Defaults.Exposed › Stats › Census & population

Census & population

1 statistic · figures as of November 2, 2026 · census snapshot 2026-11-02 · November 2026 edition

How many domains the census scanned, how many it could grade, and what happened to the rest.

A domain-security statistic is only as good as the population behind it, and most published figures never say what theirs is. The census starts from the widest name lists it can obtain instead of a list of popular sites. Three feeds contribute names: zone files, DNS (Domain Name System) measurement data and web crawl data. The census unions them, removes the names that no longer exist and the phantoms that wildcarded TLDs invent, and scans what is left: 364,204,070 domains across 1,436 top-level domains. That scanned universe is the denominator. It is not the size of the internet, because a name no feed has observed cannot be counted. It includes parked and long-untouched domains alongside domains that carry a company’s entire mail flow.

Of those scanned domains, 332,124,855, or 91.2%, answered enough to be graded. The rest fall into three groups. 0.7% are dead: the scan asked for their nameservers and got a definitive empty answer, and nothing else resolved, so no record of any kind can be read, and the census grades them F. A further 3.8% were unreachable, delegated but with nothing answering the scanner in either pass, and 4.3% answered without returning enough to grade. Roughly nine in ten scanned domains could be graded, and every one that could not is counted in one of those three groups.

That matters for every other number on this site. Quote a security statistic against every name a feed carries and it is diluted by names that do not exist. Quote it against a top-million list and you flatter the internet, because the top million are run by people with security teams. The census grades every scanned domain that returned enough to grade, gives the dead ones an F, and states the denominator on every page so anyone can check the arithmetic.

The other reason to start here is comparability. A figure computed against a different population measures something else, and it ranks neither above nor below ours. When a vendor reports DMARC (Domain-based Message Authentication, Reporting and Conformance) adoption at fifty-something percent and the census reports a much lower number, both can be correct: theirs is usually a panel of customers or a list of large organisations, ours is every scanned domain that carries a grade. The useful question is which of those populations your own domain belongs to.

The census has three limits. It measures registrable domains, not subdomains, so a company with one registered name and four hundred hostnames appears once. It measures what is published in public DNS and answered over the public internet, so anything behind a private resolver or an internal zone is invisible to it. And it measures configuration rather than behaviour: whether a protective record exists, not whether anyone has yet tried to abuse its absence.

The edition cadence matters for the same reason. Each edition is a snapshot taken over a defined window rather than a rolling average, and every figure on this site carries the snapshot date it came from. That makes any single figure checkable against the published dataset. It does not make editions directly comparable: the source feeds, the wildcard list and the existence pass all change between editions, so a difference between two editions can reflect a change in the population as much as a change in the internet. This edition’s population was rebuilt, and its shares are not comparable with earlier editions. The snapshot model also means a number here can lag a change you made last week.

Your own domain sits somewhere in that population. The free scan tells you where, without an account.

← All sections · how we grade · data & downloads