Why the most visited domains score badly, and what the A grades do
People keep typing a household name into the checker, seeing a C, and deciding the checker must be wrong. So we graded the 10,000 most visited domains on the internet at once, on the same 33 checks we run on everyone else, and looked at the whole set instead of arguing about one name. Nearly 7 in 10 of them score below a B. Only 1.8% earn an A+. 28.4% score F. They are still far better than the internet as a whole, where 74.3% of the domains graded or found dead score F, but the gap between “one of the biggest sites in the world” and “properly locked down” is wide and measurable, and a short list of records and headers explains it.
The cohort is the Tranco top 10,000 (list 4672X, generated 11 October 2026), matched domain by domain against the current census edition. Of the 10,000, 9,840 could be graded. The rest were unreachable, indeterminate or dead on the day, exactly as they would be for any other domain, or were not in the edition at all. No individual grade from this cohort is published here, and the public checker no longer runs domains on the list, for reasons the last section explains.
The top 10,000 against everyone else
| Grade | Top 100 | Top 1,000 | Top 10,000 | All graded domains |
|---|---|---|---|---|
| A+ | 4.0% | 3.2% | 1.8% | 0.03% |
| A | 10.0% | 8.9% | 5.6% | 0.18% |
| B | 35.0% | 31.4% | 25.4% | 2.2% |
| C | 21.0% | 21.5% | 25.7% | 7.8% |
| D | 9.0% | 8.7% | 13.0% | 15.5% |
| F | 21.0% | 26.3% | 28.4% | 74.3% |
| Mean score | 71 | 67 | 66 | 47 |
A domain in the top 10,000 is about 35 times more likely to hold an A or A+ than a domain picked at random. Even so, 93 in every 100 of them do not hold one, and the top 10,000’s average score of 66 is a D.
The top 100 look better than the top 10,000 on every row. The top 1,000 sit between the two on the A+, A, B and F shares and on the mean score. That is what you would expect if the very largest organisations have someone whose job includes the domain, and it thins out fast below them.
Why they score badly: the same few things, every time
The checks the top 10,000 fail most often are the same ones the rest of the internet fails. Percentages are of the domains that could be evaluated on that check: a domain with no mail service is not counted against DKIM (DomainKeys Identified Mail), and a domain with no website is not counted against HSTS (HTTP Strict Transport Security).
| Check | Top 10,000 failing | What it means when it fails |
|---|---|---|
| DNSSEC (Domain Name System Security Extensions) | 89.6% | Nothing stops a resolver being fed a forged answer for the domain |
| CAA (Certification Authority Authorization) record | 80.4% | Any certificate authority in the world may issue a certificate for the domain |
| HSTS header | 62.0% of sites with a website | The first visit can be downgraded to plain http |
| DMARC (Domain-based Message Authentication, Reporting and Conformance) at enforcement | 50.4% | Anyone can send email as the domain and receivers are told to deliver it |
| SPF (Sender Policy Framework) strength | 42.3% | The SPF record exists but does not say “reject the rest” |
| DMARC reporting | 41.0% | Nobody is told when the domain is being abused |
| DKIM found | 31.6% of domains with mail | No signing key at the selectors we probe |
| HTTP (Hypertext Transfer Protocol) to HTTPS (Hypertext Transfer Protocol Secure) redirect | 21.6% of sites with a website | Plain http is served and stays plain |
Half of the most visited domains on the internet do not enforce DMARC. That is the record that decides whether a forged invoice carrying their name reaches a customer’s inbox. They can afford that gap. They have fraud teams, legal teams and enough brand recognition that a customer might ring to check. A plumber with six vans has none of those, and the record is the same size either way. It costs the same to publish, and the DMARC pillar walks through it.
DNSSEC and CAA sit at the top of the table for the top 10,000 just as they do for everyone else. Across the whole census only 7.0% of domains publish a valid DNSSEC chain, against a 10.4% pass rate in the top 10,000. The DNS pillar covers what both records do and why registrars make one of them harder than it should be.
The F grades are not what they look like
Of the 2,798 F grades in the top 10,000, 1,324 belong to domains that serve no website at all and 1,815 have no mail service. These are the plumbing of the internet: content delivery networks, DNS (Domain Name System) providers, tracking and advertising endpoints, root and registry servers. They appear in a “most visited” list because browsers fetch from them millions of times a second. They were never meant to be a business’s front door, so an F on one of them reflects the kind of hostname it is.
Strip those out and the picture of the actual brand domains improves without changing shape. A domain that does serve a website and does send mail, and still holds a D or an F, has not published the records. Across the top 10,000, half the domains checked for DMARC have not switched it to enforcement.
Why some domains do well
The 731 domains in the top 10,000 with an A or A+ do a short list of ordinary things, and the gap between them and the D and F grades is wide.
| Check | A and A+ domains passing | D and F domains passing |
|---|---|---|
| DMARC at enforcement | 98.6% | 10.3% |
| SPF strength | 98.4% | 16.7% |
| DMARC reporting | 97.8% | 18.7% |
| HTTP to HTTPS redirect | 88.8% | 39.8% |
| HSTS header | 70.3% | 10.6% |
| DKIM found | 73.2% | 12.5% |
| CAA record | 61.4% | 7.2% |
| DNSSEC | 40.8% | 4.7% |
The line that separates an A from an F in the top 10,000 is email authentication, enforced. Nearly every A-grade domain has SPF that rejects unlisted senders, DMARC set to quarantine or reject, and a reporting address so someone is told when the domain is abused. Nearly every F-grade domain has none of the three. The web-side controls follow the same shape: an A-grade domain redirects plain http, pins HTTPS with HSTS and names its certificate authorities with CAA. Even among the A grades DNSSEC is the outlier, held by fewer than half.
As a group the A grades skew toward news publishers, government agencies, security and infrastructure vendors, and a handful of the largest consumer platforms. What they share is that in each of them someone owns the domain’s posture as a job, published the records once, and left them enforced.
Your domain is judged on its own records
Nothing about a big brand’s grade transfers to yours. Their C tells you they have not enforced DMARC or pinned HTTPS, and that they can live with the consequences. Your domain is judged on its own records with the same 33 checks and the same weighting, and the consequences of a forged invoice land on you.
The checks that separate A from F above are the same checks that separate your domain from the 74.9% of domains with no DMARC record at all. Three DNS records and two headers cover most of the distance, and the result page shows the exact record or header behind every line, with the first fix written out.
Method note
Each domain in the Tranco list was matched by exact registrable name against the census edition, so every grade in this piece comes from the same scan, the same engine and the same weighting as every other grade on this site. Per-check percentages count only the domains on which that check could be evaluated. The list itself is an aggregate of several popularity rankings and is stable against short-term manipulation, which is why it was chosen over any single provider’s ranking.
We do not publish any individual domain’s grade, including any in this cohort. The public checker also no longer runs domains on this list, because their result tells a visitor nothing about their own domain.
Figures from the defaults.exposed census, data as of 12 October 2026. Census numbers move every month; the current values are on the census data page.