Why the most visited domains on the internet score badly, and what the few A grades do differently
People keep typing a household name into the checker, seeing a C, and deciding the checker must be wrong. So we graded the 10,000 most visited domains on the internet at once, on the same 34 checks we run on everyone else, and looked at the whole set instead of arguing about one name. Nearly 7 in 10 of them score below a B. Only 1.8% earn an A+. 29.1% score F. They are still far better than the internet as a whole, where 74.2% of graded domains score F, but the gap between “one of the biggest sites in the world” and “properly locked down” is wide and measurable, and the same few records and headers explain it every time.
The cohort is the Tranco top 10,000 (list 46VQX, generated 12 September 2026), matched domain by domain against the September 2026 census edition. Of the 10,000, 9,809 could be graded. The rest were unreachable, indeterminate or dead on the day, exactly as they would be for any other domain. No individual grade from this cohort is published here, and the public checker no longer runs domains on the list, for reasons the last section explains.
The top 10,000 against everyone else
| Grade | Top 100 | Top 1,000 | Top 10,000 | All graded domains |
|---|---|---|---|---|
| A+ | 6.0% | 3.5% | 1.8% | 0.03% |
| A | 9.0% | 8.8% | 5.4% | 0.17% |
| B | 32.0% | 31.2% | 25.3% | 2.0% |
| C | 21.0% | 22.1% | 25.5% | 7.8% |
| D | 10.0% | 8.6% | 12.9% | 15.8% |
| F | 22.0% | 25.7% | 29.1% | 74.2% |
| Mean score | 71 | 68 | 66 | 47 |
A domain in the top 10,000 is about 36 times more likely to hold an A or A+ than a domain picked at random. Even so, 93 in every 100 of them do not hold one. Popularity buys a better average, and the average is still a C.
The top 100 look better than the top 10,000 on every row, and the pattern holds at each step down the list. That is what you would expect if the very largest organisations have someone whose job includes the domain, and it thins out fast below them.
Why they score badly: the same few things, every time
The checks the top 10,000 fail most often are the same ones the rest of the internet fails. Percentages are of the domains that could be evaluated on that check: a domain with no mail service is not counted against DKIM, and a domain with no website is not counted against HSTS.
| Check | Top 10,000 failing | What it means when it fails |
|---|---|---|
| DNSSEC | 89.7% | Nothing stops a resolver being fed a forged answer for the domain |
| CAA record | 80.4% | Any certificate authority in the world may issue a certificate for the domain |
| HSTS header | 62.5% of sites with a website | The first visit can be downgraded to plain http |
| DMARC at enforcement | 50.9% | Anyone can send email as the domain and receivers are told to deliver it |
| SPF strength | 43.1% | The SPF record exists but does not say “reject the rest” |
| DMARC reporting | 41.6% | Nobody is told when the domain is being abused |
| DKIM found | 32.2% of domains with mail | No signing key at the selectors we probe |
| HTTP to HTTPS redirect | 21.9% of sites with a website | Plain http is served and stays plain |
Half of the most visited domains on the internet do not enforce DMARC. That is the record that decides whether a forged invoice carrying their name reaches a customer’s inbox. They can afford that gap. They have fraud teams, legal teams and enough brand recognition that a customer might ring to check. A plumber with six vans has none of those, and the record is the same size either way. It costs the same to publish, and the DMARC pillar walks through it.
DNSSEC and CAA sit at the top of the table for the top 10,000 just as they do for everyone else. Across the whole census only 6.9% of domains publish a valid DNSSEC chain, so a 10.3% pass rate in the top 10,000 is better without being good. The DNS pillar covers what both records do and why registrars make one of them harder than it should be.
The F grades are not what they look like
Of the 2,843 F grades in the top 10,000, 1,330 belong to domains that serve no website at all and 1,858 have no mail service. These are the plumbing of the internet: content delivery networks, DNS providers, tracking and advertising endpoints, root and registry servers. They appear in a “most visited” list because browsers fetch from them millions of times a second, not because anyone types them in. They were never meant to be a business’s front door, so an F on one of them describes what the hostname is rather than what anyone got wrong.
Strip those out and the picture of the actual brand domains improves without changing shape. A domain that does serve a website and does send mail, and still holds a D or an F, has simply not published the records. Half of the top 10,000 with mail have not switched DMARC to enforcement. That is a choice, made by organisations with the budget to know better.
Why some domains do well
The 707 domains in the top 10,000 with an A or A+ do a short list of ordinary things, and the gap between them and the D and F grades is wide.
| Check | A and A+ domains passing | D and F domains passing |
|---|---|---|
| DMARC at enforcement | 98.4% | 10.0% |
| SPF strength | 98.9% | 16.0% |
| DMARC reporting | 97.6% | 18.1% |
| HTTP to HTTPS redirect | 89.0% | 39.7% |
| HSTS header | 72.4% | 10.1% |
| DKIM found | 72.8% | 12.1% |
| CAA record | 61.7% | 7.2% |
| DNSSEC | 40.6% | 4.3% |
The line that separates an A from an F in the top 10,000 is email authentication, enforced. Nearly every A-grade domain has SPF that rejects unlisted senders, DMARC set to quarantine or reject, and a reporting address so someone is told when the domain is abused. Nearly every F-grade domain has none of the three. The web-side controls follow the same shape: an A-grade domain redirects plain http, pins HTTPS with HSTS and names its certificate authorities with CAA. Even among the A grades DNSSEC is the outlier, held by fewer than half.
As a group the A grades skew toward news publishers, government agencies, security and infrastructure vendors, and a handful of the largest consumer platforms. Size is not what they share. In each of them someone owns the domain’s posture as a job, published the records once, and left them enforced.
Your domain is judged on its own records
Nothing about a big brand’s grade transfers to yours. Their C tells you they have not enforced DMARC or pinned HTTPS, and that they can live with the consequences. Your domain is judged on its own records with the same 34 checks and the same weighting, and the consequences of a forged invoice land on you.
The checks that separate A from F above are the same checks that separate your domain from the 75.2% of domains with no DMARC record at all. Three DNS records and two headers cover most of the distance, and the result page shows the exact record or header behind every line, with the first fix written out.
Method note
Each domain in the Tranco list was matched by exact registrable name against the census edition, so every grade in this piece comes from the same scan, the same engine and the same weighting as every other grade on this site. Per-check percentages count only the domains on which that check could be evaluated. The list itself is an aggregate of several popularity rankings and is stable against short-term manipulation, which is why it was chosen over any single provider’s ranking.
We do not publish any individual domain’s grade, including any in this cohort. The public checker also no longer runs domains on this list, because their result tells a visitor nothing about their own domain and every one of those scans ended in an argument about a household name instead of a fix to a real one.
Figures as of 5 September 2026, from the September 2026 edition of the defaults.exposed census. Census numbers move every month; the current values are on the census data page.