Defaults.Exposed › Stats › Combined exposure
How many domains have zero baseline security controls?
As of September 5, 2026 · census snapshot 2026-09-05 · page rebuilt 11 September 2026
As of September 5, 2026, 56,774,038 domains: 17.9% of the 317 million graded in the Defaults.Exposed census, deploy none of the five baseline controls (SPF, enforcing DMARC, DNSSEC, HTTPS, HSTS).
How this number is measured
It comes from the Defaults.Exposed census, a full pass over the public DNS, mail and TLS configuration of every domain we can resolve. There's no sampling and no panel behind it. Each domain is checked directly and counted once, and a check that can't be decided is recorded as undetermined rather than scored as a failure, so the denominator under the figure above is the set of domains where the check had something to read.
It says nothing about one domain in particular. A share of the internet tells you what the default looks like at scale; your own domain either publishes the record or it doesn't, and that takes about a minute to find out. The figure is recomputed from the raw evidence at every edition, so it moves when the internet moves rather than when we re-word the page.
Snapshot 2026-09-05, from the September 2026 edition · the full grading methodology · the underlying dataset, published open with the counts behind every percentage. If a figure here disagrees with one elsewhere on the site, the dataset is canonical and we would like to know.
| Controls deployed | Domains | Share |
|---|---|---|
| 0 of 5 (fully exposed) | 56,774,038 | 17.93% |
| 1 of 5 | 105,237,620 | 33.24% |
| 2 of 5 | 113,293,566 | 35.78% |
| 3 of 5 | 32,878,235 | 10.38% |
| 4 of 5 | 7,273,884 | 2.30% |
| 5 of 5 (fully locked) | 1,143,559 | 0.36% |
Cite this
The figure is current as of September 5, 2026 and is recomputed from the live census at every edition. The number on this page and the number in the machine-readable twin are resolved from the same file at build time, so they can't disagree. Please cite Defaults.Exposed and link this page.
Defaults.Exposed, "How many domains have zero baseline security controls?" (as of September 5, 2026). https://defaults.exposed/stats/how-many-domains-have-zero-security-controls
Permalink: https://defaults.exposed/stats/how-many-domains-have-zero-security-controls · Machine-readable: /stats/s/fully-exposed.json · Licence: open data
Methodology: how we grade the internet · Source data: defaults.exposed/data. Updated with each census edition.