Defaults.Exposed › Stats › TLDs compared

TLDs compared

5 statistics · figures as of September 5, 2026 · census snapshot 2026-09-05 · September 2026 edition

Whether the extension after the dot predicts anything about security, and where registry policy shows up in the data.

The census parses 1,433 top-level domains, which makes it possible to ask a question most datasets cannot: does the extension predict the posture? Weighted across all graded domains, 63.2% of domains under country-code TLDs score an F, against 78.0% under generic TLDs. That difference is real and it is smaller than the folklore suggests.

The two largest generic TLDs illustrate why aggregate comparisons mislead. 23.3% of graded .com domains publish a DMARC record and only 11.0% enforce it. For .org the figures are 25.4% publishing and 11.7% enforcing. Same broad category, different populations, different results, and neither number is explained by anything intrinsic to the extension.

What does move a TLD is registry policy. A registry that mandates or subsidises a control can shift its entire population inside one edition, which is visible in the data as a TLD that jumps rather than drifts. Nothing else in this dataset produces changes at that speed, and it is the strongest argument in the census for policy over persuasion: one decision at a registry outperforms years of advice to individual owners.

The practical reading for a domain owner is deflationary. A well-configured domain under a poorly-performing TLD is well configured, and a neglected domain under a strict registry is still neglected. TLD averages describe populations and predict nothing about an individual name. They are useful for spotting where policy is working and misleading for almost everything else.

One methodological note, because it is the source of most bad TLD statistics: never quote a global average without splitting country-code from generic. The two populations differ in size, age, price and registration rules, and any figure that blends them is dominated by whichever happens to be larger in that measurement rather than by anything about the extensions themselves.

The methodological warning deserves expanding, because it is the single most common way TLD statistics mislead. Country-code and generic TLDs differ in registration price, eligibility rules, average age and the mix of businesses against resellers underneath them. Any average that blends the two is dominated by whichever population is larger in that particular measurement, which means the same underlying data can be arranged to show either group ahead. Every TLD figure on this site is reported split for that reason, and a blended one quoted anywhere should be read as a presentation choice rather than a finding.

Registry and registrar also get conflated, and they pull in opposite directions. A registry sets policy for an entire TLD and can move millions of domains with one rule. A registrar controls the interface an individual owner actually uses, and can make a control either two clicks or effectively impossible. Where the census finds a TLD doing unusually well, the explanation is almost always a registry decision. Where it finds a control stuck everywhere at once, the explanation is usually registrar interfaces, which is the harder problem because it is a thousand separate companies rather than one.

The extension is not your posture. The records you publish are. The scan reads yours directly.

← All sections · how we grade · data & downloads