Defaults.Exposed › Stats
Domain security statistics
The census in 9 sections, each with the figures and what they mean read together, and 39 individual statistics underneath them: every one with its own permalink, a one-sentence dated answer, and a machine-readable JSON twin. As of .
Every statistic is recomputed from the live census each edition. For headline figures and downloads see census data and downloads; for how grading works see the methodology.
Census & population
1 statistic · read the Census & population analysis
Security grades
3 statistics · read the Security grades analysis
Email authentication (SPF, DKIM, DMARC)
11 statistics · read the Email authentication analysis
- What percent of domains have an SPF record? · 47.2%
- What percent of domains have DMARC? · 25.1%
- How many domains have no email authentication at all? · 157,320,430
- How many domains have full email authentication? · 8,262,372
- How many mail-receiving domains lack email authentication? · 29,970,338
- What percent of SPF records end in -all (hard fail)? · 39.1%
- What percent of SPF records end in ~all (soft fail)? · 55.5%
- How many SPF records use +all? · 40,988
- What percent of domains publish MX records? · 54.3%
- What percent of domains fail DMARC? · 88.0%
- What percent of .com domains have DMARC? · 24.0%
DNS & infrastructure
5 statistics · read the DNS & infrastructure analysis
- What percent of domains use DNSSEC? · 7.0%
- What percent of domains have CAA records? · 1.4%
- What percent of domains support IPv6? · 21.8%
- How many domains use Cloudflare DNS? · 52,173,900
- How many domains sit on parking nameservers? · 23,442,886
TLS & certificates
6 statistics · read the TLS & certificates analysis
- What percent of websites use TLS 1.3? · 94.5%
- How many websites use self-signed certificates? · 4,390,979
- What is Let's Encrypt's market share? · 56.68%
- Who issues the most TLS certificates? · Let's Encrypt
- What percent of websites use HSTS? · 21.4%
- How many HTTPS sites lack HSTS? · 173,148,160
Web security headers
6 statistics · read the Web security headers analysis
- What percent of websites have a Content-Security-Policy? · 2.85%
- What percent of websites block clickjacking? · 15.9%
- What percent of websites set X-Content-Type-Options? · 18.7%
- What percent of websites set a Referrer-Policy? · 8.9%
- How many websites pass every security-header check? · 1,728,228
- How many websites deploy HTTPS, HSTS and CSP together? · 6,006,555
Web servers & hosting
1 statistic · read the Web servers & hosting analysis
- What is the most common web server? · cloudflare
Combined exposure
1 statistic · read the Combined exposure analysis
TLDs compared
5 statistics · read the TLDs compared analysis
Cite these
Each statistic page carries its own citation block, permalink and machine-readable twin at /stats/s/<id>.json. Licence: open data. Please cite Defaults.Exposed and link the statistic's page, or see how to cite the census for the citation kit, one permalink per figure.