The August 2026 Domain Security Census (v9)

Explore this edition

• Census data & downloads
  Headline statistics for email authentication, TLS and DNS, plus open CSV/JSON aggregates.
• Census explorer
  Filter by TLD and security check for a quotable stat with a shareable permalink.
• Grading methodology v9
  All 34 checks (25 scored + 9 informational) with stable IDs and pass/fail criteria.
• MAGY readiness scoreboard
  The SPF+DMARC portion of the Google/Yahoo/Microsoft bulk-sender baseline, by TLD.
• State of the Internet reports
  75 research articles built on the August 2026 census.

All 75 August 2026 reports

• Invoice Fraud Prevention: Closing the Domain-Spoofing Gap Behind BEC — 2026-08-21
  Invoice fraud and business email compromise succeed because the supplier's domain can be spoofed. The August 2026 census finds ~195 million mail-receiving domains lack an enforcing DMARC policy. The accounts-payable controls that stop invoice fraud — plus the one technical control most programs miss.
• Email Spoofing Explained: Why 90.7% of Domains Can Be Forged — 2026-08-21
  Email spoofing works because most domains publish no enforcing policy. The August 2026 census of 376.9M domains finds 90.7% — 341.9 million — have no enforcing DMARC, and 56.8% have no SPF or DMARC at all. How spoofing works, how to detect it, and how to stop it.
• What Is a BIMI Record? — 2026-08-21
  A BIMI record publishes your brand logo so it shows next to authenticated email — but it only works on top of an enforcing DMARC policy. The August 2026 census of 376,928,750 graded domains finds only 9.3% (34,983,618) meet that floor, so the other 90.7% are locked out of BIMI until they enforce. Here is how a BIMI record works, what it really requires, and how to check whether your domain qualifies.
• What Is a Wildcard Certificate? Uses, Risks and When to Avoid — 2026-08-21
  A wildcard certificate secures unlimited subdomains under a single *.example.com key. In the August 2026 census, 28.5% of TLS-serving domains rely on one — convenient, but a single stolen private key covers every subdomain at once. Here is how wildcards compare to SAN and single-domain certificates, the blast-radius risk that follows, and when to avoid one.
• What Is DNSSEC? A Plain-English Guide to the DNS Trust Layer — 2026-08-21
  DNSSEC is a cryptographic signature layer that lets resolvers verify a DNS answer is genuine and unaltered. The August 2026 census of 432,127,908 domains found 157,064 with broken DNSSEC — signed but failing validation — proof that switching it on is easy and keeping the chain of trust valid is the hard part.
• SSL vs TLS — 2026-08-21
  SSL and TLS are two generations of the same encryption protocol, and the 'SSL certificates' people buy are really TLS certificates — SSL itself was deprecated back in 2015. The August 2026 census of 231,991,983 HTTPS-serving domains found 5.2 million serving expired certificates and 3.3 million serving self-signed ones, proof that 'SSL health' comes down to TLS version and certificate validity.
• HTTP Security Headers: The Complete Checklist — 2026-08-21
  Only 8.0% of the web sets a Content-Security-Policy, 20.1% deploy HSTS, and 91% omit Referrer-Policy — with cross-origin isolation under 1%. The August 2026 census of 432,127,908 scanned domains scores every major HTTP security header; here is the complete checklist, what each one stops, and how to add and verify them.
• What Is HSTS? The Header 79.9% of Sites Still Skip — 2026-08-21
  HSTS is a one-line header that forces browsers to use HTTPS only, closing the gap a plain redirect leaves open. The August 2026 census measured HSTS across 231,991,983 domains and found only 20.1% — 46,539,716 — deploy it, with just 2.57% preload-ready.
• What Is Domain Spoofing? Exact-Domain vs Look-Alike Attacks — 2026-08-21
  Domain spoofing is any attack that makes a message or site appear to come from a domain the sender does not control. In the August 2026 census of 376,928,750 email-graded domains, 56.4% of the domains that publish SPF — 82,539,695 — use a soft-fail setting that never actually blocks a forged message, which is one reason most domains stay spoofable.
• NIS2 Compliance and Email Authentication: What the Directive Requires — 2026-08-21
  NIS2 compliance requires in-scope entities to take appropriate technical measures to manage cyber risk, and email authentication is textbook baseline hygiene. The August 2026 census of 376,928,750 email-graded domains finds 214,276,774 — 56.8% — publish neither SPF nor DMARC, and only 20.0% publish any DMARC at all.
• End-of-Life Software: The Hidden Risk on 6.6 Million Domains — 2026-08-21
  End-of-life software is any program the vendor no longer patches, and the August 2026 census found 6.6 million public domains running end-of-life server software with no security updates — the exact 'unsupported software' gap cyber-insurance policies and NIS2 now penalise.
• What Is Clickjacking? X-Frame-Options and How to Stop It — 2026-08-21
  Clickjacking loads your real site invisibly inside an attacker's page and tricks visitors into clicking things they never meant to. The August 2026 census of 432,127,908 domains finds only 8.0% of the web sets a Content-Security-Policy and under 1% deploys cross-origin isolation — so the frame defense is missing on most of the internet. Here is how the attack works and the one-line header fix.
• DNS Hijacking and Spoofing: How Attackers Steal Domain Records — 2026-08-21
  DNS hijacking is the theft of the records that route your domain. The August 2026 census of 432,127,908 domains found 63,840,407 (14.8%) delegated in DNS but serving nothing — the exact dangling-delegation surface attackers scan for subdomain takeover. Here is how hijacking, spoofing, and cache poisoning work, and how to check your own domain in 30 seconds.
• Why Are My Emails Going to Spam? — 2026-08-21
  The most common reason your emails go to spam is not your subject line — it is missing authentication. The August 2026 census of 376,928,750 graded domains found 214,276,774 of them (56.8%) publish neither SPF nor DMARC, the exact records Gmail and Yahoo now demand before they trust your mail.
• CEO Fraud Explained: Why Publishing DMARC Is Not Enough — 2026-08-21
  CEO fraud is a wire-transfer scam that impersonates your chief executive by email. The August 2026 census finds 40,541,896 domains — 53.6% of every domain that publishes DMARC — sit at p=none, published but not enforcing, so the boss's own domain stays fully spoofable despite the 'we have DMARC' assumption.
• What Is an SPF Record? — 2026-08-21
  An SPF record lists which mail servers may send email using your domain's name. The August 2026 census of 376,928,750 email-graded domains found only 38.8% — 146,413,297 — publish any SPF record at all, and most that do use a soft-fail ~all that invites spoofing rather than blocking it. Here is what an SPF record is, how the -all, ~all and +all mechanisms differ, and how to check and fix your own.
• Domain Reputation: What It Is and How to Check Yours — 2026-08-21
  Domain reputation is how mailbox providers decide whether to trust your mail — and it quietly leaks the moment your domain can be impersonated. The August 2026 census of 376,928,750 graded domains finds 90.7% (341,945,132) publish no enforcing DMARC, so most senders cannot stop spoofers from spending their reputation. Here is what domain reputation is, the signals that build or break it, and how to check yours in about 30 seconds.
• What Is a Certificate Authority? — 2026-08-21
  A certificate authority (CA) is the trusted third party that vouches for a website's identity so browsers show a padlock instead of a warning. The August 2026 census of 432,127,908 domains found 3.3 million serving self-signed certificates that trust no CA at all, and among domains that publish a CAA record, 98.9% leave issuance unrestricted.
• How to Check If a Website Is Safe in 2026 — 2026-08-21
  The fastest way to check if a website is safe is to read the machine-readable signals a browser hides — HTTPS, certificate validity, email spoofability, and security headers — because 'it looks fine' proves nothing when 295,157,813 domains (78.3%) earn an F grade in the August 2026 census of 432,127,908 scanned. Here are the seven signals that actually decide it, and how to run all seven on any domain in one click.
• HTTP vs HTTPS — 2026-08-21
  HTTP sends everything a visitor types in plain text; HTTPS encrypts it. The August 2026 census of 432,127,908 scanned domains finds 27 million still answer on HTTP and never redirect to a secure version — and 44 million serve no encryption at all. Here is exactly what changes between HTTP and HTTPS, whether HTTP is ever safe, and how to check your own site in 30 seconds.
• Cyber Insurance Requirements 2026: The Email Controls Underwriters Check — 2026-08-21
  Cyber insurance requirements in 2026 increasingly include an enforcing DMARC policy an underwriter can verify from public DNS. The August 2026 census of 376,928,750 email-graded domains finds only 2.9% — 10,902,284 — are fully email-auth protected, so roughly 97% would fail the control most cyber underwriters now check at renewal.
• DNS Security Explained: Why 94 Million Domains Rely on Two Landlords — 2026-08-21
  DNS security protects the integrity, availability and authenticity of the records that route your traffic and mail. The August 2026 census of 432,127,908 domains found roughly 94 million of the world's nameservers concentrated under just two DNS landlords — a systemic single point of failure most owners never see.
• What Is HTTPS? How the Secure Web Actually Works — 2026-08-21
  HTTPS is HTTP carried inside an encrypted, authenticated TLS connection — the baseline your browser polices with the 'Not Secure' warning. Yet the August 2026 census of 432,127,908 domains found 44 million still serving plain HTTP with no encryption at all. Here is how HTTPS actually works, what the padlock does and does not prove, and how to check your own site in 30 seconds.
• Domain Health Check: The 5 Things a Good Audit Covers — 2026-08-21
  A domain health check audits five layers — email authentication, TLS, DNS, security headers, and the overall grade. In the August 2026 census of 432,127,908 domains, only 2.9% (10,902,284) pass across every layer, which is exactly why the check exists. Here is what a good audit covers and how to run one on your own domain free.
• What Is DMARC? — 2026-08-21
  DMARC is the DNS record that tells mail servers to reject email forging your domain. The August 2026 census of 376,928,750 email-graded domains finds 90.7% — 341,945,132 — publish no enforcing DMARC policy, and only 20.0% publish any DMARC record at all. Here is what DMARC is, how it works, and how to check yours free.
• DMARC Checker Explained — 2026-08-21
  A DMARC checker reads the policy your domain publishes and tells you whether it can be spoofed. The August 2026 census of 376,928,750 graded domains finds only 9.3% publish an enforcing policy — the rest publish nothing, or a record that looks protective but does nothing. Here is how to read every field of a DMARC record, spot the gap between published and enforcing, and check your own domain in 30 seconds.
• What Is Business Email Compromise? Inside the 90.7% Spoofing Gap — 2026-08-21
  Business email compromise (BEC) is a fraud that impersonates a trusted party by email to redirect a payment or data. The August 2026 census of 376,928,750 email-graded domains finds 90.7% — 341,945,132 — publish no enforcing DMARC, the exact-domain spoofing gap that makes BEC's most convincing impersonations possible.
• The Last Mile of HTTPS: Why 27 Million Domains Respond to HTTP but Never Redirect — 2026-08-20
  ~27 million domains have valid TLS certificates but still serve unencrypted HTTP with no redirect and no HSTS — every visitor who types the domain without 'https://' is exposed to SSL stripping.
• The Locked Vault: Only 10.9 Million Domains Close Every Attack Surface Simultaneously — 2026-08-20
  Only 10.9M of 376.9M graded domains (2.9%) pass all five core controls at once. 1.2M (0.33%) fail every single one. The gap is not technical — it is operational.
• The Top 1% of the Internet Starts at a B — 2026-08-20
  376.9M domains scored: entry to the top 1% is 82/100 — a B grade. Only 0.15% earn an A. The median domain scores 45 — a failing F. The web has no security middle class.
• The Security Correlation: Which Controls Cluster Together, and Which Sit Alone — 2026-08-20
  56.8% of 376.9M graded domains have neither SPF nor DMARC. Only 2.9% have all five core controls. Security controls cluster because operator maturity — not cost — is the real variable.
• The Phantom TLD Problem: The Domains That Don't Exist — 2026-08-20
  8 of 1,386 TLDs answer for every name you can invent — inflating .ph's domain count 250× to 14.6 million when the true registration base is about 57,874. Two TLDs were still broadcasting ICANN's name-collision hazard beacon in August 2026.
• The Flaky Internet: 20 Million Domains That Only Sometimes Answer — 2026-08-20
  19,814,020 domains — 4.6% of 432 million scanned — produced inconsistent results across three independent scan attempts. 14.64% of domains that failed their first scan recovered on retry. Here is what that means for internet security measurement.
• Who Guards the Web: Cloudflare, WAFs, and the CDN-vs-Origin Measurement Problem — 2026-08-20
  43,008,476 domains return 'Server: cloudflare' in the August 2026 census — but that number conflates CDN edge-termination with security protection. WAF rules, end-to-end encryption, and origin hardening are invisible in a server header.
• The Web Server Census 2026: nginx, Apache, Cloudflare and the Invisible Half — 2026-08-20
  45.6% of 376 million measured domains suppress their Server header entirely — nearly half the web declines to say what it runs. Of those that declare, Cloudflare leads with 43 million entries.
• The Google-and-Yahoo Deadline, Two Years On: Where Email Authentication Stands in August 2026 — 2026-08-20
  Two and a half years after Google and Yahoo made DMARC a hard requirement, only 9.3% of 376 million graded domains enforce it. 56.8% — 214 million domains — still publish neither SPF nor DMARC at all.
• DMARC Without SPF: 16 Million Domains With Half an Email Authentication Stack — 2026-08-20
  16,238,679 domains publish DMARC but have no SPF record at all — leaving every sending path that lacks DKIM signing with no authentication fallback. August 2026 census data across 376 million domains graded.
• Nine Million Domains Where A-Grades Round to Zero — 2026-08-20
  Across 9,338,016 GoDaddy-default domains, exactly 198 earn an A — an A-rate that rounds to 0.00%. We graded 164.7 million domains by email provider to find out what your MX record says about your security.
• SPF Hard Fail vs Soft Fail: Why 82 Million Domains Are Using the Weaker Setting — 2026-08-20
  82,539,695 domains — 56.4% of all SPF publishers — end their record with ~all (soft fail), providing little real protection. August 2026 census data across 146 million SPF records shows why soft fail became the default and what it costs.
• Who Reads the World's DMARC Reports? — 2026-08-20
  One company receives DMARC spoofing-attack telemetry for 46.8% — 13.9 million — of every report-collecting domain in our 432M-domain census. In most cases nobody chose it.
• The Silent Domain: 56.8% of the Internet Has No Email Authentication — 2026-08-20
  214 million domains — 56.8% of the graded web — publish neither SPF nor DMARC, making the majority of the internet trivially spoofable. August 2026 census of 376.9M domains.
• The DNS Landlords: How GoDaddy and Cloudflare Control Nameservers for 94 Million Domains — 2026-08-20
  GoDaddy and Cloudflare together hold authoritative DNS for 94.7 million domains — 25.1% of the entire graded web — per our August 2026 census of 376.9 million domains.
• The Isolation Headers: Why COOP, COEP, and CORP Cover Less Than 1% of the Web — 2026-08-20
  COOP appears on 0.78%, COEP on 0.48%, and CORP on 0.65% of 376.9 million domains — four years after Spectre made cross-origin isolation essential, fewer than 1 in 100 sites have deployed any of the three required headers.
• The HTTP-Only Problem: 44 Million Domains Serving Unencrypted Web in 2026 — 2026-08-20
  44,443,652 domains — 11.8% of 376.9 million graded — serve HTTP with no TLS, no redirect, and no HSTS, despite free certificates being universally available for over a decade.
• CAA Records: 98.9% of Domains Never Restrict Their CA — 2026-08-20
  98.9% of 376,928,750 domains measured in the defaults.exposed August 2026 Domain Security Census publish no CAA record — leaving them open to certificate issuance by any of approximately 300 publicly trusted certificate authorities.
• One CA to Rule Them All: The Certificate Monoculture Report — 2026-08-20
  Let's Encrypt now secures 50.2% of all 231.5 million certificate-presenting domains measured in the defaults.exposed August 2026 Domain Security Census — and in 23 country-code zones, a single CA holds 80% or more of everything.
• The B Ceiling: Where the Climb to an A Grade Stalls — 2026-08-18
  5.82 million domains score 80–89 but only 549,635 reach 90+. The biggest B-to-A gap is DMARC reporting: 34.4% of B-band domains fail it versus roughly 7% of A-band domains.
• DMARC Gap: 87 Million Domains One Record From Safety — 2026-08-18
  86.9 million domains — 23.1% of 376.9M graded — have SPF but no DMARC record: one free DNS TXT entry away from an anti-spoofing policy. The internet's largest cheap-to-close security deficit.
• Cheap Domains, Cheap Security? Budget TLDs vs the Rest — 2026-08-18
  88.8% of 19.2M graded budget-TLD domains score F — versus 72.4% on .com and 33.7% on .ch. On .top, 96.1% fail and 51.5% of scanned names were dead at scan time.
• Do Registry Rules Work? .bank 3.1% F vs .com 72.4% — 2026-08-18
  3.1% of .bank domains grade F versus 72.4% on .com — a 23× gap. Registry mandates move exactly what they name: vetted-only .pharmacy grades 84.5% F, worse than the open market.
• New gTLD Ghost Towns: Where a Third of Domains Are Dead — 2026-08-18
  36% of 63.8 million new-gTLD domains are dead or unreachable — 2.6 times the legacy-gTLD rate. In .bond, 87.3% of the namespace is gone. Only 58.4% of new-gTLD domains were alive enough to receive a security grade.
• Domain Dark Matter: 64 Million Delegated, Empty Domains — 2026-08-18
  63,840,407 domains — 14.8% of 432 million scanned — have working DNS delegation but no website and no mail route. More than one in three registered domains never produced a gradable scan at all.
• IPv6-Only Domains: 80,737 Sites Living Without IPv4 — 2026-08-18
  Just 80,737 of 376.9 million graded domains publish only an IPv6 address — 0.021%, one in 4,668. Even among the 67.4 million domains that already have IPv6, only one in 834 has dropped IPv4.
• Parked Domains: 91% Grade F Across 2.1 Million Measured — 2026-08-18
  91.3% of 2,147,113 parked domains grade F — compared to 78.3% across the general web. Exactly one parked domain out of 2.1 million earns an A. Parking provider defaults, not owner choices, set the grade.
• The Hosting League Table: Domain Security by DNS Provider — 2026-08-18
  GoDaddy carries 52.4 million domains at 82.9% grade F, and 52% of every A-grade domain on the internet sits behind Cloudflare alone. We attributed 376.9 million graded domains to their DNS provider.
• Does Cloudflare Make You Safer? 41.9M Domains Graded — 2026-08-18
  67.7% of the 41.9 million Cloudflare-fronted domains still score an F — virtually identical to the rest of the web — yet Cloudflare holds 48.7% of all A+ grades. August 2026 census data across 205 million HTTP responses.
• DMARC Subdomain Policy: 1.3 Million sp= Back Doors — 2026-08-18
  1,313,312 domains enforce DMARC at the apex then explicitly exempt their entire subdomain namespace — including 459,577 that reached p=reject and then set sp=none. We parsed 75.5 million records to find the back doors.
• DMARC pct Tag: 476,000 Domains Water Down Enforcement — 2026-08-18
  476,465 domains publish DMARC quarantine or reject — then weaken it with a pct value below 100. We parsed 75.5 million DMARC records to find out where the dials are set.
• Zombie MX Records: Mail Routed to Dead Domains — 2026-08-18
  At least 43,723 dead or unreachable domains still publish mail-routing MX records — a floor figure, not an estimate. The mail is a potential account-takeover risk. August 2026 census.
• Null MX Adoption 2026: 14.5 Million Domains Opt Out — 2026-08-18
  14,455,076 domains publish a null MX record — only 7.0% of the 207 million no-mail domains we graded. RFC 7505 adoption, measured across 376.9M domains.
• Broken DNSSEC: 157,064 Domains Are Invisibly Down — 2026-08-18
  157,064 domains have broken DNSSEC chains — a hard SERVFAIL for every validating resolver. That's 1 in 709 signed domains, and owners can't see the failure. August 2026 census.
• Single-Nameserver Domains: One Record from Oblivion — 2026-08-18
  290,673 domains run on a single nameserver — a complete single point of failure for website, email, and every DNS-dependent service. August 2026 census of 376.9M domains.
• SOA Records: The Internet's Most Neglected Setting — 2026-08-18
  50.5% of 275 million measured domains carry an SOA retry or expire timer outside recommended ranges — the DNS record nobody has ever reviewed.
• End-of-Life Software Census: 6.6 Million Servers Admit It — 2026-08-18
  6,635,647 end-of-life software banners counted across 376.9 million domains — including 2.36 million still running PHP 7.4, nearly four years after its last security patch.
• Secure by Default: the Server Software Security Showdown — 2026-08-18
  Netlify sends HSTS on 95.9% of its sites; Apache on 7.0% — a 13.7× gap across 191.7 million responses showing how your hosting choice, not your security team, determines what protection your users receive.
• Referrer-Policy: the Privacy Header 91% of the Web Forgot — 2026-08-18
  91.4% of 231.9 million HTTP responses carry no Referrer-Policy — leaving browser defaults to decide whether full URLs, search terms, and path-embedded tokens are shared with every third-party server a page contacts.
• HSTS Adoption 2026: The Half-Locked Door — 2026-08-18
  79.9% of 232 million HTTPS domains send no HSTS header — and only 12.8% of those that do publish a preload-ready policy — leaving most of the encrypted web unprotected against SSL-stripping attacks.
• Content Security Policy Adoption in 2026: the 8.0% Web — 2026-08-18
  Only 8.0% of 257.6 million measurable domains serve an effective Content-Security-Policy — and 48.3% of those who do land on just two identical scores, revealing platform defaults rather than deliberate security choices.
• TLS 1.3 by Country: Which TLDs Win on Defaults (2026) — 2026-08-18
  94.9% of 231.5 million TLS-completing domains negotiate TLS 1.3 — but South Korea's .kr lags at 73.3% and the US .gov TLD at 77.0%, revealing how infrastructure age, not national wealth, determines encryption quality.
• Cipher Suites in 2026: What Strong Encryption Really Means — 2026-08-18
  Two cipher suites carried 94.33% of 212 million measured TLS handshakes in the defaults.exposed August 2026 Domain Security Census — and RC4, 3DES, and export-grade ciphers appeared zero times.
• Wildcard Certificates: 28.5% of the TLS Web on One Key — 2026-08-18
  28.5% of the TLS web — 66,011,927 of 231.5 million domains measured in the defaults.exposed August 2026 Domain Security Census — runs on wildcard certificates, sharing one private key across every subdomain.
• Self-Signed Certificates: The 3.3 Million-Domain Census — 2026-08-18
  3,306,642 of 231.5 million TLS certificates observed in the defaults.exposed August 2026 Domain Security Census are self-signed — including 375,842 still carrying the 'Internet Widgits Pty Ltd' OpenSSL example default.
• Expired SSL Certificates: 5.2 Million Sites Still Serving — 2026-08-18
  5,157,928 live websites were serving an expired TLS certificate at the moment of the defaults.exposed August 2026 Domain Security Census sweep — 47.8% of those certificates had been expired for over a year.
• RSA vs ECDSA in 2026: Measuring the Web's Key Migration — 2026-08-18
  425,004 live TLS certificates are still signed with MD5, and RSA still holds 59.3% of 231.5 million keys measured in the defaults.exposed August 2026 Domain Security Census — the key migration is real but moving at the speed of defaults, not advice.
• The 90-Day Web: Certificate Lifetimes in 2026 — 2026-08-18
  67.7% of 231.5 million TLS certificates observed in the defaults.exposed August 2026 Domain Security Census were issued for exactly 90 days — the annual certificate is collapsing, and the 47-day era is next.

The 34 checks

Every check has a permanent, citable anchor page. 25 carry points toward the grade; 9 are informational. Full definitions and census prevalence: methodology v9 →

Open data

The August 2026 aggregates, free to download and cite. Aggregates only — no individual domain is named.

/v9/data/census.json — census totals + grade distribution · /v9/data/tld-grades.csv — per-TLD grade aggregates · Licence: open data

Current live census data (updated monthly): /data.