The locked vault: the 1.3 million domains that close every door

Some domains close every door the census checks: they authenticate their mail with SPF (Sender Policy Framework) and an enforcing DMARC (Domain-based Message Authentication, Reporting and Conformance) policy, sign their DNS (Domain Name System) with DNSSEC (Domain Name System Security Extensions), serve over HTTPS (Hypertext Transfer Protocol Secure), and send HSTS (HTTP Strict Transport Security) so a browser never tries plaintext again. In October 2026, 1,325,934 domains did all five at once. That is about 1 in 251 of every domain the census graded.

Five short changes, rarely finished together

The five controls are the ones the census can see on every domain, and each is a short list of records or headers, so cost does not explain why only 0.40% stack all five. Each control is a separate decision made by a different person at a different time, and almost nobody finishes the set.

The census scores each domain on how many of the five it has present, from zero to five. The distribution is a staircase that thins fast at the top:

Most of the graded internet lives at one or two controls. The climb from two to five is where the population falls away, which is the same pattern the control-stacking piece reads from the other direction. The zero row has its own page, how many domains have zero security controls.

Which control holds the vault shut

The five controls are not equally common, and the rarest one sets the ceiling. Across the 332,492,319 domains graded or found dead:

No more than 23,390,098 domains could reach the vault, because that is how many sign their zone. The vault is 5.67% of the DNSSEC-signed domains, 3.33% of the domains with an enforcing DMARC policy and 2.81% of those sending HSTS. So even among domains that have done the rarest step, most have left another one open.

DNSSEC also needs a DS (Delegation Signer) record published at the registrar, and how common it is varies sharply by ending. In .nl, 56.30% of graded domains are signed (2,283,225 of 4,055,303) and in .ch 51.55% (953,455 of 1,849,400). In .com the figure is 5.32% (8,181,248 of 153,849,480).

Where the vault is

Just under half of the vault sits under country codes. Grouped by the IANA (Internet Assigned Numbers Authority) delegation type:

Country-code domains are 29.24% of the graded set and just under half of the vault. The two endings named above carry much of that. .nl has 218,752 vault domains, 5.39% of its graded names, and .ch has 177,538, 9.60%. Together they hold 396,290, 29.89% of every locked-vault domain in the census. .com has the most of any single ending, 494,845, which is 37.32% of the vault and 0.32% of .com.

Among endings with at least 100,000 graded domains, the country-code leaders after .ch and .nl are .sk at 2.23% (9,163 of 411,540), .no at 2.17% (12,534 of 578,906), .dk at 1.54% (17,053 of 1,104,513) and .fr at 1.14% (40,583 of 3,561,692). The generic leaders are .studio at 3.13% (6,247 of 199,900), .art at 1.08% (3,116 of 288,905), .dev at 0.70% (5,254 of 752,083) and .app at 0.57% (9,257 of 1,612,135). Near the bottom sit .bond with 8 vault domains out of 1,152,710, .cfd with 18 out of 516,374, .top with 274 out of 5,530,948 and .cn with 189 out of 6,297,295.

What five does not cover

The five are what can be read from the outside on every domain, and a locked-vault domain can still carry a weak certificate chain, a permissive Content-Security-Policy, or a mail path that fails alignment in practice. Treat five of five as a strong result on these five checks, and keep reading the rest of the scan.

How the vault was counted

Every figure here is from this edition, on the graded base of 332,492,319 domains, which includes the dead domains the census grades F. For each domain the census counts which of the five controls are present. SPF means an SPF record is published. DMARC counts only with a policy of quarantine or reject, so a p=none record does not score. DNSSEC means the zone is signed. HTTPS means the site answers over HTTPS, and HSTS is counted only on a domain that serves HTTPS and sends the header there.

The five per-control counts add up to 487,594,860, the same total the staircase gives when each row is multiplied by its number of controls, so the two views reconcile exactly.

The ending-by-ending figures use the per-TLD rows of the same file, which cover 99.79% of graded domains (331,781,273) and 1,323,438 of the vault.

See your own

The free scan shows which of the five your domain already has and which are one record or one header away. Most domains that reach the vault got there by closing the two or three they had left.

You can read all five yourself. dig +short TXT yourdomain shows the SPF record, the string that starts v=spf1. dig +short TXT _dmarc.yourdomain shows the DMARC record, and it only counts here if it reads p=quarantine or p=reject. dig +short DS yourdomain returns a line if the zone is signed and the registrar has published the DS record. curl -sI https://yourdomain | grep -i strict-transport-security shows the HSTS header, and a response at all means HTTPS is up. The fix pages for DMARC, SPF, DNSSEC, HTTPS and HSTS cover each step. DNSSEC goes last, because a half-finished signing setup can take a domain offline.

Figures from the defaults.exposed census, data as of 12 October 2026. Census numbers move every month; the current values are on the data page.