https://defaults.exposed/ Independent domain-security research: aggregate SPF, DKIM, DMARC, DNSSEC and TLS posture measured across the internet, with as-of dates and public methodology. en Sun, 04 Oct 2026 12:00:00 GMT https://defaults.exposed/research/city-tlds-ranked https://defaults.exposed/research/city-tlds-ranked October 2026: 25 of 26 city, regional and cultural TLDs have a higher F rate than their country code. Six beat it on DMARC enforcement, eight on DNSSEC. Sun, 04 Oct 2026 12:00:00 GMT https://defaults.exposed/research/cloudflare-proxied-share https://defaults.exposed/research/cloudflare-proxied-share Of 52,954,675 domains on Cloudflare nameservers, 64.5% answered through its proxy, 12.4% without it and 23.1% gave no answer. October 2026 census. Sun, 04 Oct 2026 12:00:00 GMT https://defaults.exposed/research/dkim-not-free-with-hosted-mail https://defaults.exposed/research/dkim-not-free-with-hosted-mail 64.9% of Google Workspace and Microsoft 365 domains had no DKIM key at their provider's selector in the October 2026 census. Sun, 04 Oct 2026 12:00:00 GMT https://defaults.exposed/research/gov-after-bod-18-01 https://defaults.exposed/research/gov-after-bod-18-01 Of 1,099 live federal executive .gov domains, 89.3% publish DMARC p=reject. Of 1,322 state domains, 14.7% do. October 2026 census. Sun, 04 Oct 2026 12:00:00 GMT https://defaults.exposed/research/money-moves-by-email https://defaults.exposed/research/money-moves-by-email Of 96,110 domains verified with Stripe, 33.7% enforce DMARC and 55.2% sit at p=none. DocuSign: 61.5%. October 2026 census. Sun, 04 Oct 2026 12:00:00 GMT https://defaults.exposed/research/not-a-website-certificate https://defaults.exposed/research/not-a-website-certificate 5.0% of 220,326,298 HTTPS leaves still list clientAuth. 3,825,822 are CA, nameless or non-server certificates. October 2026 census. Sun, 04 Oct 2026 12:00:00 GMT https://defaults.exposed/research/one-mail-server-no-spare https://defaults.exposed/research/one-mail-server-no-spare 44.5% of gTLD and 56.8% of ccTLD mail domains publish one MX record. At Microsoft 365 that is standard. 31,050,877 name a host of their own. Sun, 04 Oct 2026 12:00:00 GMT https://defaults.exposed/research/security-headers-that-do-nothing https://defaults.exposed/research/security-headers-that-do-nothing 183,766 domains send a security header value the browser discards, from ALLOWALL to SAMEORIGIN; with a stray semicolon. Counted in October 2026. Sun, 04 Oct 2026 12:00:00 GMT https://defaults.exposed/research/shared-certificates-blast-radius https://defaults.exposed/research/shared-certificates-blast-radius 13.3% of 220,326,298 HTTPS domains present a certificate another apex also presents. One placeholder covers 503,418 of them. October 2026 census. Sun, 04 Oct 2026 12:00:00 GMT https://defaults.exposed/research/spf-vs-mx-vendor-mismatch https://defaults.exposed/research/spf-vs-mx-vendor-mismatch 7,856,307 domains name one vendor in SPF and another in MX. Most are built that way; 761,259 have a mailbox their SPF record leaves out. Sun, 04 Oct 2026 12:00:00 GMT https://defaults.exposed/research/verification-token-reuse https://defaults.exposed/research/verification-token-reuse October 2026: 97.61% of 37,376,388 account-scoped verification records carry a value no other domain publishes. 16 values sit on over 1,000 domains. Sun, 04 Oct 2026 12:00:00 GMT https://defaults.exposed/research/where-a-countrys-email-lives https://defaults.exposed/research/where-a-countrys-email-lives October 2026: Google and Microsoft receive mail for 17.2% of ccTLD mail domains, against 38.6% in the top million. OVHcloud holds 34.8% of .fr. Sun, 04 Oct 2026 12:00:00 GMT https://defaults.exposed/research/who-answers-for-a-nation https://defaults.exposed/research/who-answers-for-a-nation 98.9% of ccTLD domains rely on one DNS operator. Six US operators run nameservers for 28.1%. The 60 largest ccTLDs ranked, October 2026 census. Sun, 04 Oct 2026 12:00:00 GMT https://defaults.exposed/research/whose-name-on-your-certificate https://defaults.exposed/research/whose-name-on-your-certificate 17,874,769 HTTPS domains present a certificate in someone else's name. Ten defaults account for 16.9% of them. October 2026 census. Sun, 04 Oct 2026 12:00:00 GMT https://defaults.exposed/research/why-the-most-visited-domains-score-badly https://defaults.exposed/research/why-the-most-visited-domains-score-badly We graded the 10,000 most visited domains on the same 33 checks as everyone else. Nearly 7 in 10 fall short of a B and 28.4% score F. What they get wrong, what the 731 A grades share, and why none of it says anything about your domain. Sun, 13 Sep 2026 12:00:00 GMT https://defaults.exposed/research/domain-dark-matter https://defaults.exposed/research/domain-dark-matter The October 2026 census scanned 361.3 million domains that exist and graded 332.5 million; the 28.8 million in between never gave a gradable answer. Wed, 09 Sep 2026 12:00:00 GMT https://defaults.exposed/research/how-domains-stack-security-controls https://defaults.exposed/research/how-domains-stack-security-controls Most graded domains carry one or two of the five controls the census measures, and 91.7 million publish SPF but no DMARC record. Wed, 09 Sep 2026 12:00:00 GMT https://defaults.exposed/research/new-gtld-ghost-towns https://defaults.exposed/research/new-gtld-ghost-towns In October 2026 three country codes, .tk, .cf and .gq, hold most of the dead domains in the census. Among new gTLDs, .cfd leads, with 10.44% of its names dead. Wed, 09 Sep 2026 12:00:00 GMT https://defaults.exposed/research/the-locked-vault https://defaults.exposed/research/the-locked-vault 1,325,934 domains close all five of SPF, enforced DMARC, DNSSEC, HTTPS and HSTS at once in October 2026: about 1 in 251 of every graded domain. Wed, 09 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/contact-form-emails-going-to-spam https://defaults.exposed/fix/contact-form-emails-going-to-spam Your web server sends form mail unauthenticated, with no SPF authorisation and no DKIM signature. Route it through authenticated SMTP and the spam stops. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/dkim-no-key-for-signature https://defaults.exposed/fix/dkim-no-key-for-signature No key for signature means the receiver queried s._domainkey.yourdomain and found nothing. Read the s= tag off a real message, publish that record. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/dkim-signature-not-valid https://defaults.exposed/fix/dkim-signature-not-valid A DKIM signature that is not valid means the key was found and the check failed. Read the header wording, then the published key, then the signer. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/dmarc-fails-spf-dkim-pass https://defaults.exposed/fix/dmarc-fails-spf-dkim-pass DMARC fails while SPF and DKIM pass because both passed on someone else's domain. Compare header.from with smtp.mailfrom and header.d, then align one leg. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/gmail-550-5-7-1 https://defaults.exposed/fix/gmail-550-5-7-1 Gmail 550-5.7.1 is a policy block. The sentence after the code names the cause: your own DMARC, missing reverse DNS on IPv6, or spam filtering. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/new-domain-spf-dkim-dmarc https://defaults.exposed/fix/new-domain-spf-dkim-dmarc A new domain needs one SPF record naming your provider, custom-domain DKIM signing, and DMARC p=none with a rua address. About 20 minutes of DNS work. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/newsletter-emails-failing-dmarc https://defaults.exposed/fix/newsletter-emails-failing-dmarc Your platform signs as itself, so nothing aligns with your From domain. Turn on its custom domain authentication, add the DKIM CNAMEs, set the bounce domain. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/outlook-rejecting-mail https://defaults.exposed/fix/outlook-rejecting-mail Consumer Outlook bounces unauthenticated high-volume senders with 550 5.7.515. Exchange Online returns 5.7.509 when your own DMARC policy says reject. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/someone-is-sending-emails-from-my-domain https://defaults.exposed/fix/someone-is-sending-emails-from-my-domain Read the From address character by character first. An exact-domain forgery is a DNS fix, a lookalike is a takedown, and they share no steps. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/spf-broke-after-switching-provider https://defaults.exposed/fix/spf-broke-after-switching-provider The new provider's record went in next to the old one. Two v=spf1 records are a PermError, so merge to one, delete the rest, verify at your nameservers. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/research/csp-adoption-corrected https://defaults.exposed/research/csp-adoption-corrected Citing CSP adoption? 10.45% of domains that sent headers carry a CSP header, and 2.85% carry one that constrains script. Cite the second, with its denominator. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/research/dmarc-rua https://defaults.exposed/research/dmarc-rua rua= is the DMARC tag that names where aggregate reports go. A p=none record without it asks for nothing, so nothing arrives. Add it, then read a fortnight. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/research/does-my-csp-do-anything https://defaults.exposed/research/does-my-csp-do-anything Test your own header: a CSP without default-src or script-src constrains no script, and 27.26% of CSP headers in the October 2026 census have either. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/research/f-grade-score-bands https://defaults.exposed/research/f-grade-score-bands Got an F on your own scan? Read the score under it: 62.89% of F-graded domains score 40 to 59, within twenty points of the 60 mark where F ends. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/research/google-site-verification https://defaults.exposed/research/google-site-verification A google-site-verification TXT record is an inert ownership proof for a Google property. 30,511,620 domains carry one, and it is safe to leave in place. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/research/how-many-txt-records-should-a-domain-have https://defaults.exposed/research/how-many-txt-records-should-a-domain-have Most domains with a verification token in DNS carry exactly one; a small band carries three or more, and that's where unaccounted-for records live. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/research/microsoft-365-marker-vs-mail-routing https://defaults.exposed/research/microsoft-365-marker-vs-mail-routing 8,456,816 domains carry an MS= tenant marker; 14,967,920 of 180,564,746 domains with MX route mail to Microsoft 365. The two use different bases. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/research/openai-domain-verification https://defaults.exposed/research/openai-domain-verification 241,667 domains publish an openai-domain-verification TXT record at the apex, of the 174,990,877 with any apex TXT record in the October 2026 census. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/research/server-and-x-powered-by-headers https://defaults.exposed/research/server-and-x-powered-by-headers The most common Server header is cloudflare, 47,009,028 of 222,969,925 header-sending domains in the October 2026 census, and one config line trims the version from yours. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/research/three-records-away-from-a-c https://defaults.exposed/research/three-records-away-from-a-c Do the DMARC policy first, then the SPF fail qualifier, then HSTS. Three records are the shortest route from the top band of F to a C. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/research/unsafe-inline-and-frame-ancestors https://defaults.exposed/research/unsafe-inline-and-frame-ancestors unsafe-inline silences CSP errors by switching off the script guard; most counted policies only control framing. A nonce or hash restores the guard. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/research/verification-token-census https://defaults.exposed/research/verification-token-census The ranked table of DNS verification tokens: 46,336,520 domains carry one, out of 174,990,877 with any apex TXT record, over 1434 TLD partitions. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/caa/cloudflare https://defaults.exposed/setup/caa/cloudflare In Cloudflare DNS, add a CAA record with name @, flags 0, tag Only allow specific hostnames, and your CA's domain, such as letsencrypt.org. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/caa/route-53 https://defaults.exposed/setup/caa/route-53 In Route 53, create a record with an empty name, type CAA, and value 0 issue "letsencrypt.org". List every authority you use, including amazon.com for ACM. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/dkim/beget https://defaults.exposed/setup/dkim/beget In Beget, create a subzone named for your DKIM selector first, then add the TXT or CNAME record your email provider gave you inside it. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/dkim/cloudflare https://defaults.exposed/setup/dkim/cloudflare Your mail provider generates the DKIM key; Cloudflare publishes it. Add a TXT record named for the selector alone, and leave your domain off the name. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/dkim/godaddy https://defaults.exposed/setup/dkim/godaddy Your mail provider generates the DKIM key; GoDaddy publishes it. Put only the selector in the Name field, save, then hit verify at the provider. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/dkim/google-workspace https://defaults.exposed/setup/dkim/google-workspace Google generates the key in Admin console under Gmail, Authenticate email. Publish it as a TXT record at google._domainkey, then click Start authentication. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/dkim/microsoft-365 https://defaults.exposed/setup/dkim/microsoft-365 Publish Microsoft's two CNAME records, selector1._domainkey and selector2._domainkey, in your DNS host, then turn DKIM signing on at security.microsoft.com. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/dkim/reg-ru https://defaults.exposed/setup/dkim/reg-ru Your email provider generates the DKIM key and selector; you add it as a TXT or CNAME record in the Reg.ru zone editor, using the selector alone as the host. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/dkim/route-53 https://defaults.exposed/setup/dkim/route-53 In your Route 53 hosted zone, enter the selector alone as the record name, wrap a TXT key in double quotes, and paste a CNAME target with none. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/dmarc/cloudflare https://defaults.exposed/setup/dmarc/cloudflare In Cloudflare DNS, add a TXT record named _dmarc holding v=DMARC1; p=none; rua=mailto:you@yourdomain.com, then raise the policy once the reports look clean. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/dmarc/godaddy https://defaults.exposed/setup/dmarc/godaddy Add one TXT record at the host name _dmarc in GoDaddy DNS, starting v=DMARC1; p=none; rua=mailto:, then check it before you tighten the policy. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/dmarc/google-workspace https://defaults.exposed/setup/dmarc/google-workspace DMARC for Google Workspace is one TXT record at _dmarc in your DNS host. Google Admin has no DMARC switch. Start at p=none with a rua you read. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/dmarc/hostinger https://defaults.exposed/setup/dmarc/hostinger In hPanel open your domain's DNS zone, add a TXT record named _dmarc with the value v=DMARC1; p=none; rua=mailto:you@yourdomain.com, leave TTL default. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/dmarc/microsoft-365 https://defaults.exposed/setup/dmarc/microsoft-365 DMARC on Microsoft 365 is a TXT record named _dmarc, added wherever your DNS lives. Start with v=DMARC1; p=none; rua=mailto:you@yourdomain.com. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/dmarc/reg-ru https://defaults.exposed/setup/dmarc/reg-ru In the Reg.ru personal account, add a TXT record with subdomain _dmarc holding v=DMARC1; p=none; rua=mailto:you@yourdomain.com, then confirm it resolves. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/dmarc/route-53 https://defaults.exposed/setup/dmarc/route-53 In Route 53, create a TXT record named _dmarc with the value in double quotes: "v=DMARC1; p=none; rua=mailto:you@yourdomain.com", then raise the policy. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/dmarc/timeweb https://defaults.exposed/setup/dmarc/timeweb Add a TXT record named _dmarc in Timeweb's DNS editor with the value v=DMARC1; p=none; rua=mailto:you@yourdomain.com, then check for a duplicate. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/dmarc/wix https://defaults.exposed/setup/dmarc/wix In Wix DNS add a TXT record, host name _dmarc, value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, then read the reports before you tighten it. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/dnssec/reg-ru https://defaults.exposed/setup/dnssec/reg-ru DNSSEC at Reg.ru needs Premium DNS and the ns1.reg.ru nameservers. Switch it on in the zone management tab and Reg.ru lodges the keys for you. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/spf/beget https://defaults.exposed/setup/spf/beget Beget publishes v=spf1 redirect=beget.com for you. To add another sender, rewrite that one TXT record in include: form and end it with your own all term. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/spf/godaddy https://defaults.exposed/setup/spf/godaddy Add one TXT record at the apex: name @, value your provider's v=spf1 string, no quotes, one SPF record only. First check GoDaddy runs your DNS. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/spf/hostinger https://defaults.exposed/setup/spf/hostinger Add one TXT record at @ in Hostinger's DNS zone with your provider's SPF value, and only if your nameservers point at Hostinger. One v=spf1 record only. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/spf/porkbun https://defaults.exposed/setup/spf/porkbun Add one TXT record in Porkbun's DNS Records, leave Host blank for the root, paste the SPF string with no quotes, and keep it to a single record. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/spf/reg-ru https://defaults.exposed/setup/spf/reg-ru Add one TXT record on host @ carrying your mail provider's include value and an all term, in the Reg.ru panel that matches the domain's nameservers. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/spf/route-53 https://defaults.exposed/setup/spf/route-53 In Route 53 create a TXT record, leave the record name empty, and type the SPF value inside double quotes. Route 53 does not add the quotes for you. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/spf/timeweb https://defaults.exposed/setup/spf/timeweb Timeweb publishes v=spf1 include:_spf.timeweb.ru ~all for delegated domains. Edit that record to add your other senders, never add a second one. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/trends/dmarc-policy-mix https://defaults.exposed/trends/dmarc-policy-mix Across four 2026 editions about half of published DMARC records sat at p=none and the policy mix stayed flat. A p=none record changes nothing. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/trends/hsts-and-csp-across-three-editions https://defaults.exposed/trends/hsts-and-csp-across-three-editions HSTS share of answering domains: 19.89%, 19.11%, 19.24%, 19.57% from July to October 2026; CSP: 7.64%, 7.93%, 8.02%, 8.40%. Counts rose for both; the HSTS share is still below July's. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/trends/tls-1-3-adoption https://defaults.exposed/trends/tls-1-3-adoption TLS 1.3 was negotiated on 94.81%, 94.87%, 94.41% and 94.56% of completed handshakes from July to October 2026; TLS 1.2 on 5.19%, 5.13%, 5.59% and 5.44%. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/trends/what-we-compare https://defaults.exposed/trends/what-we-compare Two census figures are compared only when both denominators are an observed record set in the same edition; shares of all domains are not compared. Mon, 07 Sep 2026 12:00:00 GMT https://defaults.exposed/bimi-needs-dmarc https://defaults.exposed/bimi-needs-dmarc Your BIMI logo won't render while DMARC says p=none. Receivers check aligned DKIM, then an enforcing DMARC policy, and only then read the BIMI record. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/can-someone-spoof-my-domain https://defaults.exposed/can-someone-spoof-my-domain Yes, unless your DMARC record says p=quarantine or p=reject. Anyone can type your domain into a From: line; that record is what makes receivers refuse it. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/dkim https://defaults.exposed/dkim A dkim=fail line names its own cause: the body changed in transit, a signed header changed, or no key answers at the selector. Each is fixed at the sender or in DNS. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/dmarc https://defaults.exposed/dmarc A DMARC record only changes anything when p= says quarantine or reject. p=none tells every receiver to deliver forged mail as normal and send you a report. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/dmarc-subdomain-policy https://defaults.exposed/dmarc-subdomain-policy Subdomains inherit p= unless sp= overrides it. sp=none on a p=reject record delivers forged mail from any subdomain, real or invented. Delete it or set reject. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/dmarc-typos https://defaults.exposed/dmarc-typos A DMARC record whose p= says quarentine, policy or nothing at all is read as p=none or ignored outright. Find your typo in the ranked list and fix one word. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/dns https://defaults.exposed/dns DNSSEC signs your DNS answers so resolvers can reject forged ones. A broken chain makes the domain vanish; 7.0% of domains checked have a valid one. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/dnssec-servfail https://defaults.exposed/dnssec-servfail SERVFAIL after DNSSEC means the DS at your registrar doesn't match a live key, or the signatures lapsed. Pull the DS to fail open, then repair the chain. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/email-delivery https://defaults.exposed/email-delivery Your bounce names the reason in a code like 550 5.7.26. Match the code here, open the page that fixes it, and check your domain free before the next send. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/find-your-dkim-selector https://defaults.exposed/find-your-dkim-selector Your DKIM selector is the s= tag in the DKIM-Signature header of a message you send. Read it from a raw message, then look it up under _domainkey in DNS. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/550-5-7-26-sender-is-unauthenticated https://defaults.exposed/fix/550-5-7-26-sender-is-unauthenticated Gmail sends 550-5.7.26 when a message fails both SPF and DKIM. Get either one passing for the sending domain and the block clears once DNS is visible. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/dkim-body-hash-did-not-verify https://defaults.exposed/fix/dkim-body-hash-did-not-verify Body hash did not verify means something rewrote your message after it was signed; find the gateway, appliance, list or relay that edits it and sign after that hop. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/dmarc-policy-none-vs-reject https://defaults.exposed/fix/dmarc-policy-none-vs-reject p=none reports and delivers, p=quarantine sends failures to junk, p=reject refuses them. Move up in that order, one free DNS edit at a time. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/dmarc-quarantine-reject-policy-not-enabled https://defaults.exposed/fix/dmarc-quarantine-reject-policy-not-enabled The warning means no DMARC record or a record at p=none. Publish v=DMARC1; p=none; rua= today, read the reports, then step to quarantine and reject. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/forwarding-breaks-spf https://defaults.exposed/fix/forwarding-breaks-spf Forwarded mail fails SPF because the forwarder sends from an IP you never listed; no record fixes that, and DKIM signed with your own domain is what survives. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/is-com-safer-than-net-or-org https://defaults.exposed/fix/is-com-safer-than-net-or-org On the October 2026 census .net carries the highest F share of the legacy three and .com the lowest; the gap measures who buys each ending. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/no-spf-record-found https://defaults.exposed/fix/no-spf-record-found No SPF record found is urgent if your domain accepts mail. Check MX, count the v=spf1 lines at the authoritative nameserver, then publish one or merge to one. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/not-secure https://defaults.exposed/fix/not-secure Not secure means the browser couldn't trust the page: no HTTPS, an expired, mismatched or untrusted certificate, or one http:// asset on a valid HTTPS page. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/spf-failing-saas-europe https://defaults.exposed/fix/spf-failing-saas-europe When a SaaS tool fails SPF, read Return-Path against Authentication-Results: usually SPF passed on the vendor's domain and DMARC failed alignment. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/spf-permerror-too-many-dns-lookups https://defaults.exposed/fix/spf-permerror-too-many-dns-lookups Past ten DNS lookups a receiver returns PermError and voids your whole SPF record. Count the resolved chain, prune dead includes, use subdomains. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/yahoo-554-5-7-9 https://defaults.exposed/fix/yahoo-554-5-7-9 554 5.7.9 is Yahoo's permanent policy rejection: SPF or DKIM must pass for a domain matching your From address. Test four causes in order, then fix DNS. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/fix/your-connection-is-not-private https://defaults.exposed/fix/your-connection-is-not-private The browser can't trust the site's certificate. Match the NET::ERR_ code under the warning to one of five faults, then fix that one, free, in an afternoon. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/gappssmtp-signing https://defaults.exposed/gappssmtp-signing Google signs your mail as gappssmtp.com because your own DKIM key was never published; publish the record in DNS and the signature moves to your domain. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/how-the-domains-were-counted https://defaults.exposed/how-the-domains-were-counted The October 2026 census scanned 632,901,201 of 649,194,272 sourced names, removed 271,599,411 that answered NXDOMAIN, and counts 361,301,790 domains, 332,492,319 of them graded. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/how-the-grade-is-built https://defaults.exposed/how-the-grade-is-built A domain grade is a score out of 100 from 24 scored checks, with 40 points on email; F is the grade of 74.3% of the 332,492,319 domains that carry one. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/hsts https://defaults.exposed/hsts Send Strict-Transport-Security: max-age=31536000; includeSubDomains over HTTPS, ramp max-age up in stages, and the browser stops sending plaintext first. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/http-headers https://defaults.exposed/http-headers Each HTTP security header, the attack it stops, the share of the web that sets it, and a one-line verdict on whether the audit finding is real or pedantic. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/may-be-forged https://defaults.exposed/may-be-forged '(may be forged)' means the receiving server could not confirm the sending IP's reverse DNS. The fix is a PTR record at the IP's owner, not a DMARC record. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/parked-domain-spoofing https://defaults.exposed/parked-domain-spoofing A domain that sends no mail still needs SPF -all and DMARC p=reject, because receivers can't tell it's parked; a null MX is the optional third record. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/dkim/namecheap https://defaults.exposed/setup/dkim/namecheap Generate the key in your mail provider's console, then add it in Namecheap Advanced DNS: selector only in Host, the whole value pasted, no quotes. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/setup/spf/wix https://defaults.exposed/setup/spf/wix Wix holds your DNS and serves the site. SPF, DKIM and DMARC come from your mail provider, and you add them in Wix DNS at @, the selector and _dmarc. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/spf https://defaults.exposed/spf An SPF record is a DNS TXT line naming the servers allowed to send as your domain. Read yours, match the error in your headers, fix it in minutes. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/spf-all-qualifier https://defaults.exposed/spf-all-qualifier -all lets receivers reject on SPF alone, which can bounce forwarded mail before DKIM is checked; ~all leaves the decision to DMARC. +all authorises anyone on the internet to send as you. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/supplier-questionnaire-email-authentication https://defaults.exposed/supplier-questionnaire-email-authentication Pull three DNS records, read the p= tag, write the sentence a reviewer can verify with the same lookup, and attach the free scan as the evidence. Sun, 06 Sep 2026 12:00:00 GMT https://defaults.exposed/tls https://defaults.exposed/tls Match the exact browser error code to its cause (expired, wrong name, untrusted issuer, dead handshake) and fix each one with the command shown. Sun, 06 Sep 2026 12:00:00 GMT