Defaults.Exposed › Research

Research

Original data on how the world's businesses protect their domains: from our ongoing census of 332 million graded domains. Free to read and cite. Data as of 2026-10-12.

Across every dataset below, 74.3% of domains score grade F, effectively unprotected against email spoofing. Only 2.4% reach a secure A or B grade.

Published research

• City TLDs ranked: .berlin, .paris, .nyc and .london against their country codes
  October 2026: 25 of 26 city, regional and cultural TLDs (Top-Level Domains) have a higher F rate than their country code. Six beat it on DMARC (Domain-based Message Authentication, Reporting and Conformance) enforcement, eight on DNSSEC (Domain Name System Security Extensions).
• Only 64.5% of domains on Cloudflare nameservers are proxied
  Of 52,954,675 domains on Cloudflare nameservers, 64.5% answered through its proxy, 12.4% without it and 23.1% gave no answer. October 2026 census.
• CSP adoption has two numbers: which one to cite, and why
  Citing CSP (Content Security Policy) adoption? 10.45% of domains that sent headers carry a CSP header, and 2.85% carry one that constrains script. Cite the second, with its denominator.
• DKIM is not free with hosted mail
  64.9% of Google Workspace and Microsoft 365 domains had no DKIM (DomainKeys Identified Mail) key at their provider's selector in the October 2026 census.
• The DMARC records sitting at p=none that never asked for a report
  rua= is the DMARC tag that names where aggregate reports go. A p=none record without it asks for nothing, so nothing arrives. Add it, then read a fortnight.
• Most Content-Security-Policy headers are not content security policies
  Test your own header: a CSP without default-src or script-src constrains no script, and 27.26% of CSP headers in the October 2026 census have either.
• Domain dark matter: 28.8 million domains delegated but never graded
  The October 2026 census scanned 361.3 million domains that exist and graded 332.5 million; the 28.8 million in between never gave a gradable answer.
• 63% of the internet's failing domains are within twenty points of a pass
  Got an F on your own scan? Read the score under it: 62.89% of F-graded domains score 40 to 59, within twenty points of the 60 mark where F ends.
• What is a google-site-verification TXT record, and how many domains publish one?
  A google-site-verification TXT (Text) record is an inert ownership proof for a Google property. 30,511,620 domains carry one, and it is safe to leave in place.
• 87,922 .gov domains, eight years after the BOD 18-01 deadline
  Of 1,099 live federal executive .gov domains, 89.3% publish DMARC p=reject. Of 1,322 state domains, 14.7% do. October 2026 census.
• How domains stack security controls, and where they stop
  Most graded domains carry one or two of the five controls the census measures, and 91.7 million publish SPF (Sender Policy Framework) but no DMARC record.
• How many TXT verification records does one domain carry?
  Most domains with a verification token in DNS (Domain Name System) carry exactly one; a small band carries three or more, and that's where unaccounted-for records live.
• How many domains carry a Microsoft 365 tenant marker, and how many route mail there today?
  8,456,816 domains carry an MS= tenant marker; 14,967,920 of 180,564,746 domains with MX (Mail Exchange) route mail to Microsoft 365. The two use different bases.
• Money moves by email on domains that can be spoofed
  Of 96,110 domains verified with Stripe, 33.7% enforce DMARC and 55.2% sit at p=none. DocuSign: 61.5%. October 2026 census.
• Ghost towns: where the census's dead domains cluster
  In October 2026 three country codes, .tk, .cf and .gq, hold most of the dead domains in the census. Among new gTLDs, .cfd leads, with 10.44% of its names dead.
• Not a website certificate: EKU, CA flags and missing names
  5.0% of 220,326,298 HTTPS (Hypertext Transfer Protocol Secure) leaves still list clientAuth. 3,825,822 are CA (Certificate Authority), nameless or non-server certificates. October 2026 census.
• One mail server and no spare? MX records across 162,982,584 mail domains
  44.5% of gTLD and 56.8% of ccTLD mail domains publish one MX record. At Microsoft 365 that is standard. 31,050,877 name a host of their own.
• How many domains have declared themselves to OpenAI?
  241,667 domains publish an openai-domain-verification TXT record at the apex, of the 174,990,877 with any apex TXT record in the October 2026 census.
• Security headers that do nothing: 183,766 domains send values the browser throws away
  183,766 domains send a security header value the browser discards, from ALLOWALL to SAMEORIGIN; with a stray semicolon. Counted in October 2026.
• What the web announces about itself: server and x-powered-by headers
  The most common Server header is cloudflare, 47,009,028 of 222,969,925 header-sending domains in the October 2026 census, and one config line trims the version from yours.
• One private key, 503,418 domains: the shared TLS certificates with the largest blast radius
  13.3% of 220,326,298 HTTPS domains present a certificate another apex also presents. One placeholder covers 503,418 of them. October 2026 census.
• Mailbox on one platform, sender authorised on another
  7,856,307 domains name one vendor in SPF and another in MX. Most are built that way; 761,259 have a mailbox their SPF record leaves out.
• The locked vault: the 1.3 million domains that close every door
  1,325,934 domains close all five of SPF, enforced DMARC, DNSSEC, HTTPS and HSTS (HTTP Strict Transport Security) at once in October 2026: about 1 in 251 of every graded domain.
• 87 million domains are three records away from a C
  Do the DMARC policy first, then the SPF fail qualifier, then HSTS. Three records are the shortest route from the top band of F to a C.
• unsafe-inline, and frame-ancestors versus X-Frame-Options: what the web sends
  unsafe-inline silences CSP errors by switching off the script guard; most counted policies only control framing. A nonce or hash restores the guard.
• The verification-token census: every third-party token in the internet's DNS, ranked
  The ranked table of DNS verification tokens: 46,336,520 domains carry one, out of 174,990,877 with any apex TXT record, over 1434 TLD partitions.
• One verification string, many domains: the portfolio census
  October 2026: 97.61% of 37,376,388 account-scoped verification records carry a value no other domain publishes. 16 values sit on over 1,000 domains.
• Where a country's email lives: Microsoft, Google and the domestic hosts, by ccTLD
  October 2026: Google and Microsoft receive mail for 17.2% of ccTLD mail domains, against 38.6% in the top million. OVHcloud holds 34.8% of .fr.
• Who answers for a nation: authoritative DNS dependency by ccTLD
  98.9% of ccTLD domains rely on one DNS operator. Six US operators run nameservers for 28.1%. The 60 largest ccTLDs ranked, October 2026 census.
• Whose name is on your certificate? 17,874,769 domains present someone else's
  17,874,769 HTTPS domains present a certificate in someone else's name. Ten defaults account for 16.9% of them. October 2026 census.
• Why the most visited domains on the internet score badly, and what the few A grades do differently
  We graded the 10,000 most visited domains on the same 33 checks as everyone else. Nearly 7 in 10 fall short of a B and 28.4% score F. What they get wrong, what the 731 A grades share, and why none of it says anything about your domain.

Exposure by country, by industry and by TLD is published as data rather than as a page: the October 2026 edition data carries the aggregates and the per-TLD CSV.

The current edition is the October 2026 census: the headline data, the 33-check methodology and the census explorer.

Figures are recomputed from the census on every update; each report shows its data's as-of date and a growing edition history for trends. How we grade →