Defaults.Exposed

Defaults.Exposed › Reports

Domain Health Check: The 5 Things a Good Audit Covers

Published

A domain health check is a structured audit of everything your domain silently publishes to the internet — its email-authentication records, its TLS certificate and encryption, its DNS delegation, and the security headers its web server sends — scored into a single posture grade. It exists because the parts almost never move together. In the August 2026 defaults.exposed census of 432,127,908 domains, only 2.9% — 10,902,284 domains — are fully protected across every layer, while 78.3% (295,157,813) earn an F. A domain can pass one check brilliantly and fail three others without the owner ever knowing, because nothing on a working website tells you which of its defences are missing. This guide sets out the five layers a good health check covers, what the census found in each, and how to run the full audit on your own domain for free.

Most owners discover a domain problem the way they discover a roof leak: after the damage. Nothing about a domain that resolves, loads, and sends email advertises that its DMARC policy does nothing, its certificate is months from expiry, or its DNS hangs off a single nameserver. A health check surfaces all of it at once, before someone else does. The figures throughout are from the defaults.exposed August 2026 census, an independent scan of 432,127,908 domains graded as of 2026-08-16.

The short answer: what a domain health check is

A domain health check reads the public signals your domain exposes and grades each one against a known-good standard. It needs no access to your servers, no login, and no agent installed — every signal it inspects is already published to the world in DNS, in your TLS handshake, and in your HTTP response headers. That is the point: an attacker sizing up your domain sees exactly the same signals, so a health check simply shows you your own posture through their eyes.

A good check is layered, not a single pass/fail. It separates the questions that have nothing to do with one another:

A health check of this kind reads what your domain broadcasts publicly — it is not a penetration test. It will not find an unpatched application bug, a weak admin password, or a business-logic flaw inside your app; those need different tools. What it covers is the configuration layer an attacker probes first and most cheaply, because it needs nothing but a DNS lookup and a single connection. That is also the layer most often left on insecure defaults, which is exactly where a scan pays off.

These are five independent surfaces. The census exists precisely because they do not correlate the way people assume: a domain with a perfect TLS grade routinely has no email protection at all, and a domain that enforces DMARC often ships no security headers. We measured which controls travel together and which sit alone in The Security Correlation. The headline finding is the case for auditing all five: you cannot infer any layer from any other.

A consumer checking whether someone else’s site is safe to trust is a related but different question — that is buyer-side vetting, covered in How to Check if a Website Is Safe in 2026. This guide is owner-side: auditing a domain you control, where every finding is something you can fix.

Layer 1: email authentication (SPF, DKIM, DMARC)

The first layer answers the question with the sharpest financial edge: can a criminal send email that appears to come from your domain? Three DNS records decide it, and they work as a stack.

SPF (Sender Policy Framework, RFC 7208) lists which mail servers are allowed to send for your domain. DKIM (RFC 6376) attaches a cryptographic signature that proves a message was not altered in transit. DMARC (RFC 7489) ties the two to the visible From: address a human reads and — critically — tells receiving servers what to do when a message fails: nothing, quarantine it, or reject it outright.

The census finding here is stark. Of 376,928,750 email-graded domains, only 9.3% (34,983,618) publish an enforcing DMARC policy. The other 90.7% either publish nothing or publish p=none, a record that looks protective in a basic checker while instructing receivers to take no action on forged mail. Worse, 56.8% — 214,276,774 domains — publish neither SPF nor DMARC, meaning there is no email-authentication posture to read at all. That silent majority is profiled in The Silent Domain.

A good health check does not stop at “a DMARC record exists.” It reports whether the policy is enforcing, whether subdomains are covered, and whether your legitimate senders align. The single most common false comfort in domain security is a green DMARC tick sitting on top of p=none. For how each record is graded, see the methodology for SPF, DKIM, and DMARC policy.

A thorough audit also grades the strength of what is published, not just its presence. Many domains publish SPF but soften it to ~all (soft-fail), which asks receivers to accept suspect mail rather than reject it — 56.4% of SPF publishers, some 82,539,695 domains, choose that weaker setting.

Others publish SPF and DKIM yet never add the enforcing DMARC that ties them together. Roughly 87 million domains sit one DNS record short of protection — close enough that a single edit fixes them. A check that reports presence but ignores strength misses exactly these near-misses.

This layer alone is why most domains fail an audit. It is also the cheapest to fix — each record is a single DNS TXT edit — which is why a health check pays for itself fastest here.

Layer 2: TLS and certificate hygiene

The second layer asks whether traffic to your site is genuinely encrypted and trusted. “Has a padlock” is not the same as “TLS is healthy,” and a good check pulls the two apart across several sub-questions.

Is there any encryption at all? A surprising slice of the web still answers only over plain HTTP. The census counts 44 million domains serving unencrypted web with no TLS whatsoever, detailed in The HTTP-Only Problem. Any data a visitor sends to these — a login, a form, a card number — crosses the network in the clear.

Does HTTP redirect to HTTPS? A site can offer HTTPS yet still answer on port 80 without forwarding visitors to the secure version, leaving the first request exposed. A good audit flags the gap between “HTTPS available” and “HTTP actually redirects.” The grading logic lives in http-to-https-redirect and https-available.

Is the certificate valid and current? Certificates expire, and expired ones throw browser warnings that drive visitors away and signal neglect. The census still finds 5.2 million domains serving expired certificates and 3.3 million serving self-signed ones that no browser trusts. A health check should warn before expiry, not after — see cert-expiry-warning and cert-valid.

Is the encryption itself strong? Modern TLS versions, sound cipher suites, and adequate key strength all matter; an old protocol or a weak cipher undermines the padlock even when the certificate is perfect. These are graded under tls-version and cipher-strength.

Is HTTPS enforced going forward? HSTS (HTTP Strict Transport Security) tells browsers to refuse plain HTTP for your domain entirely. Only 20.1% of domains (46,539,716) deploy it; the other 79.9% leave the door propped open for downgrade attacks. We covered the shortfall in HSTS Adoption 2026: The Half-Locked Door, with grading in hsts-header.

Who is allowed to issue certificates for you? A CAA record restricts which certificate authorities may issue for your domain, shrinking the blast radius of a mis-issued certificate. The census finds 98.9% of domains never restrict their CA at all. Certificate key strength and signature algorithm round out this layer, and a good audit grades all three (caa-record, cert-key-strength, cert-signature-algorithm).

TLS is the layer owners most often think they have handled because the padlock appears. A good check shows the difference between a padlock and a properly hardened transport layer.

Layer 3: DNS and nameserver resilience

The third layer is the one almost nobody audits, because DNS is invisible until it fails — and when it fails, the whole domain vanishes: website, email, everything. A good health check treats resolution as a reliability question, not just a security one.

Is the domain actually configured, or just delegated? The census surfaces a category it calls domain dark matter: 63,840,407 domains (14.8%) are delegated to nameservers but publish nothing useful behind them — no working mail, often no live site. Empty delegation is both a reliability gap and an attacker’s opportunity to claim the unused surface. We mapped it in Domain Dark Matter.

Is there more than one nameserver? A domain served by a single nameserver is one outage from oblivion — the entire namespace goes dark if that one host fails. Redundant, diverse nameservers are the baseline for resilience, graded under nameserver-diversity.

Is DNSSEC present and actually valid? DNSSEC cryptographically signs DNS answers so they cannot be forged in transit. But a broken signature is worse than none: the census finds 157,064 domains whose DNSSEC is present but failing validation, which makes them invisibly unreachable to any resolver that checks. A good audit distinguishes “no DNSSEC” from “DNSSEC that is silently taking you offline” — see dnssec-ds and dnssec-dnskey.

Is the SOA record sane, and is IPv6 reachable? The start-of-authority record governs how the zone is cached and refreshed, and IPv6 support increasingly affects reachability. Both are quiet correctness checks a thorough audit includes (soa-configuration, ipv6-support).

Diversity also means diversity of provider. Two nameservers at the same host share the same fate in an outage, and the census shows how concentrated this has become: nameservers for roughly 94 million domains sit under just two operators, and 41.9 million domains are fronted by a single CDN. Concentration is often well-run, but a good audit flags when your resilience rests entirely on one company’s uptime.

DNS rarely appears in a security scorecard, yet it underpins every other layer: if resolution fails or is forged, TLS and email protection never get a chance to matter. That is why a good health check starts at the name, not the website.

Layer 4: HTTP security headers

The fourth layer is what your web server tells a visitor’s browser about how to protect them. These are HTTP response headers — small directives sent with every page — and they are the most widely neglected surface on the web, because a site works perfectly without a single one of them.

Content-Security-Policy (CSP) is the big one: it constrains what a page is allowed to load and execute, and it is the primary defence against cross-site scripting and content injection. It is present on just 8.0% of the web. The 92% without it leave the browser to trust whatever a page tells it to run — the mechanics are in content-security-policy-adoption-in-2026-the-8-0-web and graded at csp-header.

The framing and content-type headers — X-Frame-Options, X-Content-Type-Options, and Referrer-Policy — are cheap, well-understood, and still routinely absent. Referrer-Policy alone is omitted by 91% of the web, leaking navigation data that a one-line header would contain. These grade under x-frame-options, x-content-type-options, and referrer-policy.

The cross-origin isolation headers — COOP, COEP, and CORP — are the frontier: they cover less than 1% of the web and defend against a class of cross-origin leakage attacks. Few small sites need the full set, but a good audit reports their absence so the decision is deliberate rather than accidental (coop-header, corp-header).

Headers are the layer where the fix is almost always a few lines in a web-server config, and where the gap between “possible” and “done” is widest. A health check turns an invisible omission into a concrete, orderable to-do list.

Layer 5: the overall grade — why only 2.9% pass everything

The fifth thing a good audit produces is a single grade that rolls the four layers together — because a domain is only as trustworthy as its weakest surface, and owners need one number, not four dashboards.

Here the census delivers its most sobering figure. Only 2.9% of domains — 10,902,284 — are fully protected across email, TLS and DNS at once. At the other end, 295,157,813 domains, about 78.3%, earn an F (with dead and non-resolving domains counted as F). The vast middle is not a spread of B-minuses; it is domains that ace one layer and collapse on another. A domain can hold a flawless certificate and enforce DMARC and still fail on empty DNS delegation or a missing CSP.

Why so few clear every layer? Because the layers are owned by different people and fixed at different times. Email records are set by whoever runs mail; certificates by whoever runs the web server; DNS by whoever holds the registrar login; headers by whoever last touched the deploy config. Nothing forces them to converge, so they rarely do. The deeper analysis of how many domains close every attack surface simultaneously — and how rare that discipline is — is in The Locked Vault.

This is the entire argument for a periodic health check rather than a one-time setup. Each layer drifts on its own schedule: a certificate expires, a new subdomain ships without DMARC, a header gets dropped in a config rewrite. Check your domain free at defaults.exposed and you get all five layers scored into one grade in about 30 seconds — the same rollup the census applies to the whole internet, run against the one domain you actually care about.

How often should you run a domain health check?

Once is not enough, because every layer drifts on its own clock. A certificate that is valid today expires on a fixed date — and 5.2 million domains are already serving expired ones, which means their owners stopped watching. A DMARC policy set to enforce can be quietly loosened to unblock a new mail tool. A security header can vanish in a routine deploy. DNS can be repointed during a migration and left half-configured.

Server software ages too. The census counts 6.6 million servers openly advertising end-of-life software in their response banners — versions no longer receiving security patches. That is not a setting you fix once; it is a maintenance cadence you keep.

A sensible rhythm for most domains is a full check now to set a baseline, a re-check after any infrastructure change — new mail provider, site migration, registrar move, certificate renewal — and a standing monthly or quarterly scan to catch silent drift. The higher the stakes, the shorter the interval: a domain that takes payments, sends invoices, or carries a recognisable brand cannot afford a quarterly blind spot.

Continuous monitoring shrinks the interval to zero, catching a lapse the day it happens rather than the day it is exploited. That is why monitoring is a standing service alongside the free point-in-time scan (see how monitoring works).

How to run a full domain health check free

You do not need a security team or a paid platform to run every check above. All five layers read from public signals, so a single free scan covers the whole audit:

  1. Enter your domain into defaults.exposed. No account, no agent, no access to your servers — it reads the same public DNS, TLS, and HTTP signals an attacker would.
  2. Read the grade, then read past it. The overall grade is the headline; the layer breakdown is the work. A B-grade domain with an F on email authentication has a specific, cheap fix waiting.
  3. Fix the cheapest, highest-impact layer first. For most domains that is email authentication — a few DNS TXT edits move you from spoofable to protected. TLS redirects and security headers are usually a config change away.
  4. Re-check after each change, and on a schedule. Posture drifts; certificates expire; new services ship without records. A health check is a habit, not a one-off.

If you want the gaps closed and kept closed — continuous monitoring so a lapsed certificate or a dropped header is caught the day it happens rather than the day it is exploited — see how the fix works. The free scan tells you where you stand today; monitoring keeps you there.

For the full picture of how the whole namespace scores across all five layers, the flagship report is The State of Domain Security 2026.

What this means

For domain owners and founders, a health check answers a question you cannot see from inside your own business: which of your defences are actually up. A site that loads and sends mail feels fine, yet the census puts the odds of it passing every layer at 2.9%. The audit converts an invisible risk into a short, ordered list of cheap fixes — most of them DNS edits — before a spoofed invoice or a lapsed certificate becomes an incident. Not running it is a decision to stay in the 78.3% that fail somewhere.

For IT and security teams, the five-layer breakdown is a triage tool, not a scorecard to file. Because the layers are owned by different systems and drift on different schedules, one overall grade hides where the work is — the layer detail is the backlog. The census pattern of strong-on-one-surface, absent-on-another is what you will find across your own estate. A standing check catches the new subdomain shipped without DMARC and the certificate weeks from expiry while each is still a one-line fix.

FAQ

What is a domain health check? A domain health check is a structured audit of the public security signals your domain exposes — its email-authentication records (SPF, DKIM, DMARC), its TLS certificate and encryption strength, its DNS delegation and resilience, and its HTTP security headers — rolled into a single posture grade. It requires no access to your systems, because every signal it reads is already published to the internet. In the August 2026 census of 432,127,908 domains, only 2.9% (10,902,284) passed across every layer, which is why the check is worth running: most domains fail somewhere without the owner knowing.

How do I check if my domain is secure? Run a free scan that reads your domain’s public signals across all five layers at once. Enter your domain into a scanner such as defaults.exposed and it reports whether email can be forged, whether TLS is valid and enforced, whether DNS is resilient, and whether your security headers are present — then rolls it into one grade in about 30 seconds. Do not stop at the overall grade; read the layer breakdown, because a domain can score well overall while failing one specific, fixable layer. The census found 78.3% of domains earn an F, so a failing result is common, not exceptional.

What does a domain security audit include? A thorough audit covers five independent layers. First, email authentication: SPF, DKIM, and an enforcing DMARC policy — only 9.3% of domains enforce DMARC. Second, TLS: valid unexpired certificate, strong ciphers, HTTP-to-HTTPS redirect, and HSTS, which just 20.1% deploy. Third, DNS: redundant nameservers, valid DNSSEC, and no empty delegation — 14.8% of domains are delegated but empty. Fourth, HTTP security headers, led by Content-Security-Policy, present on only 8.0% of the web. Fifth, the overall grade tying them together. A check that reports only one layer is not an audit.

How secure is my website? The honest answer is that you cannot know without checking all five layers, because they do not correlate — a site with a perfect padlock routinely has no email protection and no security headers. In the August 2026 census, only 2.9% of domains were fully protected across email, TLS, and DNS simultaneously, and 78.3% earned an F. Your site is almost certainly strong on some layers and exposed on others; the only way to find which is to look. Check your domain free at defaults.exposed — it grades all five layers in about 30 seconds with no account required.

Data to cite

See where your own domain stands

A domain health check is only useful if it covers every layer, because a domain is only as trustworthy as its weakest one. Across the whole internet, only 2.9% of domains clear all five at once, and 78.3% fail somewhere — most owners have never seen their own layer-by-layer breakdown, because a working website says nothing about the defences it is missing.

Check your domain free at defaults.exposed — it reads your live email-authentication records, TLS certificate and encryption, DNS delegation, and security headers straight from public signals, and rolls them into one grade in about 30 seconds. No account needed. If you want those gaps closed and kept closed with continuous monitoring, see how the fix works.

Read the flagship census report: The State of Domain Security 2026 →

Related from this series: The Security Correlation · The Locked Vault: Only 10.9 Million Domains Close Every Attack Surface · How to Check if a Website Is Safe in 2026 · The Silent Domain

Aggregate data only. Data stored and processed in the EU.

Data source: defaults.exposed August 2026 census, methodology v9, as of 2026-08-16. 376,928,750 domains email-graded and 284,598,752 overall-graded from 432,127,908 scanned. All figures are counts of graded domains. References: RFC 7208 (SPF), RFC 6376 (DKIM), RFC 7489 (DMARC), RFC 6797 (HSTS).

How to cite this report

Press / blog: defaults.exposed (2026). Domain Health Check: The 5 Things a Good Audit Covers. defaults.exposed August 2026 Domain Security Census (432,127,908 domains scanned, asOf 2026-08-16). Retrieved from https://defaults.exposed/v9/articles/domain-health-check-the-5-things-a-good-audit-covers

Academic: defaults.exposed. (2026, August 21). Domain Health Check: The 5 Things a Good Audit Covers. In defaults.exposed Domain Security Census: August 2026. https://defaults.exposed/v9/articles/domain-health-check-the-5-things-a-good-audit-covers

In-line citation: (defaults.exposed, August 2026 Domain Security Census, n=432,127,908 domains scanned)

About the defaults.exposed August 2026 Census

The defaults.exposed Domain Security Census is a recurring independent measurement of the public domain namespace. The August 2026 edition scanned 432,127,908 domains between 1–16 August 2026 and graded them using methodology v9. Scans are conducted from EU infrastructure. No individual domain, registrant, or business is named in any report. All figures are aggregate distributions. Data is stored and processed within the EU.

Methodology: defaults.exposed/v9/methodology Full census report: defaults.exposed/en/articles/the-state-of-domain-security-2026

Data sourced from the August 2026 grading methodology (v9) — 34 checks, 376 million domains. Browse the census statistics or the Census Explorer, or see all August 2026 research →