Defaults.Exposed › Stats › TLDs compared

TLDs compared

5 statistics · figures as of November 2, 2026 · census snapshot 2026-11-02 · November 2026 edition

Whether the extension after the dot predicts anything about security, and where registry policy shows up in the data.

The census parses 1,436 top-level domains, which makes it possible to ask a question most datasets cannot: does the extension predict the posture? Weighted across all graded domains, 65.3% of domains under country-code TLDs score an F, against 76.9% under generic TLDs. That difference is real and it is smaller than the folklore suggests.

The two largest generic TLDs illustrate why aggregate comparisons mislead. 24.5% of graded .com domains publish a DMARC record and only 11.9% enforce it. For .org the figures are 26.2% publishing and 12.5% enforcing. Both are generic TLDs with different populations and different results, and neither number is explained by anything intrinsic to the extension.

What does move a TLD is registry policy. A registry that mandates or subsidises a control can shift its entire population inside one edition, which is visible in the data as a TLD that jumps rather than drifts. Nothing else in this dataset produces changes at that speed.

The practical reading for a domain owner is deflationary. A domain’s own records decide its posture, whichever TLD it sits under. TLD averages describe populations and predict nothing about an individual name. They are useful for spotting where policy is working.

One methodological warning, because it is the single most common way TLD statistics mislead: never quote a global average without splitting country-code from generic. Country-code and generic TLDs differ in size, registration price, eligibility rules, average age and the mix of businesses against resellers underneath them. Any average that blends the two is dominated by whichever population is larger in that particular measurement, which means the same underlying data can be arranged to show either group ahead. Every TLD figure on this site is reported split for that reason, so treat a blended one quoted elsewhere with caution.

Registry and registrar also get conflated, and they pull in opposite directions. A registry sets policy for an entire TLD and can move millions of domains with one rule. A registrar controls the interface an individual owner actually uses, and can make a control either two clicks or effectively impossible. Where the census finds a TLD doing unusually well, the explanation is almost always a registry decision. Where it finds a control stuck everywhere at once, the explanation is usually registrar interfaces, which are harder to change because they belong to a thousand separate companies.

Your posture comes from the records you publish, whatever the extension. The scan reads yours directly.

← All sections · how we grade · data & downloads