63% of the internet's failing domains are within twenty points of a pass

You ran the scan, it came back F, and you’re reading the letter as a judgement on the whole domain. It isn’t one. F is the widest band on the scale, running from a score of 0 up to 59, and the domains inside it range from names with nothing published at all to domains a few records short of leaving the band. The letter says which band you’re in. The number under it says where in the band you stand, and for most F-graded domains that number sits a good deal higher than the letter suggests.

Nothing in your history moved the score. The scan reads what’s published on the domain today, checks it against a fixed list, and adds up the weight of what’s missing. A domain that has never had an incident can score 45, and a domain that has been sending phishing for a year can score 45 too, if the same records are absent from both. The grade describes what’s published today, so read it as a list of missing records, weighted by how much each one counts.

How the F band is spread

Of the 234,955,475 domains graded F in the September 2026 census, 148,448,223, or 63.18% of F, score between 40 and 59. That’s the top third of the band, and the twenty points in the title is the distance from there to the 60 mark, where F ends. Leaving the band is a different thing from reaching a C, which starts at 70.

At the other end, 6,548,446 domains, 2.79% of F, score under 10. Everything else sits between those two, thinning out towards the bottom. Laid out like that, most of the F band sits near the top, closer to the 60 mark than to zero.

That matters for how you read your own result. The scanner doesn’t grade on a curve, so where other domains sit has no effect on your number. The shape of the band tells you what kind of domain usually gets an F, and it’s usually a working one.

What a score in the forties or fifties describes

A domain in that band has infrastructure that answers. Its name resolves, its web server responds, most often over HTTPS with a certificate that validates, and there’s usually a mail exchanger listed. The checks that come free with hosting pass, because the hosting company did them.

The checks that fail are the ones someone has to publish by hand: a DMARC policy that does something, an SPF record that ends the right way, a DKIM selector the scan can find, an HSTS header, a CAA record and a signed zone. None of those arrive with a hosting plan, and in the 40 to 59 band they’re the things that weren’t added.

So a score of 52 describes a working domain where the security half of the setup never got finished. That’s the state most working domains are in, and it’s where most F grades land. The distinction from the bottom of the band is that your domain has something to build on, and the records below go on top of what’s already there.

The records that separate the band

The email checks carry the most weight in the grade, so they’re where the gap between 52 and 60 mostly lives, and they’re the first thing to read on your own result.

Start with DMARC. The check named dmarc-policy is the only one on the scanner’s list carrying the severity label critical, and in the September 2026 census findings it fails on 94.4% of F-graded domains. It fails when there’s no _dmarc TXT record at all, and it also fails when the record exists but reads p=none, which tells receiving mail servers to do nothing about messages that fail authentication. Either way, anyone can put your domain in the From line and the mail goes through, which is the situation can someone spoof my domain walks through in full.

Look yours up with dig +short TXT _dmarc.yourdomain, using your own domain in place of the placeholder. If the answer is empty, or reads v=DMARC1; p=none, that’s the record the check is failing on. A policy line that counts reads v=DMARC1; p=quarantine or v=DMARC1; p=reject, and adding rua=mailto: followed by an address you read turns on the reports that show you who’s sending as you. The DMARC pillar covers how to get from none to quarantine without losing your own mail on the way.

SPF is the second record. Run dig +short TXT yourdomain and find the string that begins v=spf1. The last token is the one the scan weighs. A record ending ~all is a soft fail, which most receivers treat as a suggestion; a record ending -all is a hard fail, which they treat as an instruction. The SPF pillar explains why the tilde is the default almost everywhere and what changes when you replace it with a dash.

Then DKIM. The scan looks for a signing selector on the domain, and if it can’t find one, dkim-exists fails. Your mail service publishes the key; you add the CNAME or TXT record it gives you at the name it gives you. If mail already arrives with a DKIM signature, the selector is in the message headers, in the s= tag of the DKIM-Signature line.

Those three are the ones worth checking before anything else, and the scan reads them back against your own domain in about a minute.

The web and DNS checks that fill in the rest

The email records move the score most, and the remaining checks are smaller weights that add up.

HSTS is a single response header, Strict-Transport-Security: max-age=31536000; includeSubDomains, sent by the web server on HTTPS responses. Without it the hsts-header check fails. Most web servers and most content delivery services have a one-line switch for it, and the header does nothing visible to visitors beyond stopping their browser from ever trying plain HTTP for your site again.

A CAA record is a DNS entry that says which certificate authorities may issue for your domain. It reads yourdomain. CAA 0 issue "the authority you use", and if you only use one, that’s one line. Its absence fails caa-record.

DNSSEC signs your zone so that resolvers can tell a real answer from a forged one. For most domains this is a setting at the registrar or the DNS host: turn signing on, publish the DS record at the registrar, wait for propagation. The check here is dnssec-ds, and unlike the records above, a half-finished DNSSEC setup can take a domain offline, so this one goes last and gets tested.

None of these is hard. Each is a specific line in a specific place, and the scan result tells you which ones your domain is missing.

Why no single record ends the F

Nothing in the September 2026 census shows one of the records above lifting a domain in the fifties into a pass on its own. No F-graded domain in the edition scores 60 or above, and no single check on the list carries enough weight to carry a domain in the fifties past the 70 that a C needs. A domain at 52 is within twenty points of the 60 mark where F ends, and each of the records above is one step across that gap.

So the shape of the work is a short list, done in order, with the email records at the top because they weigh most. The scan result already orders it for you. Read it top down, fix the first item, rescan, and the number moves. Fix the second, rescan, and it moves again. The letter changes when the number crosses 60, and the records that get you there are the same ones that stop your domain being used to send mail as you.

The abandoned end

The 6,548,446 domains scoring under 10 look nothing like yours. That end of the band is where nothing answers: no mail exchanger, a web server that’s absent or refuses the connection, no TXT records of any kind, often no address at the apex at all. These are parked names, and names somebody registered for a project that never started, or re-registered and then left.

A domain down there has nothing to finish. It would need to be built before it could be secured, and the score reflects that. If you’re reading this on the result screen of a domain you use, you have a working site or working mail or both, and that alone puts you above that floor. What separates you from the abandoned end is that somebody uses your domain.

On its own, an F sounds like the bottom. Against the spread, most F-graded domains are unfinished rather than broken, and yours is almost certainly one of them.

Which missing record is yours

The scan already knows. Its result lists each check by name, with the severity and the weight, and the failed ones with the heaviest weight sit at the top. For a domain in the 40 to 59 band that list nearly always begins with dmarc-policy, because 94.4% of F-graded domains fail it, and the fix is a TXT record you can write from the examples above.

Run the free scan on your domain and start with the first record in its failed list. When you’ve published it, rescan and read the new number.

Figures as of 5 September 2026, from the September 2026 edition of the defaults.exposed census. Census numbers move every month; the current values are on the census data page.