How secure is .com?

.com failure rate: how it is measured

It comes from the existence pass, which unions three source feeds (zone files, DNS measurement data and web crawl data), removes the names that do not exist and the wildcard phantoms, and records which of the scanned domains could be graded. Every domain in the census is measured directly and counted once.

Because .com is by far the largest TLD (Top-Level Domain), its figures dominate any unsplit global average. Reporting it separately lets a reader check how much of a headline internet-wide number is really the .com figure.

The denominator under that share is 153.8 million: the population where this particular check had something to read. A domain the census could not decide on is recorded as undetermined and left out of it, never counted as a failure.

It moves when registry policy changes and when the population under a TLD turns over. A registry that mandates or subsidises a control can shift its whole TLD inside one edition. The number is recomputed from the raw evidence at every edition. What it cannot tell you is where one particular domain stands: for that, see the per-TLD data.

the full grading methodology · the underlying dataset, published open with the counts behind every percentage. If a figure here disagrees with one elsewhere on the site, the dataset is canonical and we would like to know.

.com failure rate: how to cite it

Please cite Defaults.Exposed and link this page. The citation below carries the date.

Defaults.Exposed, "How secure is .com?" (as of October 12, 2026). https://defaults.exposed/stats/how-secure-is-com

Permalink: https://defaults.exposed/stats/how-secure-is-com · Machine-readable: /stats/s/com-f-rate.json · Licence: open data

Methodology: how we grade the internet · Source data: census data and downloads. Updated with each census edition.

Related statistics

• Which TLD leads on DNSSEC adoption?
• Which TLD leads on DMARC enforcement?
• Which TLD has the best security?
• Which TLD has the worst security?