https://defaults.exposed/v9/articles Independent domain-security research from the August 2026 census of 446.9M domains: aggregate SPF, DKIM, DMARC, DNSSEC and TLS posture across the internet, with as-of dates and public methodology. en Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/invoice-fraud-prevention-closing-the-domain-spoofing-gap-behind-bec https://defaults.exposed/v9/articles/invoice-fraud-prevention-closing-the-domain-spoofing-gap-behind-bec Invoice fraud and business email compromise succeed because the supplier's domain can be spoofed. The August 2026 census finds ~195 million mail-receiving domains lack an enforcing DMARC policy. The accounts-payable controls that stop invoice fraud — plus the one technical control most programs miss. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/email-spoofing-explained-why-90-7-of-domains-can-be-forged https://defaults.exposed/v9/articles/email-spoofing-explained-why-90-7-of-domains-can-be-forged Email spoofing works because most domains publish no enforcing policy. The August 2026 census of 376.9M domains finds 90.7% — 341.9 million — have no enforcing DMARC, and 56.8% have no SPF or DMARC at all. How spoofing works, how to detect it, and how to stop it. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-a-bimi-record https://defaults.exposed/v9/articles/what-is-a-bimi-record A BIMI record publishes your brand logo so it shows next to authenticated email — but it only works on top of an enforcing DMARC policy. The August 2026 census of 376,928,750 graded domains finds only 9.3% (34,983,618) meet that floor, so the other 90.7% are locked out of BIMI until they enforce. Here is how a BIMI record works, what it really requires, and how to check whether your domain qualifies. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-a-wildcard-certificate-uses-risks-and-when-to-avoid https://defaults.exposed/v9/articles/what-is-a-wildcard-certificate-uses-risks-and-when-to-avoid A wildcard certificate secures unlimited subdomains under a single *.example.com key. In the August 2026 census, 28.5% of TLS-serving domains rely on one — convenient, but a single stolen private key covers every subdomain at once. Here is how wildcards compare to SAN and single-domain certificates, the blast-radius risk that follows, and when to avoid one. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-dnssec-a-plain-english-guide-to-the-dns-trust-layer https://defaults.exposed/v9/articles/what-is-dnssec-a-plain-english-guide-to-the-dns-trust-layer DNSSEC is a cryptographic signature layer that lets resolvers verify a DNS answer is genuine and unaltered. The August 2026 census of 432,127,908 domains found 157,064 with broken DNSSEC — signed but failing validation — proof that switching it on is easy and keeping the chain of trust valid is the hard part. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/ssl-vs-tls https://defaults.exposed/v9/articles/ssl-vs-tls SSL and TLS are two generations of the same encryption protocol, and the 'SSL certificates' people buy are really TLS certificates — SSL itself was deprecated back in 2015. The August 2026 census of 231,991,983 HTTPS-serving domains found 5.2 million serving expired certificates and 3.3 million serving self-signed ones, proof that 'SSL health' comes down to TLS version and certificate validity. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/http-security-headers-the-complete-checklist https://defaults.exposed/v9/articles/http-security-headers-the-complete-checklist Only 8.0% of the web sets a Content-Security-Policy, 20.1% deploy HSTS, and 91% omit Referrer-Policy — with cross-origin isolation under 1%. The August 2026 census of 432,127,908 scanned domains scores every major HTTP security header; here is the complete checklist, what each one stops, and how to add and verify them. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-hsts-the-header-79-9-of-sites-still-skip https://defaults.exposed/v9/articles/what-is-hsts-the-header-79-9-of-sites-still-skip HSTS is a one-line header that forces browsers to use HTTPS only, closing the gap a plain redirect leaves open. The August 2026 census measured HSTS across 231,991,983 domains and found only 20.1% — 46,539,716 — deploy it, with just 2.57% preload-ready. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-domain-spoofing-exact-domain-vs-look-alike-attacks https://defaults.exposed/v9/articles/what-is-domain-spoofing-exact-domain-vs-look-alike-attacks Domain spoofing is any attack that makes a message or site appear to come from a domain the sender does not control. In the August 2026 census of 376,928,750 email-graded domains, 56.4% of the domains that publish SPF — 82,539,695 — use a soft-fail setting that never actually blocks a forged message, which is one reason most domains stay spoofable. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/nis2-compliance-and-email-authentication-what-the-directive-requires https://defaults.exposed/v9/articles/nis2-compliance-and-email-authentication-what-the-directive-requires NIS2 compliance requires in-scope entities to take appropriate technical measures to manage cyber risk, and email authentication is textbook baseline hygiene. The August 2026 census of 376,928,750 email-graded domains finds 214,276,774 — 56.8% — publish neither SPF nor DMARC, and only 20.0% publish any DMARC at all. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/end-of-life-software-the-hidden-risk-on-6-6-million-domains https://defaults.exposed/v9/articles/end-of-life-software-the-hidden-risk-on-6-6-million-domains End-of-life software is any program the vendor no longer patches, and the August 2026 census found 6.6 million public domains running end-of-life server software with no security updates — the exact 'unsupported software' gap cyber-insurance policies and NIS2 now penalise. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-clickjacking-x-frame-options-and-how-to-stop-it https://defaults.exposed/v9/articles/what-is-clickjacking-x-frame-options-and-how-to-stop-it Clickjacking loads your real site invisibly inside an attacker's page and tricks visitors into clicking things they never meant to. The August 2026 census of 432,127,908 domains finds only 8.0% of the web sets a Content-Security-Policy and under 1% deploys cross-origin isolation — so the frame defense is missing on most of the internet. Here is how the attack works and the one-line header fix. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/dns-hijacking-and-spoofing-how-attackers-steal-domain-records https://defaults.exposed/v9/articles/dns-hijacking-and-spoofing-how-attackers-steal-domain-records DNS hijacking is the theft of the records that route your domain. The August 2026 census of 432,127,908 domains found 63,840,407 (14.8%) delegated in DNS but serving nothing — the exact dangling-delegation surface attackers scan for subdomain takeover. Here is how hijacking, spoofing, and cache poisoning work, and how to check your own domain in 30 seconds. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/why-are-my-emails-going-to-spam https://defaults.exposed/v9/articles/why-are-my-emails-going-to-spam The most common reason your emails go to spam is not your subject line — it is missing authentication. The August 2026 census of 376,928,750 graded domains found 214,276,774 of them (56.8%) publish neither SPF nor DMARC, the exact records Gmail and Yahoo now demand before they trust your mail. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/ceo-fraud-explained-why-publishing-dmarc-is-not-enough https://defaults.exposed/v9/articles/ceo-fraud-explained-why-publishing-dmarc-is-not-enough CEO fraud is a wire-transfer scam that impersonates your chief executive by email. The August 2026 census finds 40,541,896 domains — 53.6% of every domain that publishes DMARC — sit at p=none, published but not enforcing, so the boss's own domain stays fully spoofable despite the 'we have DMARC' assumption. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-an-spf-record https://defaults.exposed/v9/articles/what-is-an-spf-record An SPF record lists which mail servers may send email using your domain's name. The August 2026 census of 376,928,750 email-graded domains found only 38.8% — 146,413,297 — publish any SPF record at all, and most that do use a soft-fail ~all that invites spoofing rather than blocking it. Here is what an SPF record is, how the -all, ~all and +all mechanisms differ, and how to check and fix your own. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/domain-reputation-what-it-is-and-how-to-check-yours https://defaults.exposed/v9/articles/domain-reputation-what-it-is-and-how-to-check-yours Domain reputation is how mailbox providers decide whether to trust your mail — and it quietly leaks the moment your domain can be impersonated. The August 2026 census of 376,928,750 graded domains finds 90.7% (341,945,132) publish no enforcing DMARC, so most senders cannot stop spoofers from spending their reputation. Here is what domain reputation is, the signals that build or break it, and how to check yours in about 30 seconds. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-a-certificate-authority https://defaults.exposed/v9/articles/what-is-a-certificate-authority A certificate authority (CA) is the trusted third party that vouches for a website's identity so browsers show a padlock instead of a warning. The August 2026 census of 432,127,908 domains found 3.3 million serving self-signed certificates that trust no CA at all, and among domains that publish a CAA record, 98.9% leave issuance unrestricted. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/how-to-check-if-a-website-is-safe-in-2026 https://defaults.exposed/v9/articles/how-to-check-if-a-website-is-safe-in-2026 The fastest way to check if a website is safe is to read the machine-readable signals a browser hides — HTTPS, certificate validity, email spoofability, and security headers — because 'it looks fine' proves nothing when 295,157,813 domains (78.3%) earn an F grade in the August 2026 census of 432,127,908 scanned. Here are the seven signals that actually decide it, and how to run all seven on any domain in one click. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/http-vs-https https://defaults.exposed/v9/articles/http-vs-https HTTP sends everything a visitor types in plain text; HTTPS encrypts it. The August 2026 census of 432,127,908 scanned domains finds 27 million still answer on HTTP and never redirect to a secure version — and 44 million serve no encryption at all. Here is exactly what changes between HTTP and HTTPS, whether HTTP is ever safe, and how to check your own site in 30 seconds. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/cyber-insurance-requirements-2026-the-email-controls-underwriters-check https://defaults.exposed/v9/articles/cyber-insurance-requirements-2026-the-email-controls-underwriters-check Cyber insurance requirements in 2026 increasingly include an enforcing DMARC policy an underwriter can verify from public DNS. The August 2026 census of 376,928,750 email-graded domains finds only 2.9% — 10,902,284 — are fully email-auth protected, so roughly 97% would fail the control most cyber underwriters now check at renewal. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/dns-security-explained-why-94-million-domains-rely-on-two-landlords https://defaults.exposed/v9/articles/dns-security-explained-why-94-million-domains-rely-on-two-landlords DNS security protects the integrity, availability and authenticity of the records that route your traffic and mail. The August 2026 census of 432,127,908 domains found roughly 94 million of the world's nameservers concentrated under just two DNS landlords — a systemic single point of failure most owners never see. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-https-how-the-secure-web-actually-works https://defaults.exposed/v9/articles/what-is-https-how-the-secure-web-actually-works HTTPS is HTTP carried inside an encrypted, authenticated TLS connection — the baseline your browser polices with the 'Not Secure' warning. Yet the August 2026 census of 432,127,908 domains found 44 million still serving plain HTTP with no encryption at all. Here is how HTTPS actually works, what the padlock does and does not prove, and how to check your own site in 30 seconds. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/domain-health-check-the-5-things-a-good-audit-covers https://defaults.exposed/v9/articles/domain-health-check-the-5-things-a-good-audit-covers A domain health check audits five layers — email authentication, TLS, DNS, security headers, and the overall grade. In the August 2026 census of 432,127,908 domains, only 2.9% (10,902,284) pass across every layer, which is exactly why the check exists. Here is what a good audit covers and how to run one on your own domain free. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-dmarc https://defaults.exposed/v9/articles/what-is-dmarc DMARC is the DNS record that tells mail servers to reject email forging your domain. The August 2026 census of 376,928,750 email-graded domains finds 90.7% — 341,945,132 — publish no enforcing DMARC policy, and only 20.0% publish any DMARC record at all. Here is what DMARC is, how it works, and how to check yours free. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/dmarc-checker-explained https://defaults.exposed/v9/articles/dmarc-checker-explained A DMARC checker reads the policy your domain publishes and tells you whether it can be spoofed. The August 2026 census of 376,928,750 graded domains finds only 9.3% publish an enforcing policy — the rest publish nothing, or a record that looks protective but does nothing. Here is how to read every field of a DMARC record, spot the gap between published and enforcing, and check your own domain in 30 seconds. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/what-is-business-email-compromise-inside-the-90-7-spoofing-gap https://defaults.exposed/v9/articles/what-is-business-email-compromise-inside-the-90-7-spoofing-gap Business email compromise (BEC) is a fraud that impersonates a trusted party by email to redirect a payment or data. The August 2026 census of 376,928,750 email-graded domains finds 90.7% — 341,945,132 — publish no enforcing DMARC, the exact-domain spoofing gap that makes BEC's most convincing impersonations possible. Fri, 21 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-last-mile-of-https-why-27-million-domains-respond-to-http-but-never-redirect https://defaults.exposed/v9/articles/the-last-mile-of-https-why-27-million-domains-respond-to-http-but-never-redirect ~27 million domains have valid TLS certificates but still serve unencrypted HTTP with no redirect and no HSTS — every visitor who types the domain without 'https://' is exposed to SSL stripping. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-locked-vault-only-10-9-million-domains-close-every-attack-surface-simultaneously https://defaults.exposed/v9/articles/the-locked-vault-only-10-9-million-domains-close-every-attack-surface-simultaneously Only 10.9M of 376.9M graded domains (2.9%) pass all five core controls at once. 1.2M (0.33%) fail every single one. The gap is not technical — it is operational. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-top-1-of-the-internet-starts-at-a-b https://defaults.exposed/v9/articles/the-top-1-of-the-internet-starts-at-a-b 376.9M domains scored: entry to the top 1% is 82/100 — a B grade. Only 0.15% earn an A. The median domain scores 45 — a failing F. The web has no security middle class. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-security-correlation-which-controls-cluster-together-and-which-sit-alone https://defaults.exposed/v9/articles/the-security-correlation-which-controls-cluster-together-and-which-sit-alone 56.8% of 376.9M graded domains have neither SPF nor DMARC. Only 2.9% have all five core controls. Security controls cluster because operator maturity — not cost — is the real variable. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-phantom-tld-problem-the-domains-that-don-t-exist https://defaults.exposed/v9/articles/the-phantom-tld-problem-the-domains-that-don-t-exist 8 of 1,386 TLDs answer for every name you can invent — inflating .ph's domain count 250× to 14.6 million when the true registration base is about 57,874. Two TLDs were still broadcasting ICANN's name-collision hazard beacon in August 2026. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-flaky-internet-20-million-domains-that-only-sometimes-answer https://defaults.exposed/v9/articles/the-flaky-internet-20-million-domains-that-only-sometimes-answer 19,814,020 domains — 4.6% of 432 million scanned — produced inconsistent results across three independent scan attempts. 14.64% of domains that failed their first scan recovered on retry. Here is what that means for internet security measurement. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/who-guards-the-web-cloudflare-wafs-and-the-cdn-vs-origin-measurement-problem https://defaults.exposed/v9/articles/who-guards-the-web-cloudflare-wafs-and-the-cdn-vs-origin-measurement-problem 43,008,476 domains return 'Server: cloudflare' in the August 2026 census — but that number conflates CDN edge-termination with security protection. WAF rules, end-to-end encryption, and origin hardening are invisible in a server header. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-web-server-census-2026-nginx-apache-cloudflare-and-the-invisible-half https://defaults.exposed/v9/articles/the-web-server-census-2026-nginx-apache-cloudflare-and-the-invisible-half 45.6% of 376 million measured domains suppress their Server header entirely — nearly half the web declines to say what it runs. Of those that declare, Cloudflare leads with 43 million entries. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-google-and-yahoo-deadline-two-years-on-where-email-authentication-stands-in-august-2026 https://defaults.exposed/v9/articles/the-google-and-yahoo-deadline-two-years-on-where-email-authentication-stands-in-august-2026 Two and a half years after Google and Yahoo made DMARC a hard requirement, only 9.3% of 376 million graded domains enforce it. 56.8% — 214 million domains — still publish neither SPF nor DMARC at all. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/dmarc-without-spf-16-million-domains-with-half-an-email-authentication-stack https://defaults.exposed/v9/articles/dmarc-without-spf-16-million-domains-with-half-an-email-authentication-stack 16,238,679 domains publish DMARC but have no SPF record at all — leaving every sending path that lacks DKIM signing with no authentication fallback. August 2026 census data across 376 million domains graded. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/nine-million-domains-where-a-grades-round-to-zero https://defaults.exposed/v9/articles/nine-million-domains-where-a-grades-round-to-zero Across 9,338,016 GoDaddy-default domains, exactly 198 earn an A — an A-rate that rounds to 0.00%. We graded 164.7 million domains by email provider to find out what your MX record says about your security. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/spf-hard-fail-vs-soft-fail-why-82-million-domains-are-using-the-weaker-setting https://defaults.exposed/v9/articles/spf-hard-fail-vs-soft-fail-why-82-million-domains-are-using-the-weaker-setting 82,539,695 domains — 56.4% of all SPF publishers — end their record with ~all (soft fail), providing little real protection. August 2026 census data across 146 million SPF records shows why soft fail became the default and what it costs. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/who-reads-the-world-s-dmarc-reports https://defaults.exposed/v9/articles/who-reads-the-world-s-dmarc-reports One company receives DMARC spoofing-attack telemetry for 46.8% — 13.9 million — of every report-collecting domain in our 432M-domain census. In most cases nobody chose it. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-silent-domain-56-8-of-the-internet-has-no-email-authentication https://defaults.exposed/v9/articles/the-silent-domain-56-8-of-the-internet-has-no-email-authentication 214 million domains — 56.8% of the graded web — publish neither SPF nor DMARC, making the majority of the internet trivially spoofable. August 2026 census of 376.9M domains. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-dns-landlords-how-godaddy-and-cloudflare-control-nameservers-for-94-million-domains https://defaults.exposed/v9/articles/the-dns-landlords-how-godaddy-and-cloudflare-control-nameservers-for-94-million-domains GoDaddy and Cloudflare together hold authoritative DNS for 94.7 million domains — 25.1% of the entire graded web — per our August 2026 census of 376.9 million domains. Thu, 20 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-isolation-headers-why-coop-coep-and-corp-cover-less-than-1-of-the-web https://defaults.exposed/v9/articles/the-isolation-headers-why-coop-coep-and-corp-cover-less-than-1-of-the-web COOP appears on 0.78%, COEP on 0.48%, and CORP on 0.65% of 376.9 million domains — four years after Spectre made cross-origin isolation essential, fewer than 1 in 100 sites have deployed any of the three required headers. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-http-only-problem-44-million-domains-serving-unencrypted-web-in-2026 https://defaults.exposed/v9/articles/the-http-only-problem-44-million-domains-serving-unencrypted-web-in-2026 44,443,652 domains — 11.8% of 376.9 million graded — serve HTTP with no TLS, no redirect, and no HSTS, despite free certificates being universally available for over a decade. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/caa-records-98-9-of-domains-never-restrict-their-ca https://defaults.exposed/v9/articles/caa-records-98-9-of-domains-never-restrict-their-ca 98.9% of 376,928,750 domains measured in the defaults.exposed August 2026 Domain Security Census publish no CAA record — leaving them open to certificate issuance by any of approximately 300 publicly trusted certificate authorities. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/one-ca-to-rule-them-all-the-certificate-monoculture-report https://defaults.exposed/v9/articles/one-ca-to-rule-them-all-the-certificate-monoculture-report Let's Encrypt now secures 50.2% of all 231.5 million certificate-presenting domains measured in the defaults.exposed August 2026 Domain Security Census — and in 23 country-code zones, a single CA holds 80% or more of everything. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-b-ceiling-where-the-climb-to-an-a-grade-stalls https://defaults.exposed/v9/articles/the-b-ceiling-where-the-climb-to-an-a-grade-stalls 5.82 million domains score 80–89 but only 549,635 reach 90+. The biggest B-to-A gap is DMARC reporting: 34.4% of B-band domains fail it versus roughly 7% of A-band domains. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/dmarc-gap-87-million-domains-one-record-from-safety https://defaults.exposed/v9/articles/dmarc-gap-87-million-domains-one-record-from-safety 86.9 million domains — 23.1% of 376.9M graded — have SPF but no DMARC record: one free DNS TXT entry away from an anti-spoofing policy. The internet's largest cheap-to-close security deficit. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/cheap-domains-cheap-security-budget-tlds-vs-the-rest https://defaults.exposed/v9/articles/cheap-domains-cheap-security-budget-tlds-vs-the-rest 88.8% of 19.2M graded budget-TLD domains score F — versus 72.4% on .com and 33.7% on .ch. On .top, 96.1% fail and 51.5% of scanned names were dead at scan time. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/do-registry-rules-work-bank-3-1-f-vs-com-72-4 https://defaults.exposed/v9/articles/do-registry-rules-work-bank-3-1-f-vs-com-72-4 3.1% of .bank domains grade F versus 72.4% on .com — a 23× gap. Registry mandates move exactly what they name: vetted-only .pharmacy grades 84.5% F, worse than the open market. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/new-gtld-ghost-towns-where-a-third-of-domains-are-dead https://defaults.exposed/v9/articles/new-gtld-ghost-towns-where-a-third-of-domains-are-dead 36% of 63.8 million new-gTLD domains are dead or unreachable — 2.6 times the legacy-gTLD rate. In .bond, 87.3% of the namespace is gone. Only 58.4% of new-gTLD domains were alive enough to receive a security grade. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/domain-dark-matter-64-million-delegated-empty-domains https://defaults.exposed/v9/articles/domain-dark-matter-64-million-delegated-empty-domains 63,840,407 domains — 14.8% of 432 million scanned — have working DNS delegation but no website and no mail route. More than one in three registered domains never produced a gradable scan at all. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/ipv6-only-domains-80-737-sites-living-without-ipv4 https://defaults.exposed/v9/articles/ipv6-only-domains-80-737-sites-living-without-ipv4 Just 80,737 of 376.9 million graded domains publish only an IPv6 address — 0.021%, one in 4,668. Even among the 67.4 million domains that already have IPv6, only one in 834 has dropped IPv4. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/parked-domains-91-grade-f-across-2-1-million-measured https://defaults.exposed/v9/articles/parked-domains-91-grade-f-across-2-1-million-measured 91.3% of 2,147,113 parked domains grade F — compared to 78.3% across the general web. Exactly one parked domain out of 2.1 million earns an A. Parking provider defaults, not owner choices, set the grade. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-hosting-league-table-domain-security-by-dns-provider https://defaults.exposed/v9/articles/the-hosting-league-table-domain-security-by-dns-provider GoDaddy carries 52.4 million domains at 82.9% grade F, and 52% of every A-grade domain on the internet sits behind Cloudflare alone. We attributed 376.9 million graded domains to their DNS provider. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/does-cloudflare-make-you-safer-41-9m-domains-graded https://defaults.exposed/v9/articles/does-cloudflare-make-you-safer-41-9m-domains-graded 67.7% of the 41.9 million Cloudflare-fronted domains still score an F — virtually identical to the rest of the web — yet Cloudflare holds 48.7% of all A+ grades. August 2026 census data across 205 million HTTP responses. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/dmarc-subdomain-policy-1-3-million-sp-back-doors https://defaults.exposed/v9/articles/dmarc-subdomain-policy-1-3-million-sp-back-doors 1,313,312 domains enforce DMARC at the apex then explicitly exempt their entire subdomain namespace — including 459,577 that reached p=reject and then set sp=none. We parsed 75.5 million records to find the back doors. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/dmarc-pct-tag-476-000-domains-water-down-enforcement https://defaults.exposed/v9/articles/dmarc-pct-tag-476-000-domains-water-down-enforcement 476,465 domains publish DMARC quarantine or reject — then weaken it with a pct value below 100. We parsed 75.5 million DMARC records to find out where the dials are set. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/zombie-mx-records-mail-routed-to-dead-domains https://defaults.exposed/v9/articles/zombie-mx-records-mail-routed-to-dead-domains At least 43,723 dead or unreachable domains still publish mail-routing MX records — a floor figure, not an estimate. The mail is a potential account-takeover risk. August 2026 census. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/null-mx-adoption-2026-14-5-million-domains-opt-out https://defaults.exposed/v9/articles/null-mx-adoption-2026-14-5-million-domains-opt-out 14,455,076 domains publish a null MX record — only 7.0% of the 207 million no-mail domains we graded. RFC 7505 adoption, measured across 376.9M domains. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/broken-dnssec-157-064-domains-are-invisibly-down https://defaults.exposed/v9/articles/broken-dnssec-157-064-domains-are-invisibly-down 157,064 domains have broken DNSSEC chains — a hard SERVFAIL for every validating resolver. That's 1 in 709 signed domains, and owners can't see the failure. August 2026 census. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/single-nameserver-domains-one-record-from-oblivion https://defaults.exposed/v9/articles/single-nameserver-domains-one-record-from-oblivion 290,673 domains run on a single nameserver — a complete single point of failure for website, email, and every DNS-dependent service. August 2026 census of 376.9M domains. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/soa-records-the-internet-s-most-neglected-setting https://defaults.exposed/v9/articles/soa-records-the-internet-s-most-neglected-setting 50.5% of 275 million measured domains carry an SOA retry or expire timer outside recommended ranges — the DNS record nobody has ever reviewed. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/end-of-life-software-census-6-6-million-servers-admit-it https://defaults.exposed/v9/articles/end-of-life-software-census-6-6-million-servers-admit-it 6,635,647 end-of-life software banners counted across 376.9 million domains — including 2.36 million still running PHP 7.4, nearly four years after its last security patch. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/secure-by-default-the-server-software-security-showdown https://defaults.exposed/v9/articles/secure-by-default-the-server-software-security-showdown Netlify sends HSTS on 95.9% of its sites; Apache on 7.0% — a 13.7× gap across 191.7 million responses showing how your hosting choice, not your security team, determines what protection your users receive. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/referrer-policy-the-privacy-header-91-of-the-web-forgot https://defaults.exposed/v9/articles/referrer-policy-the-privacy-header-91-of-the-web-forgot 91.4% of 231.9 million HTTP responses carry no Referrer-Policy — leaving browser defaults to decide whether full URLs, search terms, and path-embedded tokens are shared with every third-party server a page contacts. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/hsts-adoption-2026-the-half-locked-door https://defaults.exposed/v9/articles/hsts-adoption-2026-the-half-locked-door 79.9% of 232 million HTTPS domains send no HSTS header — and only 12.8% of those that do publish a preload-ready policy — leaving most of the encrypted web unprotected against SSL-stripping attacks. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/content-security-policy-adoption-in-2026-the-8-0-web https://defaults.exposed/v9/articles/content-security-policy-adoption-in-2026-the-8-0-web Only 8.0% of 257.6 million measurable domains serve an effective Content-Security-Policy — and 48.3% of those who do land on just two identical scores, revealing platform defaults rather than deliberate security choices. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/tls-1-3-by-country-which-tlds-win-on-defaults-2026 https://defaults.exposed/v9/articles/tls-1-3-by-country-which-tlds-win-on-defaults-2026 94.9% of 231.5 million TLS-completing domains negotiate TLS 1.3 — but South Korea's .kr lags at 73.3% and the US .gov TLD at 77.0%, revealing how infrastructure age, not national wealth, determines encryption quality. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/cipher-suites-in-2026-what-strong-encryption-really-means https://defaults.exposed/v9/articles/cipher-suites-in-2026-what-strong-encryption-really-means Two cipher suites carried 94.33% of 212 million measured TLS handshakes in the defaults.exposed August 2026 Domain Security Census — and RC4, 3DES, and export-grade ciphers appeared zero times. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/wildcard-certificates-28-5-of-the-tls-web-on-one-key https://defaults.exposed/v9/articles/wildcard-certificates-28-5-of-the-tls-web-on-one-key 28.5% of the TLS web — 66,011,927 of 231.5 million domains measured in the defaults.exposed August 2026 Domain Security Census — runs on wildcard certificates, sharing one private key across every subdomain. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/self-signed-certificates-the-3-3-million-domain-census https://defaults.exposed/v9/articles/self-signed-certificates-the-3-3-million-domain-census 3,306,642 of 231.5 million TLS certificates observed in the defaults.exposed August 2026 Domain Security Census are self-signed — including 375,842 still carrying the 'Internet Widgits Pty Ltd' OpenSSL example default. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/expired-ssl-certificates-5-2-million-sites-still-serving https://defaults.exposed/v9/articles/expired-ssl-certificates-5-2-million-sites-still-serving 5,157,928 live websites were serving an expired TLS certificate at the moment of the defaults.exposed August 2026 Domain Security Census sweep — 47.8% of those certificates had been expired for over a year. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/rsa-vs-ecdsa-in-2026-measuring-the-web-s-key-migration https://defaults.exposed/v9/articles/rsa-vs-ecdsa-in-2026-measuring-the-web-s-key-migration 425,004 live TLS certificates are still signed with MD5, and RSA still holds 59.3% of 231.5 million keys measured in the defaults.exposed August 2026 Domain Security Census — the key migration is real but moving at the speed of defaults, not advice. Tue, 18 Aug 2026 12:00:00 GMT https://defaults.exposed/v9/articles/the-90-day-web-certificate-lifetimes-in-2026 https://defaults.exposed/v9/articles/the-90-day-web-certificate-lifetimes-in-2026 67.7% of 231.5 million TLS certificates observed in the defaults.exposed August 2026 Domain Security Census were issued for exactly 90 days — the annual certificate is collapsing, and the 47-day era is next. Tue, 18 Aug 2026 12:00:00 GMT