Defaults.Exposed › September 2026 census (v10)
The September 2026 domain security census (v10)
As of September 2026, 74.2% of 317M graded domains score an F in the Defaults.Exposed census of 347,691,016 scanned domains across 1,433 TLDs.
This is the permanently pinned home of the September 2026 (v10) census: the single place that links every part of this edition, the headline data and open downloads, the interactive explorer, the 34-check grading methodology and the MAGY sender-readiness scoreboard. Every figure in this edition is dated September 2026 and will never change. The previous edition stays where it was, at /v9.
Explore this edition
- Census data and downloads Headline statistics for email authentication, TLS and DNS, plus open CSV and JSON aggregates.
- Census explorer Filter by TLD and security check for a quotable stat with a shareable permalink.
- Grading methodology v10 All 34 checks (25 scored and 9 informational) with stable IDs and pass/fail criteria.
- MAGY readiness scoreboard The SPF and DMARC portion of the Google, Yahoo and Microsoft bulk-sender baseline, by TLD.
The 3 September 2026 reports
- The September 2026 edition: how 347,691,016 domains were counted
The September 2026 census scanned 347,691,016 domains: three feeds, minus 154,021,121 NXDOMAIN names and 15,109,274 wildcard phantoms, then graded. - How the grade is built: 34 checks, 100 points, and the 40 that email carries
A domain grade is a score out of 100 from 25 scored checks, with 40 points on email; F is the grade of 74.2% of the 316,600,902 domains that carry one. - Our headline F rate fell, and the internet did not get safer
74.2% of 316,600,902 graded and dead domains carry an F in September 2026. The population was rebuilt, so the share is edition-scoped and not comparable.
The 34 checks
Every check has a permanent, citable anchor page. 25 carry points toward the grade; 9 are informational. Full definitions and census prevalence: methodology v10 →
Email Security
- SPF record —
spf-exists - SPF policy strength —
spf-policy-strength - DMARC policy —
dmarc-policy - DMARC reporting —
dmarc-reporting - DKIM —
dkim-exists - MX records —
mx-record - Reverse DNS (PTR) —
reverse-dns
TLS & Certificates
- HTTPS available —
https-available - Certificate valid —
cert-valid - Certificate expiry —
cert-expiry-warning - Signature algorithm —
cert-signature-algorithm - Key strength —
cert-key-strength - TLS version —
tls-version - Cipher strength —
cipher-strength - TLS compression —
tls-compression· informational - OCSP stapling —
ocsp-stapling· informational - Secure renegotiation —
secure-renegotiation· informational
Web Security
- HSTS —
hsts-header - HTTP→HTTPS redirect —
http-to-https-redirect - Content-Security-Policy —
csp-header - Clickjacking protection —
x-frame-options - MIME-sniffing protection —
x-content-type-options - Referrer-Policy —
referrer-policy - COOP (Cross-Origin-Opener-Policy) —
coop-header· informational - CORP (Cross-Origin-Resource-Policy) —
corp-header· informational - COEP (Cross-Origin-Embedder-Policy) —
coep-header· informational
DNS Security
- CAA records —
caa-record - DNSSEC (DS) —
dnssec-ds - DNSSEC (DNSKEY) —
dnssec-dnskey - Nameserver diversity —
nameserver-diversity - SOA configuration —
soa-configuration - IPv6 support —
ipv6-support· informational
Infrastructure
- CDN / WAF detection —
cdn-waf-detection· informational - Hosting provider —
hosting-provider· informational
Open data
The September 2026 aggregates, free to download and cite. Aggregates only: no individual domain is named. 497 of the 1,433 TLDs the census reached are large enough to break out; the rest are counted in the totals.
/v10/data/census.json, census totals + grade distribution ·
/v10/data/tld-grades.csv, per-TLD grade aggregates ·
Licence: open data
The current edition data page: /v10/data. It is pinned to the September 2026 census and never moves.