorLabel": "graded domains",
        "percent": 7.2762
      }
    },
    {
      "id": "referrer-policy",
      "name": "Referrer-Policy",
      "category": "Web Security",
      "status": "scored",
      "whatItTests": "Controls what address info leaks to other sites when visitors click away.",
      "pass": "The site sends a Referrer-Policy header.",
      "fail": "The header is absent.",
      "example": "Referrer-Policy: strict-origin-when-cross-origin",
      "url": "https://defaults.exposed/methodology/v7/referrer-policy",
      "fixUrl": "https://defaults.exposed/en/fix/referrer-policy",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "send a Referrer-Policy header",
        "numerator": 8245565,
        "denominator": 275666275,
        "denominatorLabel": "graded domains",
        "percent": 2.9911
      }
    },
    {
      "id": "coop-header",
      "name": "COOP (Cross-Origin-Opener-Policy)",
      "category": "Web Security",
      "status": "informational",
      "whatItTests": "Advanced isolation that hardens against cross-site data leaks.",
      "pass": "The site sends a Cross-Origin-Opener-Policy header.",
      "fail": "The header is absent.",
      "example": "Cross-Origin-Opener-Policy: same-origin",
      "url": "https://defaults.exposed/methodology/v7/coop-header",
      "fixUrl": "https://defaults.exposed/en/fix/cross-origin-headers",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "send a Cross-Origin-Opener-Policy header",
        "numerator": 2900221,
        "denominator": 275666275,
        "denominatorLabel": "graded domains",
        "percent": 1.0521,
        "note": "Header presence measured from raw HTTP headers, scaled to the deduped graded denominator; the three cross-origin measures overlap."
      }
    },
    {
      "id": "corp-header",
      "name": "CORP (Cross-Origin-Resource-Policy)",
      "category": "Web Security",
      "status": "informational",
      "whatItTests": "Advanced isolation that hardens against cross-site data leaks.",
      "pass": "The site sends a Cross-Origin-Resource-Policy header.",
      "fail": "The header is absent.",
      "example": "Cross-Origin-Resource-Policy: same-origin",
      "url": "https://defaults.exposed/methodology/v7/corp-header",
      "fixUrl": "https://defaults.exposed/en/fix/cross-origin-headers",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "send a Cross-Origin-Resource-Policy header",
        "numerator": 2449105,
        "denominator": 275666275,
        "denominatorLabel": "graded domains",
        "percent": 0.8884,
        "note": "Header presence measured from raw HTTP headers, scaled to the deduped graded denominator; the three cross-origin measures overlap."
      }
    },
    {
      "id": "coep-header",
      "name": "COEP (Cross-Origin-Embedder-Policy)",
      "category": "Web Security",
      "status": "informational",
      "whatItTests": "Advanced isolation that hardens against cross-site data leaks.",
      "pass": "The site sends a Cross-Origin-Embedder-Policy header.",
      "fail": "The header is absent.",
      "example": "Cross-Origin-Embedder-Policy: require-corp",
      "url": "https://defaults.exposed/methodology/v7/coep-header",
      "fixUrl": "https://defaults.exposed/en/fix/cross-origin-headers",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "send a Cross-Origin-Embedder-Policy header",
        "numerator": 1880489,
        "denominator": 275666275,
        "denominatorLabel": "graded domains",
        "percent": 0.6822,
        "note": "Header presence measured from raw HTTP headers, scaled to the deduped graded denominator; the three cross-origin measures overlap."
      }
    },
    {
      "id": "caa-record",
      "name": "CAA records",
      "category": "DNS Security",
      "status": "scored",
      "whatItTests": "Stops anyone but your chosen provider issuing SSL certificates for your domain.",
      "pass": "The domain publishes at least one CAA record restricting certificate issuance.",
      "fail": "No CAA records are published (any CA may issue).",
      "example": "example.com. IN CAA 0 issue \"letsencrypt.org\"",
      "url": "https://defaults.exposed/methodology/v7/caa-record",
      "fixUrl": "https://defaults.exposed/en/fix/caa",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "publish a CAA record",
        "numerator": 4219518,
        "denominator": 274068857,
        "denominatorLabel": "graded domains",
        "percent": 1.5396
      }
    },
    {
      "id": "dnssec-ds",
      "name": "DNSSEC (DS)",
      "category": "DNS Security",
      "status": "scored",
      "whatItTests": "Stops attackers hijacking your domain to send visitors to a fake copy of your site.",
      "pass": "A DS record exists at the parent zone, anchoring the DNSSEC chain of trust.",
      "fail": "No DS record exists (the zone is unsigned from the parent’s view), or the chain is broken.",
      "example": "example.com. IN DS 12345 13 2 A1B2C3…",
      "url": "https://defaults.exposed/methodology/v7/dnssec-ds",
      "fixUrl": "https://defaults.exposed/en/fix/dnssec",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "have a valid, fully validating DNSSEC chain",
        "numerator": 17317905,
        "denominator": 275666275,
        "denominatorLabel": "graded domains",
        "percent": 6.2822,
        "note": "The census reports DNSSEC as a single signed-and-validating measure — not split into DS vs DNSKEY. A further share are signed but broken."
      }
    },
    {
      "id": "dnssec-dnskey",
      "name": "DNSSEC (DNSKEY)",
      "category": "DNS Security",
      "status": "scored",
      "whatItTests": "The signing key that makes DNSSEC protection actually work.",
      "pass": "The zone publishes DNSKEY records that validate against the DS record.",
      "fail": "DNSKEY is missing or does not validate (signed-but-broken).",
      "example": "example.com. IN DNSKEY 257 3 13 mdsswUyr…",
      "url": "https://defaults.exposed/methodology/v7/dnssec-dnskey",
      "fixUrl": "https://defaults.exposed/en/fix/dnssec",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "have a valid, fully validating DNSSEC chain",
        "numerator": 17317905,
        "denominator": 275666275,
        "denominatorLabel": "graded domains",
        "percent": 6.2822,
        "note": "The census reports DNSSEC as a single signed-and-validating measure — not split into DS vs DNSKEY. A further share are signed but broken."
      }
    },
    {
      "id": "nameserver-diversity",
      "name": "Nameserver diversity",
      "category": "DNS Security",
      "status": "scored",
      "whatItTests": "Multiple independent nameservers so one outage doesn't take you offline.",
      "pass": "The domain delegates to two or more nameservers with meaningful diversity.",
      "fail": "A single nameserver (or no redundancy) serves the zone.",
      "example": "NS: ns1.example-dns.com, ns2.example-dns.net",
      "url": "https://defaults.exposed/methodology/v7/nameserver-diversity",
      "fixUrl": "https://defaults.exposed/en/fix/nameservers",
      "prevalence": null
    },
    {
      "id": "soa-configuration",
      "name": "SOA configuration",
      "category": "DNS Security",
      "status": "scored",
      "whatItTests": "A correctly configured DNS \"start of authority\" record.",
      "pass": "The zone’s SOA record exists with sane timing values (refresh/retry/expire/minimum).",
      "fail": "The SOA record is missing or misconfigured.",
      "example": "example.com. IN SOA ns1.example.com. hostmaster.example.com. ( … )",
      "url": "https://defaults.exposed/methodology/v7/soa-configuration",
      "fixUrl": "https://defaults.exposed/en/fix/nameservers",
      "prevalence": null
    },
    {
      "id": "ipv6-support",
      "name": "IPv6 support",
      "category": "DNS Security",
      "status": "informational",
      "whatItTests": "Reachable over the modern internet protocol.",
      "pass": "The domain publishes an AAAA record (IPv6 address).",
      "fail": "No AAAA record is published.",
      "example": "example.com. IN AAAA 2001:db8::1",
      "url": "https://defaults.exposed/methodology/v7/ipv6-support",
      "fixUrl": "https://defaults.exposed/en/fix/ipv6",
      "prevalence": {
        "asOf": "2026-07-28",
        "label": "publish an AAAA (IPv6) record",
        "numerator": 63815952,
        "denominator": 275666275,
        "denominatorLabel": "graded domains",
        "percent": 23.1497,
        "note": "AAAA-presence measured from raw DNS records, scaled to the deduped graded denominator."
      }
    },
    {
      "id": "cdn-waf-detection",
      "name": "CDN / WAF detection",
      "category": "Infrastructure",
      "status": "informational",
      "whatItTests": "Whether a content-delivery network / web-application firewall is protecting your site.",
      "pass": "Informational fingerprint — reports which CDN/WAF (if any) fronts the site; never moves the grade.",
      "fail": "Not applicable (informational — no fail state).",
      "example": "Response fingerprint indicates a CDN in front of the origin",
      "url": "https://defaults.exposed/methodology/v7/cdn-waf-detection",
      "fixUrl": "https://defaults.exposed/en/fix/infrastructure",
      "prevalence": null
    },
    {
      "id": "hosting-provider",
      "name": "Hosting provider",
      "category": "Infrastructure",
      "status": "informational",
      "whatItTests": "Identifies where your site is hosted.",
      "pass": "Informational fingerprint — reports the hosting provider/ASN; never moves the grade.",
      "fail": "Not applicable (informational — no fail state).",
      "example": "Origin IP resolves to a hosting provider ASN",
      "url": "https://defaults.exposed/methodology/v7/hosting-provider",
      "fixUrl": "https://defaults.exposed/en/fix/infrastructure",
      "prevalence": null
    }
  ]
}