Most failing domains are within twenty points of a pass

You ran the scan and it came back F. F is the widest band on the scale, running from a score of 0 up to 59, and the domains inside it range from names with nothing published at all to domains a few records short of leaving the band. The letter says which band you’re in. The number under it says where in the band you stand, and for most F-graded domains that number sits a good deal higher than the letter suggests.

Nothing in your history moved the score. The scan reads what’s published on the domain today, checks it against a fixed list, and adds up the weight of what’s missing. A domain that has never had an incident can score 45, and a domain that has been sending phishing for a year can score 45 too, if the same records are absent from both. The grade describes what’s published today, so read it as a list of missing records, weighted by how much each one counts.

This page is mostly for reading one result, your own. If you’re citing the headline instead, the section for anyone citing the headline reads the same October 2026 band counts from the floor up, to show whether “most domains fail” means abandoned or unfinished. Three records away from a C takes the top band, 50 to 59, and turns it into a fixing order. The headline F rate, 247,066,987 domains or 74.3% of the 332,492,319 carrying a grade, has its own page at what percent of domains fail security.

How the F band is spread

Of the 247,066,987 domains graded F in the census, 155,373,503, or 62.89% of F, score between 40 and 59. That’s the top third of the band, and the twenty points in the title is the distance from there to the 60 mark, where F ends. Leaving the band is a different thing from reaching a C, which starts at 70.

At the other end, 8,432,224 domains, 3.41% of F, score under 10. Everything else sits between those two, and not evenly: the band is heaviest at the top, with a second, smaller bump between 10 and 19, where more domains score than in the twenties.

That matters for how you read your own result. The scanner doesn’t grade on a curve, so where other domains sit has no effect on your number. The shape of the band tells you what kind of domain usually gets an F, and it’s usually a working one.

What a score in the forties or fifties describes

A domain in that band has infrastructure that answers. Its name resolves, its web server responds, most often over HTTPS (Hypertext Transfer Protocol Secure) with a certificate that validates, and there’s usually a mail exchanger listed. The checks that come free with hosting pass, because the hosting company did them.

The checks that fail are the ones someone has to publish by hand: a DMARC (Domain-based Message Authentication, Reporting and Conformance) policy that does something, an SPF (Sender Policy Framework) record that ends the right way, a DKIM (DomainKeys Identified Mail) selector the scan can find, an HSTS (HTTP Strict Transport Security) header, a CAA (Certification Authority Authorization) record and a signed zone. None of those arrive with a hosting plan, and in the 40 to 59 band they’re the things that weren’t added.

So a score of 52 describes a working domain where the security half of the setup never got finished. That’s the state most working domains are in, and it’s where most F grades land. The distinction from the bottom of the band is that your domain has something to build on, and the records below go on top of what’s already there.

The records that separate the band

The email checks carry the most weight in the grade, so they’re where the gap between 52 and 60 mostly lives, and they’re the first thing to read on your own result.

Start with DMARC. When the check named dmarc-policy fails outright, the scanner gives it critical, its most serious severity label; a few other failures carry that label too, such as two SPF records or a site answering on port 80 with no TLS (Transport Layer Security) on 443. In the census it fails on 94.0% of the F-graded domains the checks ran on (229,510,300 of 244,179,385; the dead domains, which score F without any check running, are left out). It fails when there’s no _dmarc TXT (Text) record at all, and it also fails when the record exists but reads p=none, which tells receiving mail servers to do nothing about messages that fail authentication. Either way, anyone can put your domain in the From line and the mail goes through, which is the situation can someone spoof my domain walks through in full.

Look yours up with dig +short TXT _dmarc.yourdomain, using your own domain in place of the placeholder. If the answer is empty, or reads v=DMARC1; p=none, that’s the record the check is failing on. A policy line that counts reads v=DMARC1; p=quarantine or v=DMARC1; p=reject, and adding rua=mailto: followed by an address you read turns on the reports that show you who’s sending as you. The DMARC pillar covers how to get from none to quarantine without losing your own mail on the way.

SPF is the second record. Run dig +short TXT yourdomain and find the string that begins v=spf1. The last token is the one the scan weighs. A record ending ~all is a soft fail, which most receivers treat as a suggestion; a record ending -all is a hard fail, which they treat as an instruction. The SPF pillar explains why the tilde is the default almost everywhere and what changes when you replace it with a dash.

Then DKIM. The scan looks for a signing selector on the domain, and if it can’t find one, dkim-exists fails. Your mail service publishes the key; you add the CNAME (Canonical Name) or TXT record it gives you at the name it gives you. If mail already arrives with a DKIM signature, the selector is in the message headers, in the s= tag of the DKIM-Signature line.

Those three are the ones worth checking before anything else, and the scan reads them back against your own domain in about a minute.

The web and DNS checks that fill in the rest

The email records move the score most, and the remaining checks are smaller weights that add up.

HSTS is a single response header, Strict-Transport-Security: max-age=31536000; includeSubDomains, sent by the web server on HTTPS responses. Without it the hsts-header check fails. Most web servers and most content delivery services have a one-line switch for it, and the header does nothing visible to visitors beyond stopping their browser from ever trying plain HTTP (Hypertext Transfer Protocol) for your site again.

A CAA record is a DNS (Domain Name System) entry that says which certificate authorities may issue for your domain. It reads yourdomain. CAA 0 issue "the authority you use", and if you only use one, that’s one line. Its absence fails caa-record.

DNSSEC (Domain Name System Security Extensions) signs your zone so that resolvers can tell a real answer from a forged one. For most domains this is a setting at the registrar or the DNS host: turn signing on, publish the DS (Delegation Signer) record at the registrar, wait for propagation. The check here is dnssec-ds, and unlike the records above, a half-finished DNSSEC setup can take a domain offline, so this one goes last and gets tested.

None of these is hard. Each is a specific line in a specific place, and the scan result tells you which ones your domain is missing.

Why no single record gets you to a C

No F-graded domain in the edition scores 60 or above. For a domain with a website and mail, the heaviest check on the list weighs 8 points, so no single record carries a domain in the fifties past the 70 that a C needs. One record can end the F, though: a domain at 52 or above is within 8 points of the 60 mark where F ends and D begins, and an enforcing DMARC record where there was none closes that gap on its own. Below 52, it takes more than one of the records above.

So the shape of the work is a short list, done in order, with the email records at the top because they weigh most. The scan result already orders it for you. Read it top down, fix the first item, rescan, and the number moves. Fix the second, rescan, and it moves again. The letter changes when the number crosses 60, and the records that get you there are the same ones that stop your domain being used to send mail as you.

The abandoned end

The 8,432,224 domains scoring under 10 look nothing like yours. That end of the band is where nothing answers: no mail exchanger, a web server that’s absent or refuses the connection, no TXT records of any kind, often no address at the apex at all. These are parked names, and names somebody registered for a project that never started, or re-registered and then left.

A domain down there has nothing to finish. It would need to be built before it could be secured, and the score reflects that. If you’re reading this on the result screen of a domain you use, you have a working site or working mail or both, and that alone puts you above that floor.

For anyone citing the headline

“Most of the internet fails” is a fair reading of the census, as long as fails is read as a threshold. Each check carries points, the score is what the domain earned across all of them, and the grade says whether that total cleared a line. A 5 and a 58 print the same letter. Reading the headline F share as “three quarters of the internet is derelict” treats a threshold as a state.

Walked from the floor up, the band says unfinished far more often than abandoned. The 3.41% under 10 is the slice the word abandoned fits: parked inventory, defensive registrations of brand variants, the leftovers of projects that ended, and names bought last week with nothing on them yet. In the tens, twenties and thirties sits the half-built domain, with one thing done properly and the rest untouched: a web server on port 80 with no certificate, say, or a mail exchanger with a bare SPF record and nothing else. The pieces that push a score into the forties are the ones a browser makes you do, a certificate and a server that answers on 443. By the forties the site works the way a visitor would judge it, with a lock icon in the address bar, and the domain is still an F.

What the score can’t see

The score measures published configuration, observed once, from outside. It reads DNS records, opens a TLS connection, fetches a page and inspects the headers. It doesn’t log in, crawl or test the application, and it doesn’t know whether the site is maintained, patched, trading or compromised. A 58 can be running a content management system nobody has updated since it was installed, while a 4 might belong to a company that does all its business through a different name. A high F says the to-do list is short and makes no claim about the site behind it.

The reverse also holds. A domain scoring 58 with p=none and no reporting address can be spoofed the same way as one scoring 5, because the receiving server has no instruction to reject a message that puts the name in its From line.

How the bands were counted

The bands are a count over every F-graded row in this edition, with no sample and no extrapolation: each of the 247,066,987 domains was placed in a band by its score. Each band includes its lower bound and excludes its upper, so “0 to 9” means at least 0 and under 10, and “40 to 59” means at least 40 and under 60. The bands exist for this edition only, so nothing on this page describes a change.

Which missing record is yours

Your scan result lists each check by name, with the severity and the weight, and the failed ones with the heaviest weight sit at the top. For a domain in the 40 to 59 band that list nearly always begins with dmarc-policy, because 94.0% of the F-graded domains the checks ran on fail it, and the fix is a TXT record you can write from the examples above.

Run the free scan on your domain and start with the first record in its failed list. When you’ve published it, rescan and read the new number.

Figures from the defaults.exposed census, data as of 12 October 2026. Census numbers move every month; the current values are on the census data page.