Only 2.79% of failing domains score under ten

“Most of the internet fails” is the line you keep meeting, and you want to know what it’s made of. Does a failing grade mean a domain somebody walked away from, or one somebody set up and didn’t finish? Walk the score distribution inside the F band from the bottom and the answer is unfinished. The ones the word abandoned fits are a thin slice at the floor. Most of the band resolves, answers over HTTPS with a valid certificate and has no email policy published.

Are most websites insecure

Yes, by the measure the census applies, and what “insecure” covers is wider than the word suggests. In the September 2026 census, 234,955,475 domains carry an F, and that count is the denominator for every share on this page. F is a band with a range inside it. A score from zero up to the C threshold at 70 prints the same letter, so in a headline a 5 and a 58 look identical, and on a scan they’re different objects.

The letter is a threshold drawn on the score. Each check the scanner runs carries points, the score is what the domain earned across all of them, and the grade says whether that total cleared a line. When an analyst reads the headline F share as “three quarters of the internet is derelict”, they’re reading a threshold as a state. The threshold only tells you the domain fell short. For how far short, and why, you need the score and a look at what the domain did and didn’t publish.

The floor of the band

At the bottom of the band, 6,548,446 domains (2.79% of F) score 0 to 9. This is what a name looks like when nothing at all has been set up behind it: the registration exists, DNS resolves it to something or to nothing, and each check finds an empty slot. There’s no SPF or DMARC record at the apex, either no MX or one pointing at a host that doesn’t answer, and either no web server or one serving a registrar placeholder over plain HTTP.

That is the population the word abandoned fits. Some of it is parked inventory, some is defensive registrations of brand variants, some is the leftover of a project that ended, and some is a name bought last week with nothing on it yet. From outside they share one shape, a registration with no published configuration, and they’re 2.79% of the failing band.

If your working model of “most of the internet fails” was a wasteland of dead names, this slice is the size of the wasteland, and the rest of the band is something else.

Walking up from the floor

Climb out of the 0 to 9 band and the shape changes. In the tens, twenties and thirties you meet the half-built domain. Scan one and you’ll usually find one thing done properly and the rest untouched: a web server on port 80 with no certificate, say, or a mail exchanger with a bare SPF record and nothing else. Another common one is a valid certificate on a site whose email side is empty and whose response headers are blank.

Somebody chose a host for these and put a page on it, so dead is the wrong word for them. They’re the state a domain sits in after the first afternoon of setup, when the visible thing works and the invisible things haven’t come up yet. What separates one band from the next here is which single piece got done, and the pieces that push a score into the forties are the ones a browser makes you do: a certificate, and a server that answers on 443.

Keep climbing and the population thickens. By the forties, the site works the way a visitor would judge it. The page loads with a lock icon in the address bar, and the domain is still an F.

Where most of the failing internet sits

148,448,223 domains (63.18% of F) score 40 to 59. That’s a domain which resolves, answers on 443, negotiates modern TLS with a certificate that validates, and has not published its email records.

Look one up and the pattern is consistent. A TXT query on _dmarc.<yourdomain> returns nothing, or returns v=DMARC1; p=none with no rua= address so nobody reads the reports. The SPF record, if there is one, ends in ~all or ?all. Fetch the page and the response comes back without a Strict-Transport-Security header, and without Content-Security-Policy or X-Frame-Options either.

Its distance from a pass is a short list of DNS records and header lines. The email side is an SPF record ending in -all, covered at /spf, a DMARC record with an enforcing policy and a reporting address, covered at /dmarc, and a DKIM selector published by whoever sends the mail. The web side is a few response headers added in one config block, covered at /headers. None of that needs a rebuild or a budget line. Someone with access to the DNS console can do it in an hour.

So the mass of the F band is a working website with an unfinished email setup: of the 234,955,475 domains graded F in the September 2026 census, 63.18% score 40 to 59.

What the score can’t see

The score measures published configuration, observed once, from outside. It reads DNS records, opens a TLS connection, fetches a page and inspects the headers. It doesn’t log in, doesn’t crawl, doesn’t test the application, and doesn’t know whether the site is maintained, patched, trading or compromised. A 58 can be running a content management system nobody has updated since it was installed, while a 4 might belong to a company that does all its business through a different name.

All a high F tells you is that the to-do list is short. Whether the site behind it is clean is a separate question the scan doesn’t ask, and this page makes no claim about it.

The reverse also holds. Score 58 with p=none and no reporting address and your name can be spoofed the same way as one scoring 5. Anyone can put it in a From: header and the receiving server has no instruction to reject the message. The letter has that right. What the score adds is that the letter is fixable, and roughly how much work fixing it is.

How the bands were counted

The bands are a count over the full set of F-graded rows in the September 2026 edition. There’s no sample and no extrapolation; each of the 234,955,475 domains was placed in a band by its score. Each band includes its lower bound and excludes its upper, so “0 to 9” means a score of at least 0 and under 10, and “40 to 59” means at least 40 and under 60. No F-graded domain scores 60 or above.

The bands exist for the September 2026 edition only. There is no earlier band count to set them against, and the census doesn’t difference editions, so nothing on this page describes a change. It’s a cross-section of one month, read from the bottom up.

Find your own position in the band

The band average tells you nothing about your domain. The headline lumps a domain scoring 50 in with one scoring 5, and only one of them is a few records short of a pass. Run the free scan and read the score under the letter, because that number and the list of checks that came back empty are what tell you where you stand.

If you’re in the forties or fifties with a blank _dmarc record, the list in front of you is short and each item on it is a DNS entry or a header line. If you’re under ten, the question is whether the name is one you’re using at all.

Figures as of 5 September 2026, from the September 2026 edition of the defaults.exposed census. Census numbers move every month; the current values are on the census data page.