Defaults.Exposed › Stats › Combined exposure

Combined exposure

1 statistics · figures as of September 5, 2026 · census snapshot 2026-09-05 · September 2026 edition

What happens when you stop counting controls one at a time and start counting the domains that hold several at once.

Single-control adoption figures are the friendliest way to describe the internet, because a domain that holds one control out of six appears in the numerator six separate times across six separate statistics. Combined figures remove that flattery, and they are the reason this section exists.

On the email side, 7,862,126 domains, 2.5% of everything graded, pass the full email-authentication cross-check: SPF present, an enforcing DMARC policy, and DKIM discoverable. Compare that against the individual adoption numbers in the email section and the difference is the whole point. Plenty of domains have one piece. Very few have the set, and only the set actually prevents the thing everyone is worried about.

The web side tells the same story. 5,430,609 domains, 1.7%, deploy HTTPS, HSTS and a Content-Security-Policy together, even though HTTPS on its own is close to universal. And only 1,384,815 pass every security-header check simultaneously. Each of these controls is individually easy; holding several at once is what takes an owner who has decided to.

This is also why grade distributions look worse than adoption charts, and why the two are often quoted against each other as though one must be wrong. Adoption asks whether a control exists somewhere on the internet. A grade asks whether a given domain holds enough of them to be defensible. The gap between those two questions is the actual security problem, and it is measured here.

The arithmetic is worth doing once, because it explains why combined figures look so punishing. If six controls were adopted independently at roughly half the internet each, holding all six at once would be the product of those rates, well under two percent, even while every individual figure looked respectable. Real adoption is not independent, which helps: a domain that publishes one record is more likely to publish another, because somebody is paying attention. But the direction of the effect is the same, and it is why a chart of individual controls always tells a happier story than a chart of domains.

What a complete domain actually looks like is unremarkable. SPF naming the real senders, DKIM signing, DMARC at quarantine or reject with a reporting address, DNSSEC signed and unbroken, a CAA record, HTTPS with HSTS, and the four response headers. Every item free, every item publishable through interfaces the owner already has, and together they describe a small fraction of the internet. The scarcity is not cost. It is that nothing prompts anyone to do them, and nothing visibly breaks when they are skipped.

Your domain either holds the set or it holds part of it. Thirty seconds will tell you which, and what is missing.

← All sections · how we grade · data & downloads