https://defaults.exposed/en/ Independent domain-security research: aggregate SPF, DKIM, DMARC, DNSSEC and TLS posture measured across the internet, with as-of dates and public methodology. en Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-business-email-compromise-inside-the-90-7-spoofing-gap https://defaults.exposed/v9/articles/what-is-business-email-compromise-inside-the-90-7-spoofing-gap Business email compromise (BEC) is a fraud that impersonates a trusted party by email to redirect a payment or data. The August 2026 census of 376,928,750 email-graded domains finds 90.7%, 341,945,132, publish no enforcing DMARC, the exact-domain spoofing gap that makes BEC's most convincing impersonations possible. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/dmarc-checker-explained https://defaults.exposed/v9/articles/dmarc-checker-explained A DMARC checker reads the policy your domain publishes and tells you whether it can be spoofed. The August 2026 census of 376,928,750 graded domains finds only 9.3% publish an enforcing policy, the rest publish nothing, or a record that looks protective but does nothing. Here is how to read every field of a DMARC record, spot the gap between published and enforcing, and check your own domain in 30 seconds. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-dmarc https://defaults.exposed/v9/articles/what-is-dmarc DMARC is the DNS record that tells mail servers to reject email forging your domain. The August 2026 census of 376,928,750 email-graded domains finds 90.7%, 341,945,132, publish no enforcing DMARC policy, and only 20.0% publish any DMARC record at all. Here is what DMARC is, how it works, and how to check yours free. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/domain-health-check-the-5-things-a-good-audit-covers https://defaults.exposed/v9/articles/domain-health-check-the-5-things-a-good-audit-covers A domain health check audits five layers, email authentication, TLS, DNS, security headers, and the overall grade. In the August 2026 census of 432,127,908 domains, only 2.9% (10,902,284) pass across every layer, which is exactly why the check exists. Here is what a good audit covers and how to run one on your own domain free. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-https-how-the-secure-web-actually-works https://defaults.exposed/v9/articles/what-is-https-how-the-secure-web-actually-works HTTPS is HTTP carried inside an encrypted, authenticated TLS connection, the baseline your browser polices with the 'Not Secure' warning. Yet the August 2026 census of 432,127,908 domains found 44 million still serving plain HTTP with no encryption at all. Here is how HTTPS actually works, what the padlock does and does not prove, and how to check your own site in 30 seconds. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/dns-security-explained-why-94-million-domains-rely-on-two-landlords https://defaults.exposed/v9/articles/dns-security-explained-why-94-million-domains-rely-on-two-landlords DNS security protects the integrity, availability and authenticity of the records that route your traffic and mail. The August 2026 census of 432,127,908 domains found roughly 94 million of the world's nameservers concentrated under just two DNS landlords, a systemic single point of failure most owners never see. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/cyber-insurance-requirements-2026-the-email-controls-underwriters-check https://defaults.exposed/v9/articles/cyber-insurance-requirements-2026-the-email-controls-underwriters-check Cyber insurance requirements in 2026 increasingly include an enforcing DMARC policy an underwriter can verify from public DNS. The August 2026 census of 376,928,750 email-graded domains finds only 2.9%, 10,902,284, are fully email-auth protected, so roughly 97% would fail the control most cyber underwriters now check at renewal. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/http-vs-https https://defaults.exposed/v9/articles/http-vs-https HTTP sends everything a visitor types in plain text; HTTPS encrypts it. The August 2026 census of 432,127,908 scanned domains finds 27 million still answer on HTTP and never redirect to a secure version, and 44 million serve no encryption at all. Here is exactly what changes between HTTP and HTTPS, whether HTTP is ever safe, and how to check your own site in 30 seconds. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/how-to-check-if-a-website-is-safe-in-2026 https://defaults.exposed/v9/articles/how-to-check-if-a-website-is-safe-in-2026 The fastest way to check if a website is safe is to read the machine-readable signals a browser hides (HTTPS, certificate validity, email spoofability, and security headers) because 'it looks fine' proves nothing when 295,157,813 domains (78.3%) earn an F grade in the August 2026 census of 432,127,908 scanned. Here are the seven signals that actually decide it, and how to run all seven on any domain in one click. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-a-certificate-authority https://defaults.exposed/v9/articles/what-is-a-certificate-authority A certificate authority (CA) is the trusted third party that vouches for a website's identity so browsers show a padlock instead of a warning. The August 2026 census of 432,127,908 domains found 3.3 million serving self-signed certificates that trust no CA at all, and among domains that publish a CAA record, 98.9% leave issuance unrestricted. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/domain-reputation-what-it-is-and-how-to-check-yours https://defaults.exposed/v9/articles/domain-reputation-what-it-is-and-how-to-check-yours Domain reputation is how mailbox providers decide whether to trust your mail, and it quietly leaks the moment your domain can be impersonated. The August 2026 census of 376,928,750 graded domains finds 90.7% (341,945,132) publish no enforcing DMARC, so most senders cannot stop spoofers from spending their reputation. Here is what domain reputation is, the signals that build or break it, and how to check yours in about 30 seconds. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-an-spf-record https://defaults.exposed/v9/articles/what-is-an-spf-record An SPF record lists which mail servers may send email using your domain's name. The August 2026 census of 376,928,750 email-graded domains found only 38.8%, 146,413,297, publish any SPF record at all, and most that do use a soft-fail ~all that invites spoofing rather than blocking it. Here is what an SPF record is, how the -all, ~all and +all mechanisms differ, and how to check and fix your own. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/ceo-fraud-explained-why-publishing-dmarc-is-not-enough https://defaults.exposed/v9/articles/ceo-fraud-explained-why-publishing-dmarc-is-not-enough CEO fraud is a wire-transfer scam that impersonates your chief executive by email. The August 2026 census finds 40,541,896 domains, 53.6% of every domain that publishes DMARC, sit at p=none, published but not enforcing, so the boss's own domain stays fully spoofable despite the 'we have DMARC' assumption. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/why-are-my-emails-going-to-spam https://defaults.exposed/v9/articles/why-are-my-emails-going-to-spam The most common reason your emails go to spam is not your subject line, it is missing authentication. The August 2026 census of 376,928,750 graded domains found 214,276,774 of them (56.8%) publish neither SPF nor DMARC, the exact records Gmail and Yahoo now demand before they trust your mail. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/dns-hijacking-and-spoofing-how-attackers-steal-domain-records https://defaults.exposed/v9/articles/dns-hijacking-and-spoofing-how-attackers-steal-domain-records DNS hijacking is the theft of the records that route your domain. The August 2026 census of 432,127,908 domains found 63,840,407 (14.8%) delegated in DNS but serving nothing, the exact dangling-delegation surface attackers scan for subdomain takeover. Here is how hijacking, spoofing, and cache poisoning work, and how to check your own domain in 30 seconds. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-clickjacking-x-frame-options-and-how-to-stop-it https://defaults.exposed/v9/articles/what-is-clickjacking-x-frame-options-and-how-to-stop-it Clickjacking loads your real site invisibly inside an attacker's page and tricks visitors into clicking things they never meant to. The August 2026 census of 432,127,908 domains finds only 8.0% of the web sets a Content-Security-Policy and under 1% deploys cross-origin isolation, so the frame defense is missing on most of the internet. Here is how the attack works and the one-line header fix. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/end-of-life-software-the-hidden-risk-on-6-6-million-domains https://defaults.exposed/v9/articles/end-of-life-software-the-hidden-risk-on-6-6-million-domains End-of-life software is any program the vendor no longer patches, and the August 2026 census found 6.6 million public domains running end-of-life server software with no security updates, the exact 'unsupported software' gap cyber-insurance policies and NIS2 now penalise. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/nis2-compliance-and-email-authentication-what-the-directive-requires https://defaults.exposed/v9/articles/nis2-compliance-and-email-authentication-what-the-directive-requires NIS2 compliance requires in-scope entities to take appropriate technical measures to manage cyber risk, and email authentication is textbook baseline hygiene. The August 2026 census of 376,928,750 email-graded domains finds 214,276,774, 56.8%, publish neither SPF nor DMARC, and only 20.0% publish any DMARC at all. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-domain-spoofing-exact-domain-vs-look-alike-attacks https://defaults.exposed/v9/articles/what-is-domain-spoofing-exact-domain-vs-look-alike-attacks Domain spoofing is any attack that makes a message or site appear to come from a domain the sender does not control. In the August 2026 census of 376,928,750 email-graded domains, 56.4% of the domains that publish SPF, 82,539,695, use a soft-fail setting that never actually blocks a forged message, which is one reason most domains stay spoofable. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-hsts-the-header-79-9-of-sites-still-skip https://defaults.exposed/v9/articles/what-is-hsts-the-header-79-9-of-sites-still-skip HSTS is a one-line header that forces browsers to use HTTPS only, closing the gap a plain redirect leaves open. The August 2026 census measured HSTS across 231,991,983 domains and found only 20.1%, 46,539,716, deploy it, with just 2.57% preload-ready. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/http-security-headers-the-complete-checklist https://defaults.exposed/v9/articles/http-security-headers-the-complete-checklist Only 8.0% of the web sets a Content-Security-Policy, 20.1% deploy HSTS, and 91% omit Referrer-Policy, with cross-origin isolation under 1%. The August 2026 census of 432,127,908 scanned domains scores every major HTTP security header; here is the complete checklist, what each one stops, and how to add and verify them. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/ssl-vs-tls https://defaults.exposed/v9/articles/ssl-vs-tls SSL and TLS are two generations of the same encryption protocol, and the 'SSL certificates' people buy are really TLS certificates, SSL itself was deprecated back in 2015. The August 2026 census of 231,991,983 HTTPS-serving domains found 5.2 million serving expired certificates and 3.3 million serving self-signed ones, proof that 'SSL health' comes down to TLS version and certificate validity. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-dnssec-a-plain-english-guide-to-the-dns-trust-layer https://defaults.exposed/v9/articles/what-is-dnssec-a-plain-english-guide-to-the-dns-trust-layer DNSSEC is a cryptographic signature layer that lets resolvers verify a DNS answer is genuine and unaltered. The August 2026 census of 432,127,908 domains found 157,064 with broken DNSSEC, signed but failing validation, proof that switching it on is easy and keeping the chain of trust valid is the hard part. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-a-wildcard-certificate-uses-risks-and-when-to-avoid https://defaults.exposed/v9/articles/what-is-a-wildcard-certificate-uses-risks-and-when-to-avoid A wildcard certificate secures unlimited subdomains under a single *.example.com key. In the August 2026 census, 28.5% of TLS-serving domains rely on one, convenient, but a single stolen private key covers every subdomain at once. Here is how wildcards compare to SAN and single-domain certificates, the blast-radius risk that follows, and when to avoid one. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-a-bimi-record https://defaults.exposed/v9/articles/what-is-a-bimi-record A BIMI record publishes your brand logo so it shows next to authenticated email, but it only works on top of an enforcing DMARC policy. The August 2026 census of 376,928,750 graded domains finds only 9.3% (34,983,618) meet that floor, so the other 90.7% are locked out of BIMI until they enforce. Here is how a BIMI record works, what it really requires, and how to check whether your domain qualifies. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/email-spoofing-explained-why-90-7-of-domains-can-be-forged https://defaults.exposed/v9/articles/email-spoofing-explained-why-90-7-of-domains-can-be-forged Email spoofing works because most domains publish no enforcing policy. The August 2026 census of 376.9M domains finds 90.7%, 341.9 million, have no enforcing DMARC, and 56.8% have no SPF or DMARC at all. How spoofing works, how to detect it, and how to stop it. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/invoice-fraud-prevention-closing-the-domain-spoofing-gap-behind-bec https://defaults.exposed/v9/articles/invoice-fraud-prevention-closing-the-domain-spoofing-gap-behind-bec Invoice fraud and business email compromise succeed because the supplier's domain can be spoofed. The August 2026 census finds ~195 million mail-receiving domains lack an enforcing DMARC policy. The accounts-payable controls that stop invoice fraud, plus the one technical control most programs miss. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-dns-landlords-how-godaddy-and-cloudflare-control-nameservers-for-94-million-domains https://defaults.exposed/v9/articles/the-dns-landlords-how-godaddy-and-cloudflare-control-nameservers-for-94-million-domains GoDaddy and Cloudflare together hold authoritative DNS for 94.7 million domains, 25.1% of the entire graded web, per our August 2026 census of 376.9 million domains. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-silent-domain-56-8-of-the-internet-has-no-email-authentication https://defaults.exposed/v9/articles/the-silent-domain-56-8-of-the-internet-has-no-email-authentication 214 million domains, 56.8% of the graded web, publish neither SPF nor DMARC, making the majority of the internet trivially spoofable. August 2026 census of 376.9M domains. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/who-reads-the-world-s-dmarc-reports https://defaults.exposed/v9/articles/who-reads-the-world-s-dmarc-reports One company receives DMARC spoofing-attack telemetry for 46.8%, 13.9 million, of every report-collecting domain in our 432M-domain census. In most cases nobody chose it. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/spf-hard-fail-vs-soft-fail-why-82-million-domains-are-using-the-weaker-setting https://defaults.exposed/v9/articles/spf-hard-fail-vs-soft-fail-why-82-million-domains-are-using-the-weaker-setting 82,539,695 domains, 56.4% of all SPF publishers, end their record with ~all (soft fail), providing little real protection. August 2026 census data across 146 million SPF records shows why soft fail became the default and what it costs. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/nine-million-domains-where-a-grades-round-to-zero https://defaults.exposed/v9/articles/nine-million-domains-where-a-grades-round-to-zero Across 9,338,016 GoDaddy-default domains, exactly 198 earn an A, an A-rate that rounds to 0.00%. We graded 164.7 million domains by email provider to find out what your MX record says about your security. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/dmarc-without-spf-16-million-domains-with-half-an-email-authentication-stack https://defaults.exposed/v9/articles/dmarc-without-spf-16-million-domains-with-half-an-email-authentication-stack 16,238,679 domains publish DMARC but have no SPF record at all, leaving every sending path that lacks DKIM signing with no authentication fallback. August 2026 census data across 376 million domains graded. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-google-and-yahoo-deadline-two-years-on-where-email-authentication-stands-in-august-2026 https://defaults.exposed/v9/articles/the-google-and-yahoo-deadline-two-years-on-where-email-authentication-stands-in-august-2026 Two and a half years after Google and Yahoo made DMARC a hard requirement, only 9.3% of 376 million graded domains enforce it. 56.8%, 214 million domains, still publish neither SPF nor DMARC at all. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-security-correlation-which-controls-cluster-together-and-which-sit-alone https://defaults.exposed/v9/articles/the-security-correlation-which-controls-cluster-together-and-which-sit-alone 56.8% of 376.9M graded domains have neither SPF nor DMARC. Only 2.9% have all five core controls. Security controls cluster because operator maturity, not cost, is the real variable. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-top-1-of-the-internet-starts-at-a-b https://defaults.exposed/v9/articles/the-top-1-of-the-internet-starts-at-a-b 376.9M domains scored: entry to the top 1% is 82/100, a B grade. Only 0.15% earn an A. The median domain scores 45, a failing F. The web has no security middle class. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-locked-vault-only-10-9-million-domains-close-every-attack-surface-simultaneously https://defaults.exposed/v9/articles/the-locked-vault-only-10-9-million-domains-close-every-attack-surface-simultaneously Only 10.9M of 376.9M graded domains (2.9%) pass all five core controls at once. 1.2M (0.33%) fail every single one. The gap is not technical, it is operational. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-last-mile-of-https-why-27-million-domains-respond-to-http-but-never-redirect https://defaults.exposed/v9/articles/the-last-mile-of-https-why-27-million-domains-respond-to-http-but-never-redirect ~27 million domains have valid TLS certificates but still serve unencrypted HTTP with no redirect and no HSTS, every visitor who types the domain without 'https://' is exposed to SSL stripping. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-90-day-web-certificate-lifetimes-in-2026 https://defaults.exposed/v9/articles/the-90-day-web-certificate-lifetimes-in-2026 67.7% of 231.5 million TLS certificates observed in the defaults.exposed August 2026 Domain Security Census were issued for exactly 90 days, the annual certificate is collapsing, and the 47-day era is next. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/rsa-vs-ecdsa-in-2026-measuring-the-web-s-key-migration https://defaults.exposed/v9/articles/rsa-vs-ecdsa-in-2026-measuring-the-web-s-key-migration 425,004 live TLS certificates are still signed with MD5, and RSA still holds 59.3% of 231.5 million keys measured in the defaults.exposed August 2026 Domain Security Census, the key migration is real but moving at the speed of defaults, not advice. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/one-ca-to-rule-them-all-the-certificate-monoculture-report https://defaults.exposed/v9/articles/one-ca-to-rule-them-all-the-certificate-monoculture-report Let's Encrypt now secures 50.2% of all 231.5 million certificate-presenting domains measured in the defaults.exposed August 2026 Domain Security Census, and in 23 country-code zones, a single CA holds 80% or more of everything. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/expired-ssl-certificates-5-2-million-sites-still-serving https://defaults.exposed/v9/articles/expired-ssl-certificates-5-2-million-sites-still-serving 5,157,928 live websites were serving an expired TLS certificate at the moment of the defaults.exposed August 2026 Domain Security Census sweep, 47.8% of those certificates had been expired for over a year. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/self-signed-certificates-the-3-3-million-domain-census https://defaults.exposed/v9/articles/self-signed-certificates-the-3-3-million-domain-census 3,306,642 of 231.5 million TLS certificates observed in the defaults.exposed August 2026 Domain Security Census are self-signed, including 375,842 still carrying the 'Internet Widgits Pty Ltd' OpenSSL example default. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/wildcard-certificates-28-5-of-the-tls-web-on-one-key https://defaults.exposed/v9/articles/wildcard-certificates-28-5-of-the-tls-web-on-one-key 28.5% of the TLS web, 66,011,927 of 231.5 million domains measured in the defaults.exposed August 2026 Domain Security Census, runs on wildcard certificates, sharing one private key across every subdomain. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/caa-records-98-9-of-domains-never-restrict-their-ca https://defaults.exposed/v9/articles/caa-records-98-9-of-domains-never-restrict-their-ca 98.9% of 376,928,750 domains measured in the defaults.exposed August 2026 Domain Security Census publish no CAA record, leaving them open to certificate issuance by any of approximately 300 publicly trusted certificate authorities. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/cipher-suites-in-2026-what-strong-encryption-really-means https://defaults.exposed/v9/articles/cipher-suites-in-2026-what-strong-encryption-really-means Two cipher suites carried 94.33% of 212 million measured TLS handshakes in the defaults.exposed August 2026 Domain Security Census, and RC4, 3DES, and export-grade ciphers appeared zero times. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/tls-1-3-by-country-which-tlds-win-on-defaults-2026 https://defaults.exposed/v9/articles/tls-1-3-by-country-which-tlds-win-on-defaults-2026 94.9% of 231.5 million TLS-completing domains negotiate TLS 1.3, but South Korea's .kr lags at 73.3% and the US .gov TLD at 77.0%, revealing how infrastructure age, not national wealth, determines encryption quality. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-http-only-problem-44-million-domains-serving-unencrypted-web-in-2026 https://defaults.exposed/v9/articles/the-http-only-problem-44-million-domains-serving-unencrypted-web-in-2026 44,443,652 domains, 11.8% of 376.9 million graded, serve HTTP with no TLS, no redirect, and no HSTS, despite free certificates being universally available for over a decade. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/content-security-policy-adoption-in-2026-the-8-0-web https://defaults.exposed/v9/articles/content-security-policy-adoption-in-2026-the-8-0-web Only 8.0% of 257.6 million measurable domains serve an effective Content-Security-Policy, and 48.3% of those who do land on just two identical scores, revealing platform defaults rather than deliberate security choices. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-isolation-headers-why-coop-coep-and-corp-cover-less-than-1-of-the-web https://defaults.exposed/v9/articles/the-isolation-headers-why-coop-coep-and-corp-cover-less-than-1-of-the-web COOP appears on 0.78%, COEP on 0.48%, and CORP on 0.65% of 376.9 million domains, four years after Spectre made cross-origin isolation essential, fewer than 1 in 100 sites have deployed any of the three required headers. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/hsts-adoption-2026-the-half-locked-door https://defaults.exposed/v9/articles/hsts-adoption-2026-the-half-locked-door 79.9% of 232 million HTTPS domains send no HSTS header, and only 12.8% of those that do publish a preload-ready policy, leaving most of the encrypted web unprotected against SSL-stripping attacks. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/referrer-policy-the-privacy-header-91-of-the-web-forgot https://defaults.exposed/v9/articles/referrer-policy-the-privacy-header-91-of-the-web-forgot 91.4% of 231.9 million HTTP responses carry no Referrer-Policy, leaving browser defaults to decide whether full URLs, search terms, and path-embedded tokens are shared with every third-party server a page contacts. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/secure-by-default-the-server-software-security-showdown https://defaults.exposed/v9/articles/secure-by-default-the-server-software-security-showdown Netlify sends HSTS on 95.9% of its sites; Apache on 7.0%, a 13.7× gap across 191.7 million responses showing how your hosting choice, not your security team, determines what protection your users receive. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/end-of-life-software-census-6-6-million-servers-admit-it https://defaults.exposed/v9/articles/end-of-life-software-census-6-6-million-servers-admit-it 6,635,647 end-of-life software banners counted across 376.9 million domains, including 2.36 million still running PHP 7.4, nearly four years after its last security patch. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/soa-records-the-internet-s-most-neglected-setting https://defaults.exposed/v9/articles/soa-records-the-internet-s-most-neglected-setting 50.5% of 275 million measured domains carry an SOA retry or expire timer outside recommended ranges, the DNS record nobody has ever reviewed. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/single-nameserver-domains-one-record-from-oblivion https://defaults.exposed/v9/articles/single-nameserver-domains-one-record-from-oblivion 290,673 domains run on a single nameserver, a complete single point of failure for website, email, and every DNS-dependent service. August 2026 census of 376.9M domains. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/broken-dnssec-157-064-domains-are-invisibly-down https://defaults.exposed/v9/articles/broken-dnssec-157-064-domains-are-invisibly-down 157,064 domains have broken DNSSEC chains, a hard SERVFAIL for every validating resolver. That's 1 in 709 signed domains, and owners can't see the failure. August 2026 census. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/null-mx-adoption-2026-14-5-million-domains-opt-out https://defaults.exposed/v9/articles/null-mx-adoption-2026-14-5-million-domains-opt-out 14,455,076 domains publish a null MX record, only 7.0% of the 207 million no-mail domains we graded. RFC 7505 adoption, measured across 376.9M domains. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/zombie-mx-records-mail-routed-to-dead-domains https://defaults.exposed/v9/articles/zombie-mx-records-mail-routed-to-dead-domains At least 43,723 dead or unreachable domains still publish mail-routing MX records, a floor figure, not an estimate. The mail is a potential account-takeover risk. August 2026 census. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/dmarc-pct-tag-476-000-domains-water-down-enforcement https://defaults.exposed/v9/articles/dmarc-pct-tag-476-000-domains-water-down-enforcement 476,465 domains publish DMARC quarantine or reject, then weaken it with a pct value below 100. We parsed 75.5 million DMARC records to find out where the dials are set. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/dmarc-subdomain-policy-1-3-million-sp-back-doors https://defaults.exposed/v9/articles/dmarc-subdomain-policy-1-3-million-sp-back-doors 1,313,312 domains enforce DMARC at the apex then explicitly exempt their entire subdomain namespace, including 459,577 that reached p=reject and then set sp=none. We parsed 75.5 million records to find the back doors. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/does-cloudflare-make-you-safer-41-9m-domains-graded https://defaults.exposed/v9/articles/does-cloudflare-make-you-safer-41-9m-domains-graded 67.7% of the 41.9 million Cloudflare-fronted domains still score an F, virtually identical to the rest of the web, yet Cloudflare holds 48.7% of all A+ grades. August 2026 census data across 205 million HTTP responses. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-hosting-league-table-domain-security-by-dns-provider https://defaults.exposed/v9/articles/the-hosting-league-table-domain-security-by-dns-provider GoDaddy carries 52.4 million domains at 82.9% grade F, and 52% of every A-grade domain on the internet sits behind Cloudflare alone. We attributed 376.9 million graded domains to their DNS provider. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-web-server-census-2026-nginx-apache-cloudflare-and-the-invisible-half https://defaults.exposed/v9/articles/the-web-server-census-2026-nginx-apache-cloudflare-and-the-invisible-half 45.6% of 376 million measured domains suppress their Server header entirely, nearly half the web declines to say what it runs. Of those that declare, Cloudflare leads with 43 million entries. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/parked-domains-91-grade-f-across-2-1-million-measured https://defaults.exposed/v9/articles/parked-domains-91-grade-f-across-2-1-million-measured 91.3% of 2,147,113 parked domains grade F, compared to 78.3% across the general web. Exactly one parked domain out of 2.1 million earns an A. Parking provider defaults, not owner choices, set the grade. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/who-guards-the-web-cloudflare-wafs-and-the-cdn-vs-origin-measurement-problem https://defaults.exposed/v9/articles/who-guards-the-web-cloudflare-wafs-and-the-cdn-vs-origin-measurement-problem 43,008,476 domains return 'Server: cloudflare' in the August 2026 census, but that number conflates CDN edge-termination with security protection. WAF rules, end-to-end encryption, and origin hardening are invisible in a server header. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/ipv6-only-domains-80-737-sites-living-without-ipv4 https://defaults.exposed/v9/articles/ipv6-only-domains-80-737-sites-living-without-ipv4 Just 80,737 of 376.9 million graded domains publish only an IPv6 address, 0.021%, one in 4,668. Even among the 67.4 million domains that already have IPv6, only one in 834 has dropped IPv4. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/domain-dark-matter-64-million-delegated-empty-domains https://defaults.exposed/v9/articles/domain-dark-matter-64-million-delegated-empty-domains 63,840,407 domains, 14.8% of 432 million scanned, have working DNS delegation but no website and no mail route. More than one in three registered domains never produced a gradable scan at all. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-flaky-internet-20-million-domains-that-only-sometimes-answer https://defaults.exposed/v9/articles/the-flaky-internet-20-million-domains-that-only-sometimes-answer 19,814,020 domains, 4.6% of 432 million scanned, produced inconsistent results across three independent scan attempts. 14.64% of domains that failed their first scan recovered on retry. Here is what that means for internet security measurement. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/new-gtld-ghost-towns-where-a-third-of-domains-are-dead https://defaults.exposed/v9/articles/new-gtld-ghost-towns-where-a-third-of-domains-are-dead 36% of 63.8 million new-gTLD domains are dead or unreachable, 2.6 times the legacy-gTLD rate. In .bond, 87.3% of the namespace is gone. Only 58.4% of new-gTLD domains were alive enough to receive a security grade. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-phantom-tld-problem-the-domains-that-don-t-exist https://defaults.exposed/v9/articles/the-phantom-tld-problem-the-domains-that-don-t-exist 8 of 1,386 TLDs answer for every name you can invent, inflating .ph's domain count 250× to 14.6 million when the true registration base is about 57,874. Two TLDs were still broadcasting ICANN's name-collision hazard beacon in August 2026. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/do-registry-rules-work-bank-3-1-f-vs-com-72-4 https://defaults.exposed/v9/articles/do-registry-rules-work-bank-3-1-f-vs-com-72-4 3.1% of .bank domains grade F versus 72.4% on .com, a 23× gap. Registry mandates move exactly what they name: vetted-only .pharmacy grades 84.5% F, worse than the open market. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/cheap-domains-cheap-security-budget-tlds-vs-the-rest https://defaults.exposed/v9/articles/cheap-domains-cheap-security-budget-tlds-vs-the-rest 88.8% of 19.2M graded budget-TLD domains score F, versus 72.4% on .com and 33.7% on .ch. On .top, 96.1% fail and 51.5% of scanned names were dead at scan time. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/dmarc-gap-87-million-domains-one-record-from-safety https://defaults.exposed/v9/articles/dmarc-gap-87-million-domains-one-record-from-safety 86.9 million domains, 23.1% of 376.9M graded, have SPF but no DMARC record: one free DNS TXT entry away from an anti-spoofing policy. The internet's largest cheap-to-close security deficit. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-b-ceiling-where-the-climb-to-an-a-grade-stalls https://defaults.exposed/v9/articles/the-b-ceiling-where-the-climb-to-an-a-grade-stalls 5.82 million domains score 80–89 but only 549,635 reach 90+. The biggest B-to-A gap is DMARC reporting: 34.4% of B-band domains fail it versus roughly 7% of A-band domains. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/en/articles/spf-failing-saas-senders-europe https://defaults.exposed/en/articles/spf-failing-saas-senders-europe SPF fails silently when SaaS include: chains exceed 10 DNS lookups, a limit millions of UK and EU businesses have already crossed. 828,317 domains confirmed affected. Check yours free. Thu, 13 Aug 2026 12:00:00 GMT https://defaults.exposed/en/articles/the-state-of-domain-security-2026 https://defaults.exposed/en/articles/the-state-of-domain-security-2026 We graded 377 million domains across 34 security checks. 78.3% score an F, only 9.28% enforce DMARC, 61.41% use HTTPS, and -1.13% get every security header right. The signal-by-signal state of the internet. Thu, 13 Aug 2026 12:00:00 GMT https://defaults.exposed/en/articles/bimi-qualification-report https://defaults.exposed/en/articles/bimi-qualification-report BIMI puts your logo beside your email, but only domains that enforce DMARC qualify. Just 9.28% of graded domains clear that bar. Data as of 2026-08-16. Sat, 01 Aug 2026 12:00:00 GMT https://defaults.exposed/en/articles/certificate-authority-race-2026 https://defaults.exposed/en/articles/certificate-authority-race-2026 Free certificates won: Let's Encrypt signs 52.6% of 212M certificate observations in our census. The SSL platform race: GoDaddy 18.6% vs Google Trust Services 17.3%. Data as of 2026-08-16. Sat, 01 Aug 2026 12:00:00 GMT https://defaults.exposed/en/articles/com-vs-ai-domain-security https://defaults.exposed/en/articles/com-vs-ai-domain-security .ai domains enforce DMARC email protection nearly three times as often as .com, we measured both in our 377-million-domain census. Sat, 01 Aug 2026 12:00:00 GMT https://defaults.exposed/en/articles/dmarc-enforcement-report-july-2026 https://defaults.exposed/en/articles/dmarc-enforcement-report-july-2026 How many domains enforce DMARC against email spoofing, our monthly tracker across 377 million domains, updated each census. Data as of 2026-08-16. Sat, 01 Aug 2026 12:00:00 GMT https://defaults.exposed/en/articles/dns-concentration-report https://defaults.exposed/en/articles/dns-concentration-report GoDaddy and Cloudflare answer DNS for roughly a third of 377 million domains. The concentration risk, explained. Data as of 2026-08-16. Sat, 01 Aug 2026 12:00:00 GMT https://defaults.exposed/en/articles/dnssec-adoption-report https://defaults.exposed/en/articles/dnssec-adoption-report Only 5.05% of the domains we could evaluate publish a valid DNSSEC chain. Another 157,064 zones are signed but broken, which risks taking them offline for users behind validating resolvers. Data as of 2026-08-16. Sat, 01 Aug 2026 12:00:00 GMT https://defaults.exposed/en/articles/fully-protected-domains-club https://defaults.exposed/en/articles/fully-protected-domains-club What is a 'fully protected' domain? 2.79% run SPF, DKIM + enforcing DMARC; 1 in 330 hold all five controls. 377M-domain census, 2026-08-16. Sat, 01 Aug 2026 12:00:00 GMT https://defaults.exposed/en/articles/internet-rot-report-dead-unreachable-zombie-domains https://defaults.exposed/en/articles/internet-rot-report-dead-unreachable-zombie-domains Dead domains, zombie MX records, and unreachable hosts in our 432-million-domain internet census, the full breakdown. Data as of 2026-08-16. Sat, 01 Aug 2026 12:00:00 GMT https://defaults.exposed/en/articles/july-2026-domain-security-census https://defaults.exposed/en/articles/july-2026-domain-security-census The July 2026 census graded 376,928,750 domains. 78.3% scored an F, while DMARC enforcement climbed to 9.28%. Data as of 2026-08-16. Sat, 01 Aug 2026 12:00:00 GMT https://defaults.exposed/en/articles/tls-13-adoption-report https://defaults.exposed/en/articles/tls-13-adoption-report How TLS 1.3 reached near-universal adoption — our census of 377 million TLS-reachable domains. Data as of 2026-08-16. Sat, 01 Aug 2026 12:00:00 GMT https://defaults.exposed/en/articles/who-hosts-the-internets-email https://defaults.exposed/en/articles/who-hosts-the-internets-email Census of 377M domains: 52.8% of those with mail servers run self-hosted or on smaller email providers. The cloud giants have not won the domain count. Data as of 2026-08-16. Sat, 01 Aug 2026 12:00:00 GMT https://defaults.exposed/en/articles/dmarc-reject-vs-quarantine https://defaults.exposed/en/articles/dmarc-reject-vs-quarantine reject refuses forged mail outright; quarantine sends it to spam. Of the 9.28% of domains that enforce DMARC, the split is almost even, 5.08% quarantine, 4.21% reject. How to choose, the staged path up, and how to roll back safely. As of 2026-08-16. Sat, 25 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/dmarc-vs-spf https://defaults.exposed/en/articles/dmarc-vs-spf SPF lists which servers may send email for your domain. DMARC decides what happens when a message fails, and it's the only one that protects the 'From' address people actually see. 38.84% of domains publish SPF; just 9.28% enforce DMARC. What each does, why you need both, and in which order. Data as of 2026-08-16. Sat, 25 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/email-authentication-guide https://defaults.exposed/en/articles/email-authentication-guide SPF, DKIM and DMARC are one system, not three projects. 38.84% of 377 million graded domains publish SPF, but only 9.28% enforce DMARC, the step that actually stops impersonation. The full stack, in order, with a verification gate at each stage. Data as of 2026-08-16. Sat, 25 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/what-is-bimi-email-brand-logo https://defaults.exposed/en/articles/what-is-bimi-email-brand-logo BIMI shows your brand logo in email clients like Gmail and Apple Mail. It requires DMARC enforcement first, and only 9.28% of domains we've graded have reached that bar. Data as of 2026-08-16. Mon, 06 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/119-million-domains-spf-no-enforcement https://defaults.exposed/en/articles/119-million-domains-spf-no-enforcement 121 million domains publish SPF but never enforce DMARC, 85.4% of everyone who set SPF up. Is SPF enough? Measured across the whole internet: no. Only 2.79% of domains are fully email-protected. The exposure, counted. As of 2026-08-16. Fri, 03 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/all-qualifier-softfail-vs-hardfail https://defaults.exposed/en/articles/all-qualifier-softfail-vs-hardfail SPF softfail vs hardfail: 55.9% of records end in ~all, and only 1 in 11 has the setting that gives softfail teeth. Data as of 2026-08-16. Fri, 03 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/dmarc-publishing-blind https://defaults.exposed/en/articles/dmarc-publishing-blind Only 39.4% of the 71M domains publishing DMARC request reports (rua=). The rest are publishing blind, and one DNS edit fixes it. Fri, 03 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/the-6-stages-of-dmarc-maturity https://defaults.exposed/en/articles/the-6-stages-of-dmarc-maturity 20.05% of domains publish a DMARC record, only 9.28% enforce one. A six-stage maturity model, from Unprotected to Hardened, that explains where domains stall and the one move that advances each stage. Fri, 03 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/the-email-spoofability-index https://defaults.exposed/en/articles/the-email-spoofability-index 9 in 10 domains can be forged: 88.2% of the internet publishes no policy telling receivers to reject or junk failed mail. The spoofability index, from a census of 377 million domains. Data as of 2026-08-16. Fri, 03 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/the-fully-protected-few https://defaults.exposed/en/articles/the-fully-protected-few Only 2.79% of domains, 7,678,989, run the full enforced email stack: SPF, DKIM, DMARC at quarantine/reject. Just 0.30% hold all five protections. Fri, 03 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/the-plus-all-map https://defaults.exposed/en/articles/the-plus-all-map 36,262 domains end their SPF record with +all, explicit permission for anyone on Earth to send email as them. Where the welcome mats cluster, how they got there, and the one-character fix. Data as of 2026-08-16. Fri, 03 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/the-spf-adoption-maturity-model https://defaults.exposed/en/articles/the-spf-adoption-maturity-model The average domain sits at SPF stage 2.4 of 6. SPFAMM: the six-stage SPF maturity model, find your stage and the one move up. Data as of 2026-08-16. Fri, 03 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/the-spf-permerror-report https://defaults.exposed/en/articles/the-spf-permerror-report SPF voids itself past 10 DNS lookups, and the breakage hides inside include: chains. At least 828,317 domains are over the limit. Data as of 2026-08-16. Fri, 03 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/the-spf-ptr-trap https://defaults.exposed/en/articles/the-spf-ptr-trap The SPF ptr mechanism was deprecated in 2014, slow, unreliable, and a drain on the 10-lookup budget. 12 years later, 946,056 domains still publish it. Data as of 2026-08-16. Fri, 03 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/two-spf-records-equals-none https://defaults.exposed/en/articles/two-spf-records-equals-none Two SPF records void both: 1,019,482 domains publish multiple v=spf1 records, which the standard treats as a permanent error. The copy-paste mistake that switches SPF off, measured across 377 million domains. Data as of 2026-08-16. Fri, 03 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/which-email-provider-strongest-spf https://defaults.exposed/en/articles/which-email-provider-strongest-spf 84.9% of Microsoft 365 domains end SPF with strict -all; 7.6% of Google Workspace domains do, and no major mailbox provider's customers get past 30% enforced. Data as of 2026-08-16. Fri, 03 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/cyber-insurance-security-questionnaire https://defaults.exposed/en/articles/cyber-insurance-security-questionnaire Insurers and enterprise buyers now ask whether you enforce DMARC, serve modern TLS, and lock down DNS. Across 377 million graded domains, only 2.79% are fully email-protected, so most can't honestly tick the boxes. What's asked and how the internet actually scores. Data as of 2026-08-16. Wed, 01 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/domain-and-dns-hijacking https://defaults.exposed/en/articles/domain-and-dns-hijacking Hijacking redirects your visitors and email without touching your servers. The two DNS controls that stop it are barely used: 5.05% of 377 million graded domains have valid DNSSEC and 2.20% publish CAA. How domains are stolen and how to lock yours. Data as of 2026-08-16. Wed, 01 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/ssl-certificate-expired-how-to-fix https://defaults.exposed/en/articles/ssl-certificate-expired-how-to-fix An expired or invalid certificate throws a full-page browser warning that stops visitors cold. Across domains serving HTTPS, 9.54% present an invalid certificate. Why certificates fail and how to fix, and prevent, it. Data as of 2026-08-16. Wed, 01 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/weak-and-outdated-tls https://defaults.exposed/en/articles/weak-and-outdated-tls Good news: 94.88% of HTTPS sites now negotiate TLS 1.3. But 'weak TLS' hasn't vanished, it hides in servers that still accept old versions, weak ciphers, and broken certificates (9.54% invalid across 377 million graded domains). How to check you're not the exception. Data as of 2026-08-16. Wed, 01 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/what-is-dmarc-none-quarantine-reject https://defaults.exposed/en/articles/what-is-dmarc-none-quarantine-reject DMARC is the record that decides whether forged email in your name gets delivered. Only 9.28% of 377 million graded domains set it to enforce, the rest either have none or a monitor-only policy that does nothing. What each policy means and how to set it. Data as of 2026-08-16. Wed, 01 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/what-is-dnssec-and-do-i-need-it https://defaults.exposed/en/articles/what-is-dnssec-and-do-i-need-it DNSSEC signs your DNS so answers can't be forged in transit. Only 5.05% of 377 million graded domains have it, and a misconfigured signature can take you offline. What it protects, who needs it, and how to turn it on safely. Data as of 2026-08-16. Wed, 01 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/what-is-spf-and-how-to-fix-it https://defaults.exposed/en/articles/what-is-spf-and-how-to-fix-it SPF tells the world which servers may send email for your domain. 38.84% of 377 million graded domains publish one, but a record alone isn't protection. The common mistakes, and how to fix yours. Data as of 2026-08-16. Wed, 01 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/your-connection-is-not-private https://defaults.exposed/en/articles/your-connection-is-not-private The full-page 'your connection is not private' warning almost always means a certificate problem. Across domains serving HTTPS, 9.54% present an invalid certificate that triggers it. What the error codes mean and how to clear it. Data as of 2026-08-16. Wed, 01 Jul 2026 12:00:00 GMT https://defaults.exposed/en/articles/best-tlds-for-domain-security https://defaults.exposed/en/articles/best-tlds-for-domain-security Only 0.146% of graded domains earn an A or A+, yet a handful of TLDs run about 7.4× that rate. We dig into which top-level domains have proportionally the most A and A+ domains, as of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/can-someone-spoof-my-domain https://defaults.exposed/en/articles/can-someone-spoof-my-domain Only 9.28% of 377 million graded domains enforce DMARC, the one control that actually stops email impersonation. The other 90.72% can be spoofed. What that means for invoice fraud, and how to tell if you're protected. Data as of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/certificate-authority-market-share https://defaults.exposed/en/articles/certificate-authority-market-share Across 212 million certificates, Let's Encrypt issues 52.6% and GoDaddy 18.6%, together 71.2% of the encrypted web runs on just two certificate authorities. The CA market, measured. As of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/certificate-error-report https://defaults.exposed/en/articles/certificate-error-report 8.77% of the web's TLS certificates fail validation, 18,602,449 domains that present a certificate browsers won't trust. 3,306,642 are self-signed. The certificate errors that show visitors a warning, in census data. As of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/dmarc-p-none-is-not-protection https://defaults.exposed/en/articles/dmarc-p-none-is-not-protection A DMARC policy of p=none monitors but doesn't protect, your domain can still be impersonated. 10.76% of domains sit at p=none, more than the 9.28% that actually enforce. The false-security trap, in census data. As of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/dmarc-typos https://defaults.exposed/en/articles/dmarc-typos 38,650 domains published a DMARC record with a misspelled or invalid policy — "quarentine", "ninguno", "non", or no policy at all — and get zero protection as a result. The typos that quietly break email security, from 71 million DMARC records. Data as of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/does-mandatory-dnssec-work https://defaults.exposed/en/articles/does-mandatory-dnssec-work Where registries push DNSSEC, valid adoption runs ~7× higher, 28.0% on registry-driven endings vs 3.3% elsewhere (.se 52.83% vs .com 3.79%). But even the leaders break it more than they get it right. The data, as of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/does-nis2-require-dmarc https://defaults.exposed/en/articles/does-nis2-require-dmarc NIS2 doesn't name DMARC, but it requires cyber-hygiene measures, and email authentication is a baseline anti-spoofing control. Yet across the EU, even the best member state has only 22.93% of domains able to stop impersonation, and most sit far lower. Where EU domains actually stand, as of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/domain-exposure-score https://defaults.exposed/en/articles/domain-exposure-score Scored across five core protections (SPF, enforced DMARC, DNSSEC, HTTPS and HSTS) the typical domain has just one or two. 8.5% have none at all; only 0.30% have all five. The exposure curve of 377 million domains, as of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/email-hosting-market-share https://defaults.exposed/en/articles/email-hosting-market-share Among 163 million domains with an identifiable mail host, 12.7% route mail through Google Workspace and 8.6% through Microsoft 365, but the biggest category is self-hosted. Email hosting market share, as of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/end-of-life-php-on-the-web https://defaults.exposed/en/articles/end-of-life-php-on-the-web Of the 13 million sites that reveal their PHP version, 42.2% run an end-of-life release that no longer gets security patches, and the single most common version is 7.4.33, dead since 2022. The unpatched PHP web, in census data. As of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/google-yahoo-sender-requirements https://defaults.exposed/en/articles/google-yahoo-sender-requirements Google, Yahoo and Microsoft now require SPF, DKIM and DMARC to deliver bulk email. Yet only 38.84% of domains publish SPF, -16.40% DKIM, and 20.05% have any DMARC. Whether your domain meets the bar, in census data. As of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/http-security-header-report-card https://defaults.exposed/en/articles/http-security-header-report-card Security headers are free, one-line defences against clickjacking, injection and snooping, and almost nobody sets them. Across 377 million domains, just -1.13% get every header right. CSP -14.07%, HSTS 18.75%, clickjacking protection -20.96%. Data as of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/misconfiguration-hall-of-fame https://defaults.exposed/en/articles/misconfiguration-hall-of-fame 375,840 sites serve a TLS certificate literally named "Internet Widgits Pty Ltd" — the placeholder nobody changed. DMARC policies written in the wrong language, SPF records that invite the whole internet in, and other gems from a 377-million-domain census. As of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/nameserver-concentration https://defaults.exposed/en/articles/nameserver-concentration Five providers run 44.5% of the internet's DNS. GoDaddy alone hosts 18.5% and Cloudflare 14.7%. The systemic risk of DNS concentration, across 278 million domains. As of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/spf-misconfiguration-report https://defaults.exposed/en/articles/spf-misconfiguration-report 141 million domains publish SPF, but 55.9% use the weak '~all' softfail setting and only 39.2% use strict '-all'. Plus 36,262 domains use '+all', which authorises the entire internet to send as them. The misconfigurations hiding inside published SPF. Data as of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/spf-without-dmarc https://defaults.exposed/en/articles/spf-without-dmarc 30.9% of domains publish SPF but have no DMARC at all, and 43.8% have SPF without enforcement, they look protected and aren't. Only 2.79% are fully email-protected. The false-security gap, in census data. As of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/state-of-ipv6-2026 https://defaults.exposed/en/articles/state-of-ipv6-2026 A decade after 'IPv6 launch', just 23.76% of domains publish an AAAA record, the other 76.24% are IPv4-only. Adoption by country, from a 377-million-domain census. As of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/the-dnssec-paradox https://defaults.exposed/en/articles/the-dnssec-paradox DNSSEC is meant to stop DNS hijacking, but across 377 million domains, more have it misconfigured and broken (0.04%) than working correctly (5.05%). The rest (94.91%) don't try at all. Why DNS is the internet's most-neglected security layer. Data as of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/what-your-server-headers-leak https://defaults.exposed/en/articles/what-your-server-headers-leak 69.0% of sites announce their web server in the response headers, and 8.3% reveal their app stack and version via X-Powered-By, including end-of-life software. What the web tells attackers for free, in census data. As of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/why-are-my-emails-going-to-spam https://defaults.exposed/en/articles/why-are-my-emails-going-to-spam Most business email lands in spam for one fixable reason: missing authentication. Across 377 million domains, only 38.84% publish SPF, -16.40% use DKIM and 20.05% have any DMARC, the exact signals Gmail and Yahoo now require. Data as of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/why-does-my-website-say-not-secure https://defaults.exposed/en/articles/why-does-my-website-say-not-secure The 'Not Secure' label appears when a site isn't on valid HTTPS. Across 377 million domains, 38.59% serve no HTTPS at all, and 9.54% of those that do have an invalid certificate, so visitors see a browser warning. What it costs and how to fix it. Data as of 2026-08-16. Mon, 29 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/domain-decay-by-tld https://defaults.exposed/en/articles/domain-decay-by-tld About 21.4% of all registered domains no longer resolve, but the rate varies wildly by ending. Cheap bulk endings like .xyz decay fastest; established national registries barely at all. The internet's domain mortality map, as of 2026-08-16. Sun, 28 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/emerging-market-domains https://defaults.exposed/en/articles/emerging-market-domains National domains in emerging markets score an F 79.0% of the time, against 66.2% in developed economies, an 12.8-point gap. But the spread inside the emerging group is far wider than the gap between groups. The data, as of 2026-08-16. Sun, 28 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/europe-vs-world-domain-security https://defaults.exposed/en/articles/europe-vs-world-domain-security European businesses protect their domains better than the rest of the world: 64.6% of European national-domain businesses score an F, versus 78.6% elsewhere. But 'better' still means most domains are exposed. The data, as of 2026-08-16. Sun, 28 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/how-we-graded-the-internet https://defaults.exposed/en/articles/how-we-graded-the-internet How Defaults.Exposed grades 377 million domains from A+ to F across 34 externally observable security checks, what we measure, how the grade is calculated, and the limits of the data. Last updated 2026-08-16. Sun, 28 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/national-domain-security-index https://defaults.exposed/en/articles/national-domain-security-index We graded the business domains behind 120 countries' national endings. 70.9% score an F, and even the best-ranked country leaves most of its domains exposed. The full national ranking, updated live, as of 2026-08-16. Sun, 28 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/national-vs-generic-domains https://defaults.exposed/en/articles/national-vs-generic-domains We compared 120 national domain endings against 764 generic ones across 377 million domains. National (ccTLD) domains are measurably more secure: 70.9% score an F versus 81.1% on generic endings. Data as of 2026-08-16. Sun, 28 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/new-gtlds-vs-legacy-domains https://defaults.exposed/en/articles/new-gtlds-vs-legacy-domains We compared the security of legacy endings (.com, .net, .org) against new gTLDs (.ai, .io, .xyz, .top) across millions of domains. The surprise: age doesn't predict safety, price and purpose do. Data as of 2026-08-16. Sun, 28 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/the-internet-security-grade-curve https://defaults.exposed/en/articles/the-internet-security-grade-curve We graded 377 million domains A–F. The average domain scores a D or F, only 6.4% reach a C, and just 1.69% earn a B or better. Here is the full grade distribution of the internet, as of 2026-08-16. Sun, 28 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/the-internets-dead-domains https://defaults.exposed/en/articles/the-internets-dead-domains Of 432 million domains we track, 92 million (21.4%) no longer resolve to anything. Here's what the internet's dead domains tell us, and the quiet security risk abandoned domains leave behind. Data as of 2026-08-16. Sun, 28 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/the-most-secure-domains-on-the-internet https://defaults.exposed/en/articles/the-most-secure-domains-on-the-internet Only 1.69% of 377 million domains earn a B or better, and just 0.15% reach an A, about 1 in 700. Here is exactly what the internet's most secure domains have in common, as of 2026-08-16. Sun, 28 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/the-most-spoofable-countries https://defaults.exposed/en/articles/the-most-spoofable-countries China tops the list: 99.0% of its business domains are effectively unprotected against email spoofing. We ranked 72 countries by how forgeable their domains are. Data as of 2026-08-16. Sun, 28 Jun 2026 12:00:00 GMT https://defaults.exposed/en/articles/domain-security-world-cup https://defaults.exposed/en/articles/domain-security-world-cup We took the real 2026 World Cup draw (all 12 groups, all 48 teams) and let one rule decide every match: the country whose business domains are least exposed wins. Bosnia are world champions, Germany finish bottom of their group, and the hosts go out at home. Sat, 27 Jun 2026 12:00:00 GMT