Defaults.Exposed › Stats › Combined exposure
How many domains have zero baseline security controls?
October 2026 census edition
As of October 12, 2026, 60,347,767 domains (18.2% of the 332 million graded in the Defaults.Exposed census) deploy none of the five baseline controls (SPF, enforcing DMARC, DNSSEC, HTTPS, HSTS).
Fully exposed domains (0/5): how it is measured
It comes from the cross-check pass, which takes the per-domain results and counts the combinations: domains holding one control but not another, and domains holding a whole set together. Every domain in the census is measured directly and counted once.
Zero controls is the other end of the same measurement: nothing published, on any of the five. They are in the state a new domain arrives in.
The figure is an absolute count of domains rather than a sample scaled up. A domain the census could not decide on is left out rather than estimated.
It moves when domains close whole combinations of gaps rather than single ones. Combined figures move more slowly than single-control figures, because a domain only counts once it holds every control in the combination. The number is recomputed from the raw evidence at every edition. What it cannot tell you is where one particular domain stands: for that, see check your own combination.
the full grading methodology · the underlying dataset, published open with the counts behind every percentage. If a figure here disagrees with one elsewhere on the site, the dataset is canonical and we would like to know.
| Controls deployed | Domains | Share |
|---|---|---|
| 0 of 5 (fully exposed) | 60,347,767 | 18.15% |
| 1 of 5 | 111,113,342 | 33.42% |
| 2 of 5 | 117,172,732 | 35.24% |
| 3 of 5 | 34,623,792 | 10.41% |
| 4 of 5 | 7,908,752 | 2.38% |
| 5 of 5 (fully locked) | 1,325,934 | 0.40% |
Fully exposed domains (0/5): how to cite it
Please cite Defaults.Exposed and link this page. The citation below carries the date.
Defaults.Exposed, "How many domains have zero baseline security controls?" (as of October 12, 2026). https://defaults.exposed/stats/how-many-domains-have-zero-security-controls
Permalink: https://defaults.exposed/stats/how-many-domains-have-zero-security-controls · Machine-readable: /stats/s/fully-exposed.json · Licence: open data
Methodology: how we grade the internet · Source data: census data and downloads. Updated with each census edition.