Domain dark matter: 28.8 million domains delegated but never graded

The October 2026 census scanned 361,301,790 domains that exist, and it could grade 332,492,319 of them. The 28,809,471 in between are the ones that exist on paper and never gave the scanner a usable answer. We call them the internet’s dark matter: delegated and counted, and never graded.

What the gap is made of

The gap is 7.97% of the inventory, and it splits cleanly in two. About 13,607,529 domains were unreachable: the scanner could not complete the DNS (Domain Name System) or connection work needed to grade them at all. Another 15,201,942 were indeterminate: they answered, but not consistently enough to resolve into a grade. Add those and you get 28,809,471, the exact distance between the inventory and the graded set. Against the inventory the two halves are close in size, 3.77% unreachable and 4.21% indeterminate.

None of the dark matter is dead. The 2,887,602 dead domains, 0.80% of the inventory, gave a definite result: the scan asked for their name servers, got a definitive empty answer, and no address or mail record resolved either. A domain in that state has published nothing, so the census grades it F and counts it inside the 332,492,319. The 332,492,319 is the 329,604,717 domains in the graded disposition plus those 2,887,602 dead ones. The dark matter is the rest: delegated names that a registry still lists and a nameserver still claims, which fall over or contradict themselves the moment anyone actually asks.

It is also separate from the names the census took out of the count. The sourced lists held 649,194,272 names. The census set aside 16,500,126 wildcard phantoms before the scan, and after the scan it removed 271,599,411 names that answered NXDOMAIN (Non-Existent Domain). Those were names that only a registry wildcard answered for, or names that do not exist. Every name in the dark matter does exist and has a delegation, which is why it is counted.

Where the dark matter sits

Split by kind of ending, following the IANA (Internet Assigned Numbers Authority) delegation type, the gap is widest in the new gTLDs and narrowest in the country codes:

The three groups account for 28,687,112 of the 28,809,471. The other 122,359 sit in the 914 smaller endings the per-TLD file does not list.

By absolute size, .com holds the largest share of the dark matter: 13,398,300 of the 28,809,471, or 46.51%, close to its 46.29% share of the inventory. Next come .net with 1,225,133 (9.87% of its names), .xyz with 997,109 (9.38%), .org with 956,301 (7.85%), .cn with 915,534 (12.69%), .top with 760,996 (12.09%) and .online with 613,948 (17.11%). For comparison, .de, one of the largest country codes, has 325,321 in the gap, 2.46% of its names.

The highest rates sit in a few endings. Among new gTLDs with at least 100,000 names, .makeup has 53,501 of 113,144 in the gap (47.29%), .autos 51,007 of 156,866 (32.52%) and .icu 168,539 of 552,122 (30.53%). Among ccTLDs of that size, .ph has 63,481 of 141,841 (44.76%) and .gq 85,184 of 361,344 (23.57%). The census records where the gap sits; it does not record why a given registry’s names answer badly.

Indeterminate and unreachable are different failures

An unreachable name gave the scanner nothing: nothing behind the delegation answered at all. An indeterminate name returned something, then contradicted it, timed out on a step that had worked, or resolved through a delegation that answered some queries and not others. The scan went back to every domain its first pass could not settle, so a single timeout at a bad moment did not decide the result. The indeterminate names are the ones still unsettled after that. This is not a measure of uptime or of how often a domain answers, because the census does not probe a name repeatedly to clock its flakiness. A domain in this state has something unstable in its resolution path, most often a nameserver or a delegation that half-works.

The two states look alike from outside and behave differently by ending. .xyz has 851,472 names indeterminate (8.01%) and only 145,637 unreachable (1.37%), so its names mostly answer, and answer badly. Other endings show the reverse. .icu has 149,577 names unreachable (27.09%) and 18,962 indeterminate (3.43%), and .cn has 709,713 unreachable (9.84%) against 205,821 indeterminate (2.85%). Reading the two separately tells you whether an ending’s problem is names nobody serves or names served by something that does not agree with itself.

Why it matters when you read a headline

A grade share only means something against the population it was measured on. When a report says a share of the web fails a check, the denominator to use is the graded set, 332,492,319, because that is what the scanner could assess. Quote the same percentage against the full 361.3 million inventory and you have folded in 28.8 million domains nobody could grade. That moves the number without measuring anything. The how the domains were counted page carries the full accounting.

The uneven split makes this worse for comparisons between endings. A new gTLD share quoted against inventory carries 10.67% ungraded names, a ccTLD share only 5.95%. So two shares on the wrong denominator differ partly because of the dark matter alone. The TLD statistics page quotes grade shares on graded domains for that reason, and keeps country-code and generic endings apart.

The dark matter is also why census editions cannot be differenced as a trend. The October edition had no existence pass before the scan and removed the NXDOMAIN names after it, so the denominator itself changed from September’s. A drop in a failure share can come from a change in composition, with no change in how domains are set up.

What the census cannot see in the dark

Two questions about these names stay open in this edition. The first is mail. A delegated name that cannot be graded may still publish an MX (Mail Exchange) record and accept mail, and that would matter to anyone who receives it. The census only enumerated MX records for graded domains this round, so the count of dark names still accepting mail is recorded as unknown. The second is parking and sale pages, which would need the page body; the census keeps response headers and status only, so those counts are unknown too.

See your own

If your domain is in the graded set, the free scan shows its grade and the records behind it. If it is in the dark, the scan will show you where the resolution breaks, which is usually a nameserver or a delegation that no longer answers. A broken DNSSEC (Domain Name System Security Extensions) chain is one common cause: a resolver that validates gets SERVFAIL and treats the domain as unreachable, although it is registered and paid for. Name servers that time out do the same.

You can compare your name servers yourself. List them with dig +short NS yourdomain, using your own domain in place of the placeholder. Then ask each one directly for the zone’s SOA (Start of Authority) record, for example dig +short SOA yourdomain @ns1.yourprovider.example, once per name server. Every server should answer, and every answer should carry the same serial number. A server that times out, refuses, or returns an older serial is the kind of half-working delegation that leaves a domain unsettled. Check too that the name servers listed at your registrar match the ones your zone lists for itself. The name server and DNSSEC fix pages cover what to check at your DNS host and registrar.

Figures from the defaults.exposed census, data as of 12 October 2026. Census numbers move every month; the current values are on the data page.