Defaults.Exposed › Research
Research
Original data on how the world's businesses protect their domains: from our ongoing census of 317 million+ graded domains. Free to read and cite. Data as of 2026-09-05.
Across every dataset below, 74.2% of domains score grade F, effectively unprotected against email spoofing. Only 2.2% reach a secure A–B grade.
- Our CSP adoption number was measuring the wrong thing, and here is the corrected one
10.01% of domains that sent headers carry a CSP header; 2.49% carry one that constrains script. Cite the second, with its denominator. - The DMARC records sitting at p=none that never asked for a report
rua= is the DMARC tag that names where aggregate reports go. A p=none record without it asks for nothing, so nothing arrives. Add it, then read a fortnight. - Most Content-Security-Policy headers are not content security policies
A CSP without default-src or script-src constrains no script; only 24.86% of the CSP headers in the September 2026 census have either. - 63% of the internet's failing domains are within twenty points of a pass
An F is a range: 63.18% of the domains graded F score 40 to 59, within twenty points of the 60 mark where F ends, with records unfinished rather than absent. - What is a google-site-verification TXT record, and how many domains publish one?
A google-site-verification TXT record is an inert ownership proof for a Google property. 29,145,803 domains carry one, and it is safe to leave in place. - Only 2.79% of failing domains score under ten
Only 2.79% of the 234,955,475 F-graded domains score under ten; 63.18% sit at 40 to 59, live sites a few DNS records short of a pass. - How many TXT verification records does one domain carry?
Most domains with a verification token in DNS carry exactly one; a small band carries three or more, and that's where unaccounted-for records live. - How many domains carry a Microsoft 365 tenant marker, and how many route mail there today?
8,218,984 domains carry an MS= tenant marker; 14,697,578 of 173,425,856 domains with MX route mail to Microsoft 365. Two signals, two denominators. - How many domains have declared themselves to OpenAI?
230,938 domains publish an openai-domain-verification TXT record at the apex, of the 167,692,006 with any apex TXT record in the September 2026 census. - What the web announces about itself: server and x-powered-by headers
The most common Server header is cloudflare, 44,468,182 of 214,006,060 header-sending domains in the September 2026 census, and one config line hides yours. - How many domains show a Stripe verification record?
92,560 domains publish a stripe-verification TXT record at the apex: 0.06% of the 167,692,006 domains with an apex TXT record, seen in 381 TLDs. - 83 million domains are three records away from a C
Do the DMARC policy first, then the SPF fail qualifier, then HSTS. Three records are the shortest honest route from the top band of F to a C. - unsafe-inline, and frame-ancestors versus X-Frame-Options: what the web sends
unsafe-inline silences CSP errors by switching off the script guard; most counted policies only control framing. A nonce or hash restores the guard. - The verification-token census: every third-party token in the internet's DNS, ranked
The ranked table of DNS verification tokens: 44,285,266 domains carry one, out of 167,692,006 with any apex TXT record, over 1285 TLD partitions. - Zoho, Meta, Atlassian, Canva, Klaviyo: the long tail of domain verification, counted
The exact apex TXT verification strings 22 services publish, counted over 167,692,006 domains with a TXT record, with the vendors that use two strings named.
Exposure by country, by industry and by TLD is published as data rather than as a page: the September 2026 edition data carries the aggregates and the per-TLD CSV.
The current edition: August 2026 census — State of the Internet reports, pinned headline data and the 34-check methodology.
Figures are recomputed from the census on every update; each report shows its data's as-of date and a growing edition history for trends. How we grade →