Defaults.Exposed › Stats › Security grades
Security grades
3 statistics · figures as of November 2, 2026 · census snapshot 2026-11-02 · November 2026 edition
What the A-to-F distribution actually looks like across the whole measurable internet, and why the shape is so lopsided.
| Measure | As of November 2, 2026 |
|---|---|
| Domains scoring an F | 73.5% |
| Domains scoring A or A+ | 0.27% |
| A+ domains | 118,030 |
| B-or-better domains | 8,859,180 |
The grade distribution is the most compressed summary the census produces. 73.5% of the 335 million graded domains score an F: 246,217,810 domains that fail the basic, externally observable protections. At the other end, 0.27% reach an A or A+, and only 118,030 domains hold an A+ outright. Between those poles, 8,859,180 domains manage a B or better, which is 2.65% of everything graded.
Every control in the grade is free, publishable through a registrar or DNS (Domain Name System) host in minutes, and requires no software, licence or vendor. What the distribution shows is defaults: what a domain looks like when nobody has configured it.
That also explains why the curve moves faster than people expect. A domain’s grade is built from independent checks, so one published DNS record can carry it across a boundary. A hosting platform that turns a header on for every customer moves a percentage point of the whole internet in a week, without a single customer deciding anything. Most of the movement between editions comes from platforms changing their defaults.
The F cohort deserves one clarification, because it is the figure most often misquoted. An F does not mean a domain has been compromised or is doing anything wrong. It means the domain publishes none of the protections that would stop someone forging mail from it or intercepting traffic to it. It records what is absent. An attacker choosing which name to impersonate looks for domains in that state.
The mechanics behind a grade are deliberately unclever. Each check is decided independently, a domain either publishes what the check looks for or it does not, and the grade is the arithmetic of those results rather than a judgement applied on top. Industry, company size and intent do not enter the calculation. A large organisation with no SPF (Sender Policy Framework) record scores exactly what a dormant domain with no SPF record scores, because to someone forging mail from either of them the situation is identical.
One rule does more work than any other: a check the census cannot decide is recorded as undetermined and excluded from that domain's denominator, never counted as a failure. A timeout, a refused query or a redacted source produces no data, and no data is not evidence of absence. That single decision means no domain is marked down for a check the census could not complete, which makes the grades harder to argue with. It is the first thing to check when comparing this distribution against anyone else's.
A grade lists the records a domain is missing. Find out which ones are missing from yours.
Every statistic in Security grades
Each has its own citable permalink and a machine-readable twin at
/stats/s/<id>.json, resolved from the same census files as the figures above.