How domains stack security controls, and where they stop

A domain that carries one security control tends to carry the one next to it, and a domain that does none tends to do none of them. The October 2026 census scores every domain on how many of five controls it carries: SPF (Sender Policy Framework), an enforcing DMARC (Domain-based Message Authentication, Reporting and Conformance) policy, DNSSEC (Domain Name System Security Extensions), HTTPS (Hypertext Transfer Protocol Secure) and HSTS (HTTP Strict Transport Security).

Almost everyone stops at one or two

288,633,841 domains, 86.8% of the 332,492,319 graded, carry two of the five controls or fewer. The population piles up at the bottom of the staircase and thins fast toward the top, ending at the 1,325,934 that close all five, the locked vault. The middle is nearly empty: 43,858,478 domains, 13.19%, carry three or more. Doing three, four or five controls is rare, and it is rare together, because the domains that finish one tend to finish the rest. The locked-vault piece sets out the full staircase and which of the five is rarest.

The gap that defines the pattern

The clearest place to see controls travelling together is email, where SPF and DMARC are a natural pair: SPF says who may send, DMARC says what to do when someone else does. In October, 65,360,376 domains published both. But 91,705,195 published SPF and never added DMARC, more than the number who did both. And 157,320,430 published neither.

That 91.7 million is the pattern in one number: domains that took the first step, SPF, and stopped one record short of the step that makes it enforceable. The record is easy to add, and the DMARC pillar covers it.

The four email combinations

SPF and DMARC give four combinations, and every graded domain sits in exactly one of them:

Read across the rows and the pairing shows. Of the 157,065,571 domains that publish SPF, 41.61% also publish DMARC. Of the 175,426,748 that do not, 10.32% publish DMARC anyway. A domain with the first record is about four times as likely to have the second.

The table counts any DMARC record. The control in the five-point score counts only a DMARC record whose policy is quarantine or reject, and that cuts the pairing further. 131,972,311 domains publish SPF without an enforcing DMARC policy, 84.02% of SPF publishers and 39.69% of every domain graded or found dead. Only 25,093,260 have SPF together with an enforcing policy. Of the 83,466,694 domains that publish a DMARC record at all, 43,708,107, 52.37%, stop short of an enforcing policy by the grading engine’s count over the same 332,492,319 domains. That is a second stopping point inside the first one.

The same pattern on the web side

HTTPS and HSTS are the web pair, and they break the same way. 220,264,382 graded domains serve HTTPS, and 173,148,160 of them, 78.61%, send no HSTS header. HSTS is one line in the server configuration once HTTPS works, so this is the web’s version of SPF without DMARC: the first step taken, the one that makes it stick left out. The statistic has its own page, how many HTTPS sites lack HSTS.

How the pattern differs by ending

The staircase has the same shape under every kind of ending, at different heights. Grouped by the IANA (Internet Assigned Numbers Authority) delegation type, using the per-TLD rows of the same file:

Country-code domains stack the most controls and new gTLDs the fewest. The SPF-without-DMARC share is close for country-code and legacy endings and lower for new gTLDs, which have more domains with neither record: 59.26%, against 47.06% for com, net and org and 40.57% for country codes. Some single endings stand out. In .xyz, 65.62% of graded domains have SPF and no DMARC (6,323,013 of 9,635,822). Among country codes with at least 100,000 graded domains, .kz is at 61.84% (80,197 of 129,681), .by at 51.31% (54,224 of 105,677), .jp at 47.48% (681,260 of 1,434,808) and .za at 46.83% (517,217 of 1,104,365). In .com the share is 29.42%, 45,256,681 domains.

What this is, exactly

This is a co-occurrence distribution: how many of the five each domain has, and the SPF/DMARC pairing. It is not a correlation coefficient and not a pairwise matrix across all five, because the census does not compute one. Read it as “controls tend to come in sets, and most sets are small,” which is what the counts support.

All figures are from this edition, on the graded base of 332,492,319 domains, which includes the dead domains the census grades F. HSTS is counted only on domains that serve HTTPS. The group figures use the per-TLD rows, which cover 99.79% of graded domains.

See your own

The free scan shows which of the five your domain carries and which are one record away. If you are in the 91.7 million with SPF and no DMARC, that is the highest-value record you can add next.

Check it with dig +short TXT _dmarc.yourdomain, using your own domain in place of the placeholder. An empty answer means no DMARC record. An answer reading v=DMARC1; p=none means a record that does not yet count as a control. A record with p=quarantine or p=reject counts. The DMARC fix page and the none versus reject guide cover the move from monitoring to enforcement, and the HSTS fix page covers the web-side step.

Figures from the defaults.exposed census, data as of 12 October 2026. Census numbers move every month; the current values are on the data page.