Defaults.Exposed › Stats › DNS & infrastructure

DNS & infrastructure

5 statistics · figures as of November 2, 2026 · census snapshot 2026-11-02 · November 2026 edition

DNSSEC (Domain Name System Security Extensions), CAA (Certification Authority Authorization), IPv6 and the handful of providers who between them answer for most of the internet.

DNS is the layer everything else depends on, and it is the least protected layer the census measures. 7.1% of graded domains have a valid DNSSEC chain. A further 0.0% are signed but broken, which is its own category of problem: a broken chain can make a domain unreachable for validating resolvers while providing none of the protection signing was meant to buy. Among all signed domains, 0.6% are in that broken state.

Certificate authority authorisation is the other control at this layer, and adoption is similarly thin at 1.8%. A CAA record is one line that names which certificate authorities may issue for your domain. Without it, any authority on earth may issue a certificate for your name, and nothing in the process would tell you it had happened.

DNS hosting is concentrated. The largest DNS provider alone serves 16.42% of domains with nameservers, and Cloudflare specifically answers for 54,053,892 domains, or 16.42% of them. A default changed at one provider improves millions of domains overnight, which is most of how adoption figures move at all. It also means a small number of operators hold a great deal of the internet’s resolution in their configuration choices.

IPv6 reachability sits at 22.1%. And 24,097,113 domains sit on dedicated parking nameservers, registered but pointed at nothing in particular and held for resale.

DNSSEC adoption is stuck because of how the work is split between companies. Signing a zone is straightforward at the DNS host, but completing the chain requires publishing a DS (Delegation Signer) record at the registrar, and registrar interfaces for that range from buried to absent. The result is a control where the operator who can sign and the operator who can complete the chain are frequently different companies, with the customer in between. Where a single provider does both, adoption is markedly higher.

There is also a resolver side that no site-level measurement can see. A signed domain only benefits visitors whose resolver actually validates signatures, and a broken chain only harms those same visitors. That asymmetry is why signed-but-broken is worse than unsigned: an unsigned domain is merely unprotected, while a broken one can be unreachable for the most security-conscious part of its audience while offering nothing to anybody else.

DNSSEC and CAA are both single records published through your DNS host. The scan tells you whether yours are there.

← All sections · how we grade · data & downloads