Defaults.Exposed › Stats › Combined exposure

Combined exposure

1 statistic · figures as of November 2, 2026 · census snapshot 2026-11-02 · November 2026 edition

What happens when you stop counting controls one at a time and start counting the domains that hold several at once.

Each single-control adoption figure counts the domains that hold one control and says nothing about the rest. A domain that holds one control out of six counts toward one adoption figure, and nothing in that figure shows the five it lacks. Combined figures count those gaps too, and this section reports them.

On the email side, 8,462,990 domains, 2.5% of everything graded, pass the full email-authentication cross-check: SPF (Sender Policy Framework) present, an enforcing DMARC (Domain-based Message Authentication, Reporting and Conformance) policy, and DKIM (DomainKeys Identified Mail) discoverable. That is lower than every individual adoption figure in the email section.

On the web side, 6,623,291 domains, 2.0%, deploy HTTPS (Hypertext Transfer Protocol Secure), HSTS (HTTP Strict Transport Security) and a Content-Security-Policy together, although 66.4% of graded domains serve HTTPS. And only 2,044,650 pass every security-header check simultaneously.

At the bottom of the same scale, 60,324,163 domains, 18.0% of everything graded, deploy none of the five baseline controls the census combines: SPF, an enforcing DMARC policy, DNSSEC (Domain Name System Security Extensions), HTTPS and HSTS. That is the statistic this section lists: every one of those domains is missing every control on the list.

This is also why grade distributions look worse than adoption charts, and why the two are often quoted against each other as though one must be wrong. Adoption asks whether a control exists somewhere on the internet. A grade asks whether a given domain holds enough of them to be defensible.

The arithmetic is worth doing once, because it explains why combined figures look so punishing. If six controls were adopted independently at roughly half the internet each, holding all six at once would be the product of those rates, well under two percent, even while every individual figure looked respectable. Real adoption is not independent, which helps: a domain that publishes one record is more likely to publish another, because somebody is paying attention. But the direction of the effect is the same, and it is why a chart of individual controls always tells a happier story than a chart of domains.

What a complete domain actually looks like is unremarkable. SPF naming the real senders, DKIM signing, DMARC at quarantine or reject with a reporting address, DNSSEC signed and unbroken, a CAA (Certification Authority Authorization) record, HTTPS with HSTS, and the four response headers. Every item is free and can be published through interfaces the owner already has, yet domains holding all of them are a small fraction of the internet. The set stays scarce because nothing prompts an owner to publish it and nothing stops working when it is missing.

Your domain either holds the set or it holds part of it. The free scan tells you which, and what is missing.

← All sections · how we grade · data & downloads