Sitemap
Every page this site publishes for indexing, grouped by what it is for. There are 249 of them. This is the same set sitemap.xml carries, generated from the same source, so the two cannot drift apart.
What is not here: the August 2026 edition under /v9, which stays served and citable and is deliberately out of the sitemap and the feed; the retired families, which answer 410 Gone and are listed at /retired.json; and this page itself.
Home and pillars 8 pages
The scan, and the seven checks it reports against.
Fix guides 47 pages
One page per failing check and per error string, with the exact record to publish.
- /fix
- /fix/550-5-7-26-sender-is-unauthenticated
- /fix/bimi
- /fix/caa
- /fix/certificate
- /fix/clickjacking
- /fix/contact-form-emails-going-to-spam
- /fix/cross-origin-headers
- /fix/csp
- /fix/dane
- /fix/dkim
- /fix/dkim-body-hash-did-not-verify
- /fix/dkim-broke-after-switching-tools
- /fix/dkim-no-key-for-signature
- /fix/dkim-passes-dmarc-fails
- /fix/dkim-signature-not-valid
- /fix/dmarc
- /fix/dmarc-fails-spf-dkim-pass
- /fix/dmarc-policy-none-vs-reject
- /fix/dmarc-quarantine-reject-policy-not-enabled
- /fix/dnssec
- /fix/forwarding-breaks-spf
- /fix/gmail-550-5-7-1
- /fix/hsts
- /fix/https
- /fix/infrastructure
- /fix/ipv6
- /fix/is-com-safer-than-net-or-org
- /fix/mime-sniffing
- /fix/mx
- /fix/nameservers
- /fix/new-domain-spf-dkim-dmarc
- /fix/newsletter-emails-failing-dmarc
- /fix/no-spf-record-found
- /fix/not-secure
- /fix/outlook-rejecting-mail
- /fix/referrer-policy
- /fix/reverse-dns
- /fix/soa-record
- /fix/someone-is-sending-emails-from-my-domain
- /fix/spf
- /fix/spf-broke-after-switching-provider
- /fix/spf-failing-saas-europe
- /fix/spf-permerror-too-many-dns-lookups
- /fix/tls
- /fix/yahoo-554-5-7-9
- /fix/your-connection-is-not-private
Setup guides 55 pages
Per-provider walkthroughs: where the record goes and what to type.
- /setup/caa/cloudflare
- /setup/caa/godaddy
- /setup/caa/namecheap
- /setup/caa/route-53
- /setup/dkim/beget
- /setup/dkim/bluehost
- /setup/dkim/cloudflare
- /setup/dkim/godaddy
- /setup/dkim/google-workspace
- /setup/dkim/hostinger
- /setup/dkim/ionos
- /setup/dkim/microsoft-365
- /setup/dkim/namecheap
- /setup/dkim/porkbun
- /setup/dkim/reg-ru
- /setup/dkim/route-53
- /setup/dkim/squarespace
- /setup/dkim/timeweb
- /setup/dkim/wix
- /setup/dmarc/beget
- /setup/dmarc/bluehost
- /setup/dmarc/cloudflare
- /setup/dmarc/godaddy
- /setup/dmarc/google-workspace
- /setup/dmarc/hostinger
- /setup/dmarc/ionos
- /setup/dmarc/microsoft-365
- /setup/dmarc/namecheap
- /setup/dmarc/porkbun
- /setup/dmarc/reg-ru
- /setup/dmarc/route-53
- /setup/dmarc/squarespace
- /setup/dmarc/timeweb
- /setup/dmarc/wix
- /setup/dnssec/cloudflare
- /setup/dnssec/godaddy
- /setup/dnssec/namecheap
- /setup/dnssec/reg-ru
- /setup/dnssec/route-53
- /setup/spf/beget
- /setup/spf/bluehost
- /setup/spf/cloudflare
- /setup/spf/godaddy
- /setup/spf/google-workspace
- /setup/spf/hostinger
- /setup/spf/ionos
- /setup/spf/microsoft-365
- /setup/spf/namecheap
- /setup/spf/porkbun
- /setup/spf/reg-ru
- /setup/spf/route-53
- /setup/spf/squarespace
- /setup/spf/timeweb
- /setup/spf/wix
- /setup/tls/lets-encrypt
Trends 6 pages
What moved between editions, and what we compare when we say so.
Research 16 pages
Standing datasets and the DMARC adoption tables.
- /research
- /research/csp-adoption-corrected
- /research/dmarc-rua
- /research/does-my-csp-do-anything
- /research/f-grade-score-bands
- /research/google-site-verification
- /research/how-insecure-is-the-internet
- /research/how-many-txt-records-should-a-domain-have
- /research/microsoft-365-marker-vs-mail-routing
- /research/openai-domain-verification
- /research/server-and-x-powered-by-headers
- /research/stripe-verification-record-count
- /research/three-records-away-from-a-c
- /research/unsafe-inline-and-frame-ancestors
- /research/verification-token-census
- /research/verification-token-long-tail
Tools 7 pages
Pages that take an input and answer about it.
Edition v10 44 pages
The September 2026 census: hub, data, methodology and the reports.
- /v10
- /v10/data
- /v10/data/census.json
- /v10/data/tld-grades.csv
- /v10/explore
- /v10/how-the-domains-were-counted
- /v10/how-the-grade-is-built
- /v10/magy-readiness
- /v10/methodology
- /v10/methodology/caa-record
- /v10/methodology/cdn-waf-detection
- /v10/methodology/cert-expiry-warning
- /v10/methodology/cert-key-strength
- /v10/methodology/cert-signature-algorithm
- /v10/methodology/cert-valid
- /v10/methodology/cipher-strength
- /v10/methodology/coep-header
- /v10/methodology/coop-header
- /v10/methodology/corp-header
- /v10/methodology/csp-header
- /v10/methodology/dkim-exists
- /v10/methodology/dmarc-policy
- /v10/methodology/dmarc-reporting
- /v10/methodology/dnssec-dnskey
- /v10/methodology/dnssec-ds
- /v10/methodology/hosting-provider
- /v10/methodology/hsts-header
- /v10/methodology/http-to-https-redirect
- /v10/methodology/https-available
- /v10/methodology/ipv6-support
- /v10/methodology/mx-record
- /v10/methodology/nameserver-diversity
- /v10/methodology/ocsp-stapling
- /v10/methodology/referrer-policy
- /v10/methodology/reverse-dns
- /v10/methodology/secure-renegotiation
- /v10/methodology/soa-configuration
- /v10/methodology/spf-exists
- /v10/methodology/spf-policy-strength
- /v10/methodology/tls-compression
- /v10/methodology/tls-version
- /v10/methodology/x-content-type-options
- /v10/methodology/x-frame-options
- /v10/why-the-f-rate-fell
Articles 12 pages
The explainer and research corpus, including the pieces at a root slug.
Stats 41 pages
One permalink per cited statistic, each with a JSON twin.
- /stats
- /stats/how-many-domains-have-full-email-protection
- /stats/how-many-domains-have-no-email-authentication
- /stats/how-many-domains-have-zero-security-controls
- /stats/how-many-domains-score-b-or-better
- /stats/how-many-domains-sit-on-parking-nameservers
- /stats/how-many-domains-use-cloudflare-dns
- /stats/how-many-https-sites-lack-hsts
- /stats/how-many-mail-domains-lack-authentication
- /stats/how-many-spf-records-use-plus-all
- /stats/how-many-tlds-does-the-census-cover
- /stats/how-many-websites-get-https-hsts-and-csp-right
- /stats/how-many-websites-pass-every-security-header-check
- /stats/how-many-websites-use-cross-origin-isolation-headers
- /stats/how-many-websites-use-self-signed-certificates
- /stats/how-secure-is-com
- /stats/what-is-lets-encrypts-market-share
- /stats/what-is-the-most-common-web-server
- /stats/what-percent-of-com-domains-have-dmarc
- /stats/what-percent-of-domains-fail-dmarc
- /stats/what-percent-of-domains-fail-security
- /stats/what-percent-of-domains-get-an-a
- /stats/what-percent-of-domains-have-caa-records
- /stats/what-percent-of-domains-have-dmarc
- /stats/what-percent-of-domains-have-mx-records
- /stats/what-percent-of-domains-have-spf
- /stats/what-percent-of-domains-support-ipv6
- /stats/what-percent-of-domains-use-dnssec
- /stats/what-percent-of-spf-records-use-hard-fail
- /stats/what-percent-of-spf-records-use-soft-fail
- /stats/what-percent-of-websites-block-clickjacking
- /stats/what-percent-of-websites-have-a-content-security-policy
- /stats/what-percent-of-websites-set-a-referrer-policy
- /stats/what-percent-of-websites-set-x-content-type-options
- /stats/what-percent-of-websites-use-hsts
- /stats/what-percent-of-websites-use-tls-1-3
- /stats/which-tld-has-the-best-security
- /stats/which-tld-has-the-worst-security
- /stats/which-tld-leads-on-dmarc-enforcement
- /stats/which-tld-leads-on-dnssec
- /stats/who-issues-the-most-tls-certificates
Policy 13 pages
Terms, privacy, scope, and the pages that say who we are.
249 pages in 10 groups. Machine-readable: sitemap.xml, rss.xml, llms.txt.