What we will and will not compare between census editions

Before you write “up from X to Y” about two figures from two editions of the census, check that both were measured over the same thing. With most published statistics you can’t tell. On this site the question is settled in advance, and the answer is narrow: a figure is compared across editions only when its denominator is a set of records the census observed in that same edition. A share of all domains, however familiar it looks, isn’t compared at all.

Why a share of domains can move without a record changing

Each edition of the census starts from a fresh source list. The census pulls the zone files and crawl indexes again and drops the names that no longer exist. A different set of names survives each month. Up to September, a pass before the scan removed those names. From October, names that answer NXDOMAIN (Non-Existent Domain) are removed after the scan. The number of domains inside a TLD (Top-Level Domain) moves between editions, and it moves for reasons that have nothing to do with anyone’s DNS (Domain Name System).

Take a share like “domains with a DMARC record”. Its numerator is a count of records the census saw. Its denominator is the count of domains in the edition. If a source list picks up a few million parked names with no mail and no records, the denominator rises, the numerator stands still, and the share falls. Nobody removed a DMARC (Domain-based Message Authentication, Reporting and Conformance) record. The ratio moved anyway. The same distortion runs the other way when a list shrinks.

So before comparing any two figures, check what sits under the line. When the denominator is a domain count, the composition of the list is baked into the number, and you can’t take it back out afterwards. When the denominator is a set of records the census observed, composition mostly cancels, because a domain that arrives with no record adds nothing to either side and a domain that leaves takes its record from both. A name that doesn’t exist brings no record with it, so the mix lines below stay shares within each edition’s own observed record sets.

The same question applies when the domain under the line is your own. A cohort share, however well its denominator is chosen, describes a population. Whether your DMARC record ends in p=none, or your web host still answers on TLS 1.2 (Transport Layer Security), is a fact about one row. The free scan reads that row in under a minute and lists free fixes for what it finds.

The cohort the series are measured over

The census fixes the comparison set before it counts any fact. This edition of the census defines it as 1243 TLDs present in the July, August, September and October lakes (IDN TLDs excluded: their partition names differ between lakes). A TLD missing from any one of the four lakes is out, and the internationalised ones are out for the reason in the brackets.

Inside that cohort, each fact is computed identically per edition from the raw evidence, and disposition and grades play no part. The same code reads the same kind of evidence in each lake: the DMARC TXT (Text) string as fetched, the SPF (Sender Policy Framework) string as fetched, the TLS version the handshake settled on, the HTTP (Hypertext Transfer Protocol) response headers as received. Whether a domain was later marked graded, indeterminate, unreachable or dead has no bearing on the count, and neither does the grade it received. The grade stays out on purpose. Grading rules get revised, and a series built on grades would shift every time the rules did.

The rule, in one line

Compare only lines whose denominator is itself an observed record set in the same edition.

Four families of line pass that test. The census counts the DMARC policy mix (p=none, p=quarantine, p=reject) over cohort_dmarc_present, the DMARC records it observed in that edition. The SPF qualifier mix (-all, ~all, ?all, +all) has cohort_spf_present under it. TLS version sits over cohort_handshakes, the handshakes that completed, and HSTS (HTTP Strict Transport Security) and CSP (Content Security Policy) presence over cohort_http_answered, the hosts that returned an HTTP response. If you want to know what a DMARC policy or an HSTS or CSP header means for a single domain, those pages cover it. This page is only about whether the counts can be compared.

Two lines on the same sheet fail the test and are printed for transparency only: DMARC record present and SPF record present, both over cohort_domains. They’re there so you can watch the domain count move, which is the whole reason they aren’t quoted as a trend.

What isn’t compared, and why

This site keeps DKIM (DomainKeys Identified Mail) out of any edition comparison. The DKIM probe checks a fixed list of selectors. A domain whose selector isn’t on that list reads as not determinable, and the census can’t say whether it has DKIM at all. The size of that not-determinable pool depends on which selectors are in use and when the list was last edited. A series with that much unmeasured mass in it can move for reasons nobody can name, so it isn’t published as one.

Grades and dispositions aren’t compared either. A grade is the output of a scoring rule, and the rule is the site’s to change. Each edition’s grade shares describe that edition and stop there.

Then there’s the break between the August and September editions. The list of domains under measurement changed shape between those two months, for reasons on the sourcing side. This edition’s sheet has no like-for-like figure for that break, so this page records it as a fact with no number attached, and no percentage-point change in the F share between August and September appears on this site. If you see one quoted with this census as the source, it wasn’t taken from here.

The series that obey the rule

Here are two series from the cohort above, quoted as the sheet prints them with the denominator in the sentence, so you can carry that denominator into your own.

The first is the share of DMARC records whose policy is p=none, measured over cohort_dmarc_present, the DMARC records the census observed in each edition.

Read across the rows and the record set grows each month. Read down the share column and the mix holds within a single percentage point. The share describes the policy mix among records that exist and says nothing about how many domains have no record at all.

The second is the share of completed handshakes that negotiated TLS 1.3, measured over cohort_handshakes.

The August denominator is larger than any other edition’s, which is the composition break showing up in the handshake count. The share column is the part that can be compared, because a handshake that didn’t complete is on neither side of the line. What a TLS version means for a single site, and why 1.2 still answers on some hosts, is a separate question from whether these four shares line up.

How big a move has to be before it counts

Once the denominator is sound, the next test is size. The p=none share above stays within one percentage point across four editions. October’s reading is the lowest of the four, and it’s still less than a point below July’s. The TLS 1.3 share stays inside a single point too. Sound denominators don’t turn either of those into a trend, so this page doesn’t write them up as one.

This site describes a mix line as having shifted only when it has moved by at least one full percentage point, in the same direction, across three consecutive editions. Below that, month-to-month wobble in which domains happened to answer and which hosts timed out is enough to explain the movement, and the accurate description is “flat”. Above that, the sentence still carries the denominator, and it still says nothing about domains outside the record set.

What to write when you cite a change

Name the denominator in the sentence, in words. “Of the DMARC records observed in the cohort in the October 2026 edition, 50.98% carried p=none” is a sentence that survives someone checking it. “50.98% of domains have p=none” is wrong twice over. It uses the wrong denominator, and it’s a share of domains, which this site doesn’t publish as a series.

Keep the edition in the sentence, and quote the number as printed. If you’re comparing two editions, quote both rows and let the reader see the denominators move. If the thing you want to compare is a share of domains, a grade share, a DKIM figure or the F rate across the August break, the accurate citation is that the census doesn’t compare it. You can say why in one line: the denominators aren’t the same thing.

Figures from the defaults.exposed census, data as of 12 October 2026. Census numbers move every month; the current values are on the census data page.