Defaults.Exposed

The locked vault: the 1.1 million domains that close every door

There is a version of a domain that closes every door the census checks: it authenticates its mail with SPF and an enforcing DMARC policy, signs its DNS with DNSSEC, serves over HTTPS, and sends HSTS so a browser never tries plaintext again. In September 2026, 1,143,559 domains did all five at once. That is about 1 in 277 of every domain the census graded.

Rare by design, not by difficulty

The five controls are the ones the census can see on every domain, and each is a short list of records or headers. None needs a rebuild or a budget line. The reason only 0.36% stack all five is not cost, it is that each is a separate decision made by a different person at a different time, and almost nobody finishes the set.

The census scores each domain on how many of the five it has present, from zero to five. The distribution is a staircase that thins fast at the top:

Most of the graded internet lives at one or two controls. The climb from two to five is where the population falls away, which is the same pattern the control-stacking piece reads from the other direction.

What five does not cover

Closing all five is the strong end of what the census measures, and it is a real distinction. It is also a floor, not a ceiling: the five are what can be read from the outside on every domain, and a locked-vault domain can still carry a weak certificate chain, a permissive Content-Security-Policy, or a mail path that fails alignment in practice. Treat five of five as evidence of a team that finishes what it starts, and keep reading the rest of the scan.

See your own

The free scan shows which of the five your domain already has and which are one record or one header away. Most domains that reach the vault got there by closing the two or three they had left, in an afternoon.

Figures as of 5 September 2026, from the September 2026 edition of the defaults.exposed census. Census numbers move every month; the current values are on the data page.