Defaults.Exposed › Stats
Domain security statistics
71 canonical numbers from the Defaults.Exposed census — each with its own permalink, a one-sentence dated answer, and a machine-readable JSON twin. As of .
Every statistic is recomputed from the live census each edition. For headline figures and downloads see /data; for how grading works see the methodology.
Census & population
- How many registered domains are there? — 360,067,238
- How many domains does Defaults.Exposed grade? — 296,674,837
- How many TLDs does the census cover? — 1,386
- How many registered domains are dead? — 5,455,696
- Are country-code TLDs more secure than generic TLDs? — 61.5%
Security grades
Email authentication (SPF, DKIM, DMARC)
- What percent of domains have an SPF record? — 51.2%
- What percent of domains have DMARC? — 25.8%
- What percent of domains enforce DMARC? — 11.8%
- What percent of DMARC records are p=none? — 54.1%
- What percent of domains have DKIM? — 51.2%
- How many domains have no email authentication at all? — 119,454,538
- How many domains have SPF but no DMARC? — 85,070,427
- How many domains can be email-spoofed? — 243,029,017
- How many domains have full email authentication? — 7,678,989
- How many mail-receiving domains lack email authentication? — 27,539,878
- What percent of SPF records end in -all (hard fail)? — 39.2%
- What percent of SPF records end in ~all (soft fail)? — 55.9%
- How many SPF records use +all? — 36,262
- How many SPF records exceed the 10-DNS-lookup limit? — 7,979
- What percent of DMARC records enable aggregate reporting? — 39.4%
- What is the most common DMARC policy typo? — quarentine
- What percent of domains publish MX records? — 59.2%
- Who hosts the world's email domains? — Google Workspace
- How many domains use Google Workspace for email? — 20,803,363
- How many domains use Microsoft 365 for email? — 14,051,037
- What percent of domains self-host their email? — 52.84%
DNS & infrastructure
- What percent of domains use DNSSEC? — 6.3%
- How many DNSSEC deployments are broken? — 1.4%
- What percent of domains have CAA records? — 1.5%
- What percent of domains support IPv6? — 23.1%
- What percent of domains have reverse DNS? — 76.3%
- Who runs the world's DNS? — GoDaddy
- How many domains use Cloudflare DNS? — 40,869,253
- How many domains sit on parking nameservers? — 21,730,187
TLS & certificates
- What percent of domains serve HTTPS? — 76.3%
- How many websites are still HTTP-only? — 65,226,956
- What percent of websites use TLS 1.3? — 94.8%
- How many websites top out at TLS 1.2? — 10,849,118
- What percent of TLS certificates are valid? — 91.2%
- How many websites use self-signed certificates? — 3,306,642
- What is Let's Encrypt's market share? — 52.62%
- Who issues the most TLS certificates? — Let's Encrypt
- What is Google Trust Services' market share? — 17.27%
- What percent of websites use HSTS? — 19.1%
- How many HTTPS sites lack HSTS? — 170,206,896
Web security headers
- What percent of websites have a Content-Security-Policy? — 3.8%
- What percent of websites block clickjacking? — 5.7%
- What percent of websites set X-Content-Type-Options? — 7.3%
- What percent of websites set a Referrer-Policy? — 3.0%
- How many websites pass every security-header check? — 1,190,045
- How many websites use cross-origin isolation headers? — 2,900,221
- How many websites deploy HTTPS, HSTS and CSP together? — 4,512,670
Web servers & hosting
- What is the most common web server? — cloudflare
- What percent of websites reveal their server software? — 69.0%
- How many websites send an X-Powered-By header? — 22,957,264
Combined exposure
TLDs compared
- Which TLD has the best security? — .ch
- Which TLD has the worst security? — .top
- How secure is .com? — 73.7%
- What share of all domains are .com? — 47.9%
- Is .net more or less secure than .com? — 81.0%
- Which TLD leads on DNSSEC adoption? — .se
- Which TLD leads on DMARC enforcement? — .ch
- Which TLD lags furthest on HTTPS? — .xyz
Cite these
Each statistic page carries its own citation block, permalink and machine-readable twin at /stats/s/<id>.json. Licence: open data. Please cite Defaults.Exposed and link the statistic's page.