Defaults.Exposed › Stats
Domain security statistics
40 canonical numbers from the Defaults.Exposed census: each with its own permalink, a one-sentence dated answer, and a machine-readable JSON twin. As of .
Every statistic is recomputed from the live census each edition. For headline figures and downloads see /data; for how grading works see the methodology.
Census & population
Security grades
Email authentication (SPF, DKIM, DMARC)
- What percent of domains have an SPF record? · 47.4%
- What percent of domains have DMARC? · 24.8%
- How many domains have no email authentication at all? · 149,416,895
- How many domains have full email authentication? · 7,862,126
- How many mail-receiving domains lack email authentication? · 29,326,259
- What percent of SPF records end in -all (hard fail)? · 38.4%
- What percent of SPF records end in ~all (soft fail)? · 56.1%
- How many SPF records use +all? · 39,589
- What percent of domains publish MX records? · 54.8%
- What percent of domains fail DMARC? · 88.4%
- What percent of .com domains have DMARC? · 23.3%
DNS & infrastructure
- What percent of domains use DNSSEC? · 6.9%
- What percent of domains have CAA records? · 1.4%
- What percent of domains support IPv6? · 21.8%
- How many domains use Cloudflare DNS? · 49,278,555
- How many domains sit on parking nameservers? · 22,163,989
TLS & certificates
- What percent of websites use TLS 1.3? · 94.4%
- How many websites use self-signed certificates? · 4,160,496
- What is Let's Encrypt's market share? · 55.73%
- Who issues the most TLS certificates? · Let's Encrypt
- What percent of websites use HSTS? · 21.1%
- How many HTTPS sites lack HSTS? · 167,470,119
Web security headers
- What percent of websites have a Content-Security-Policy? · 10.1%
- What percent of websites block clickjacking? · 15.3%
- What percent of websites set X-Content-Type-Options? · 17.8%
- What percent of websites set a Referrer-Policy? · 7.9%
- How many websites pass every security-header check? · 1,384,815
- How many websites use cross-origin isolation headers?
- How many websites deploy HTTPS, HSTS and CSP together? · 5,430,609
Web servers & hosting
- What is the most common web server? · cloudflare
Combined exposure
TLDs compared
Cite these
Each statistic page carries its own citation block, permalink and machine-readable twin at /stats/s/<id>.json. Licence: open data. Please cite Defaults.Exposed and link the statistic's page.