How domains stack security controls, and where they stop

Security controls travel in company. A domain that does one tends to do the one next to it, and a domain that does none tends to do none of them. The September 2026 census scores every domain on how many of five controls it carries, SPF, an enforcing DMARC policy, DNSSEC, HTTPS and HSTS, and the shape of that distribution says more about how the internet is run than any single check does.

Almost everyone stops at one or two

275,305,224 domains, 86.9% of the 316,600,902 graded, carry two of the five controls or fewer. The population piles up at the bottom of the staircase and thins fast toward the top, ending at the 1,143,559 that close all five, the locked vault. The middle is nearly empty: doing three, four or five controls is rare, and it is rare together, because the domains that finish one tend to finish the rest.

The gap that defines the pattern

The clearest place to see controls travelling together is email, where SPF and DMARC are a natural pair: SPF says who may send, DMARC says what to do when someone else does. In September, 61,364,052 domains published both. But 88,739,150 published SPF and never added DMARC, more than the number who did both. And 149,416,895 published neither.

That 88.7 million is the single largest gap on the page: domains that took the first step, SPF, and stopped one record short of the step that makes it enforceable. It is not a hard record to add, and the DMARC pillar covers it. The size of the gap is the whole story of this distribution: the internet is full of half-finished security, one record short of the next control.

What this is, exactly

This is a co-occurrence distribution: how many of the five each domain has, and the SPF/DMARC pairing. It is not a correlation coefficient and not a pairwise matrix across all five, because the census does not compute one. Read it as “controls tend to come in sets, and most sets are small,” which is what the counts support.

See your own

The free scan shows which of the five your domain carries and which are one record away. If you are in the 88.7 million with SPF and no DMARC, that is the highest-value record you can add next.

Figures as of 5 September 2026, from the September 2026 edition of the defaults.exposed census. Census numbers move every month; the current values are on the data page.