Defaults.Exposed › Stats › Combined exposure
How many domains deploy all five baseline security controls?
As of July 28, 2026 · census snapshot 2026-07-28
As of July 28, 2026, only 834,509 domains — 0.30% of the 276 million graded in the Defaults.Exposed census — deploy all five baseline controls: SPF, enforcing DMARC, DNSSEC, HTTPS and HSTS.
| Controls deployed | Domains | Share |
|---|---|---|
| 0 of 5 (fully exposed) | 23,298,293 | 8.45% |
| 1 of 5 | 107,302,883 | 38.92% |
| 2 of 5 | 108,519,087 | 39.37% |
| 3 of 5 | 29,461,853 | 10.69% |
| 4 of 5 | 6,249,650 | 2.27% |
| 5 of 5 (fully locked) | 834,509 | 0.30% |
Cite this
Statistic current as of July 28, 2026. Recomputed from the live census each edition; the number on this page and the machine-readable twin always match. Please cite Defaults.Exposed and link this page.
Defaults.Exposed, "How many domains deploy all five baseline security controls?" (as of July 28, 2026). https://defaults.exposed/stats/how-many-domains-deploy-all-five-baseline-controls
Permalink:https://defaults.exposed/stats/how-many-domains-deploy-all-five-baseline-controls · Machine-readable:fully-locked.json · Licence:open data
Methodology: how we grade the internet · Source data: defaults.exposed/data. Updated with each census edition.