Sitemap
Every page this site publishes for indexing, grouped by what it is for. There are 239 of them. This is the same set sitemap.xml carries, generated from the same source, so the two cannot drift apart.
What is not here: the August 2026 edition under /v9, which is retired and now answers a 301 to its current-edition equivalent for every URL; the retired families, which answer 410 Gone and are listed at /retired.json; and this page itself.
Home and pillars 8 pages
The scan, and the seven checks it reports against.
Fix guides 44 pages
One page per failing check and per error string, with the exact record to publish.
- /fix
- /fix/550-5-7-26-sender-is-unauthenticated
- /fix/bimi
- /fix/caa
- /fix/certificate
- /fix/clickjacking
- /fix/contact-form-emails-going-to-spam
- /fix/cross-origin-headers
- /fix/csp
- /fix/dane
- /fix/dkim
- /fix/dkim-body-hash-did-not-verify
- /fix/dkim-no-key-for-signature
- /fix/dkim-signature-not-valid
- /fix/dmarc
- /fix/dmarc-fails-spf-dkim-pass
- /fix/dmarc-policy-none-vs-reject
- /fix/dmarc-quarantine-reject-policy-not-enabled
- /fix/dnssec
- /fix/forwarding-breaks-spf
- /fix/gmail-550-5-7-1
- /fix/hsts
- /fix/https
- /fix/infrastructure
- /fix/ipv6
- /fix/is-com-safer-than-net-or-org
- /fix/mime-sniffing
- /fix/mx
- /fix/nameservers
- /fix/new-domain-spf-dkim-dmarc
- /fix/newsletter-emails-failing-dmarc
- /fix/no-spf-record-found
- /fix/not-secure
- /fix/outlook-rejecting-mail
- /fix/referrer-policy
- /fix/reverse-dns
- /fix/someone-is-sending-emails-from-my-domain
- /fix/spf
- /fix/spf-broke-after-switching-provider
- /fix/spf-failing-saas-europe
- /fix/spf-permerror-too-many-dns-lookups
- /fix/tls
- /fix/yahoo-554-5-7-9
- /fix/your-connection-is-not-private
Setup guides 34 pages
Per-provider walkthroughs: where the record goes and what to type.
- /setup
- /setup/caa
- /setup/caa/cloudflare
- /setup/caa/route-53
- /setup/dkim
- /setup/dkim/beget
- /setup/dkim/cloudflare
- /setup/dkim/godaddy
- /setup/dkim/google-workspace
- /setup/dkim/microsoft-365
- /setup/dkim/namecheap
- /setup/dkim/reg-ru
- /setup/dkim/route-53
- /setup/dmarc
- /setup/dmarc/cloudflare
- /setup/dmarc/godaddy
- /setup/dmarc/google-workspace
- /setup/dmarc/hostinger
- /setup/dmarc/microsoft-365
- /setup/dmarc/reg-ru
- /setup/dmarc/route-53
- /setup/dmarc/timeweb
- /setup/dmarc/wix
- /setup/dnssec
- /setup/dnssec/reg-ru
- /setup/spf
- /setup/spf/beget
- /setup/spf/godaddy
- /setup/spf/hostinger
- /setup/spf/porkbun
- /setup/spf/reg-ru
- /setup/spf/route-53
- /setup/spf/timeweb
- /setup/spf/wix
Trends 5 pages
What moved between editions, and what we compare when we say so.
Research 32 pages
Standing datasets and the DMARC (Domain-based Message Authentication, Reporting and Conformance) adoption tables.
- /research
- /research/city-tlds-ranked
- /research/cloudflare-proxied-share
- /research/csp-adoption-corrected
- /research/dkim-not-free-with-hosted-mail
- /research/dmarc-rua
- /research/does-my-csp-do-anything
- /research/domain-dark-matter
- /research/f-grade-score-bands
- /research/google-site-verification
- /research/gov-after-bod-18-01
- /research/how-domains-stack-security-controls
- /research/how-many-txt-records-should-a-domain-have
- /research/microsoft-365-marker-vs-mail-routing
- /research/money-moves-by-email
- /research/new-gtld-ghost-towns
- /research/not-a-website-certificate
- /research/one-mail-server-no-spare
- /research/openai-domain-verification
- /research/security-headers-that-do-nothing
- /research/server-and-x-powered-by-headers
- /research/shared-certificates-blast-radius
- /research/spf-vs-mx-vendor-mismatch
- /research/the-locked-vault
- /research/three-records-away-from-a-c
- /research/unsafe-inline-and-frame-ancestors
- /research/verification-token-census
- /research/verification-token-reuse
- /research/where-a-countrys-email-lives
- /research/who-answers-for-a-nation
- /research/whose-name-on-your-certificate
- /research/why-the-most-visited-domains-score-badly
Tools 7 pages
Pages that take an input and answer about it.
Census 31 pages
The current Defaults.Exposed census: hub, data, methodology and the reports.
- /census
- /data
- /data/census.json
- /data/tld-grades.csv
- /magy-readiness
- /methodology
- /methodology/caa-record
- /methodology/cert-expiry-warning
- /methodology/cert-key-strength
- /methodology/cert-signature-algorithm
- /methodology/cert-valid
- /methodology/cipher-strength
- /methodology/csp-header
- /methodology/dkim-exists
- /methodology/dmarc-policy
- /methodology/dmarc-reporting
- /methodology/dnssec
- /methodology/hsts-header
- /methodology/http-to-https-redirect
- /methodology/https-available
- /methodology/ipv6-support
- /methodology/mx-record
- /methodology/nameserver-diversity
- /methodology/referrer-policy
- /methodology/reverse-dns
- /methodology/soa-configuration
- /methodology/spf-exists
- /methodology/spf-policy-strength
- /methodology/tls-version
- /methodology/x-content-type-options
- /methodology/x-frame-options
Articles 15 pages
The explainer and research corpus, including the pieces at a root slug.
- /bimi-needs-dmarc
- /can-someone-spoof-my-domain
- /dmarc-subdomain-policy
- /dmarc-typos
- /dnssec-servfail
- /find-your-dkim-selector
- /gappssmtp-signing
- /glossary
- /how-the-domains-were-counted
- /how-the-grade-is-built
- /hsts
- /may-be-forged
- /parked-domain-spoofing
- /spf-all-qualifier
- /supplier-questionnaire-email-authentication
Stats 49 pages
One permalink per cited statistic, each with a JSON twin.
- /stats
- /stats/census
- /stats/dns
- /stats/email
- /stats/exposure
- /stats/grades
- /stats/headers
- /stats/how-many-domains-have-full-email-protection
- /stats/how-many-domains-have-no-email-authentication
- /stats/how-many-domains-have-zero-security-controls
- /stats/how-many-domains-score-b-or-better
- /stats/how-many-domains-sit-on-parking-nameservers
- /stats/how-many-domains-use-cloudflare-dns
- /stats/how-many-https-sites-lack-hsts
- /stats/how-many-mail-domains-lack-authentication
- /stats/how-many-spf-records-use-plus-all
- /stats/how-many-tlds-does-the-census-cover
- /stats/how-many-websites-get-https-hsts-and-csp-right
- /stats/how-many-websites-pass-every-security-header-check
- /stats/how-many-websites-use-self-signed-certificates
- /stats/how-secure-is-com
- /stats/stack
- /stats/tld
- /stats/tls
- /stats/what-is-lets-encrypts-market-share
- /stats/what-is-the-most-common-web-server
- /stats/what-percent-of-com-domains-have-dmarc
- /stats/what-percent-of-domains-fail-dmarc
- /stats/what-percent-of-domains-fail-security
- /stats/what-percent-of-domains-get-an-a
- /stats/what-percent-of-domains-have-caa-records
- /stats/what-percent-of-domains-have-dmarc
- /stats/what-percent-of-domains-have-mx-records
- /stats/what-percent-of-domains-have-spf
- /stats/what-percent-of-domains-support-ipv6
- /stats/what-percent-of-domains-use-dnssec
- /stats/what-percent-of-spf-records-use-hard-fail
- /stats/what-percent-of-spf-records-use-soft-fail
- /stats/what-percent-of-websites-block-clickjacking
- /stats/what-percent-of-websites-have-a-content-security-policy
- /stats/what-percent-of-websites-set-a-referrer-policy
- /stats/what-percent-of-websites-set-x-content-type-options
- /stats/what-percent-of-websites-use-hsts
- /stats/what-percent-of-websites-use-tls-1-3
- /stats/which-tld-has-the-best-security
- /stats/which-tld-has-the-worst-security
- /stats/which-tld-leads-on-dmarc-enforcement
- /stats/which-tld-leads-on-dnssec
- /stats/who-issues-the-most-tls-certificates
Policy 14 pages
Terms, privacy, scope, and the pages that say who we are.
239 pages in 10 groups. Machine-readable: sitemap.xml, rss.xml, llms.txt.