Defaults.Exposed › Reports

Parked Domains: 91% Grade F Across 2.1 Million Measured

Published 2026-08-18

Figures as of 16 August 2026 · methodology v9. This is a recurring report; each edition re-measures the same population so the numbers can be tracked over time. All figures are aggregate — we never publish an individual business’s grade or name an individual registrant’s domain.

The headline: the parked web fails almost to a domain

We identified 2,147,113 graded domains sitting on the nameservers of five major domain-parking providers, and 91.3% of them grade F. Add the Ds and the figure climbs to 99.91%. Across more than two million parked domains, 1,675 manage a C or better. Thirty-one reach B or better. Exactly one earns an A.

The general web is bad. The parked web is a different order of bad. Across all 376.9 million graded domain rows in the August 2026 census, the F rate is 78.3%. Parking pushes that to 91.3%, and it flattens the top of the distribution to nearly nothing: a randomly chosen graded domain is about 37 times more likely to score C or better than a parked one, and roughly 1,900 times more likely to reach B or better.

There is no mystery in the mechanism. A parked domain’s security posture is not chosen by its owner. The moment you point a domain at a parking provider’s nameservers, its DNS, its web configuration and its email posture become whatever that provider serves by default — multiplied across every domain in the portfolio. The grade you see is the provider’s configuration, echoed a million times.

Key numbers

• 2,147,113 graded domains sit on the nameservers of five major parking providers (Sedo, ParkLogic, Bodis, ParkingCrew, Above) in the August 2026 census.
• 91.3% of parked domains grade F, versus 78.3% across all 376.9 million graded domain rows.
• 99.91% of parked domains grade D or worse — 2,145,438 of 2,147,113.
• C or better: 1,675 parked domains, about 1 in 1,283. The all-web rate is 1 in 16.
• Exactly 1 parked domain out of 2.1 million earns an A. Thirty more reach B.
• Provider defaults set the grade: the D-or-better share ranges from 2.2% at one provider to 45.6% at another — same parked status, different inherited configuration.

What happens to a domain when you park it?

Parking is the domain industry’s holding pattern. You register a name — for a future project, for resale, to protect a brand — and rather than leave it dark, you delegate it to a parking service. The service answers DNS for it, serves a landing page (often with ads, sometimes with a “this domain is for sale” banner), and you collect a trickle of revenue or at least a live page while the name waits.

The part nobody mentions at signup: delegation is total. Nameservers are the root of a domain’s externally visible posture. Whoever runs them decides whether the domain has SPF, whether it has DMARC, whether its landing page redirects to HTTPS, whether the certificate matches, whether security headers exist. Park a domain and every one of those decisions is made for you, identically to every other domain in the provider’s stable.

Our census sees the result at population scale. We flagged domains whose delegated nameservers match one of five well-known parking providers and looked at how they grade under the same 34-check methodology applied to everything else. The distribution barely qualifies as one:

Denominators: 2,147,113 parked graded domains; 376,928,781 graded domain rows overall.

The all-web column already describes a security failure — we have written about that curve at length. The parked column erases what little top the curve had. B-and-above holds 2.18% of the general web. Among parked domains it holds 31 names.

Does it matter which parking provider you use?

For your grade, yes — and that is the most revealing cut in the data, because it isolates the mechanism. If parked domains failed because their owners neglect them, you would expect roughly uniform failure across providers. Instead the split tracks the provider:

Sedo, the largest cohort here, lands 13.9% of its parked domains at D — meaning its default configuration passes enough checks to lift a meaningful slice of its portfolio one band off the floor. ParkLogic’s defaults leave 97.8% at F. ParkingCrew’s leave 99.0% at F, with six domains in a cohort of nine thousand reaching C. The domains did nothing differently. The nameservers did.

The two small cohorts are worth a cautious note rather than a conclusion. Both Above and Bodis have very small cohorts where nameserver-matching may capture some non-parking use of the provider’s infrastructure; we report the numbers as measured and resist drawing firm conclusions from cohorts this small.

The population-scale finding stands on the two providers with six-figure cohorts, and it is clean: the grade of a parked domain is a property of the parking provider, not the domain. A parking provider that turned on baseline email authentication and sane web defaults tomorrow would move hundreds of thousands of grades overnight, with no action from any owner. No other actor in this census controls that many grades with one configuration change.

Why do parked domains fail the checks?

Because almost every check we run measures something a parking page has no commercial reason to provide.

Think about what a parked domain needs to do: resolve, serve a page of links, maybe show a sales banner. That requires an A record and a web server. It does not require DMARC, because the provider isn’t sending mail as your domain. It does not require HSTS or a content security policy, because there is no user session to protect. It does not require DNSSEC, because signing two million transient zones is operational cost with zero ad revenue attached. Every one of those absences is a failed or defaulted check, and the checks add up to an F.

The catch is that the internet does not know your domain is “only” parked. Mail servers receiving a message claiming to come from your parked domain evaluate it like any other sender — and a domain with no SPF and no DMARC policy offers a receiving server nothing to reject forgeries with, which is what makes parked names attractive raw material for spoofing. (That attacker preference is industry knowledge; our census measures the missing records, not the abuse.) A parked domain is often an aged domain with history and even residual reputation. Unprotected, it is exactly the kind of name worth borrowing.

There is a second cost, quieter and closer to home. Parked domains are, by definition, domains someone intends to use someday. When that day comes — the project launches, the brand activates, the buyer takes delivery — the domain starts its working life from the posture measured here: bottom of the F band, nothing configured, everything default. The parking period isn’t neutral storage. It is time spent at the worst measurable baseline.

How big is the parked web really?

Bigger than our number. This is the mandated caveat and it deserves its own section: 2,147,113 is a floor, not a census of parking.

We detect parking by nameserver delegation to five specific, well-known parking providers. That method is precise — a domain on ParkingCrew’s nameservers is unambiguously parked — but it is nowhere near exhaustive. It cannot see domains parked on their registrar’s default page, which never leave the registrar’s own nameservers. It cannot see marketplace or registrar-branded parking programs that run on generic infrastructure. It cannot see self-parked domains pointed at a “coming soon” page. Industry estimates of the parked share of the web vary widely and we will not launder one through this report; what we can say from our own data is that the five-provider cohort alone is over two million domains, and every parking arrangement we cannot detect shares the same structural incentive to fail the same checks.

Read the headline accordingly. Not “2.1 million domains are parked” — rather, “the 2.1 million parked domains we can identify with certainty grade F at 91.3%, and there is no reason to expect the parked domains we cannot identify to differ.”

How we measured this

• Population and denominator: 2,147,113 graded domains whose delegated nameservers matched one of five known parking providers (Sedo, ParkLogic, Bodis, ParkingCrew, Above), drawn from the 376,928,781 graded domain rows in the August 2026 census round (432.1M scanned; the row basis carries roughly 0.75% re-scan duplicates, immaterial to any rate here), methodology v9, figures as of 16 August 2026.
• Detection method: nameserver-string matching against the five providers’ parking NS infrastructure. This is a high-precision, low-recall method: registrar default parking, marketplace parking on generic infrastructure, and self-parking are all invisible to it. The 2.1M cohort is a floor on the parked universe, not an estimate of it.
• Grading: parked domains are graded by the same 34-check methodology as every other domain — no parking-specific adjustment in either direction. A parked domain that passed the checks would grade well; almost none do.
• Comparator figures (78.3% F, 1.54% B-or-better, etc.) use the graded-rows basis of 376,928,781 rows. The live site’s headline F figure uses a different basis that counts dead domains as F; we use the graded-rows basis throughout this article so the parked cohort and its comparator share one denominator.
• Small-cohort caution: per-provider findings are population-scale for Sedo (1.16M) and ParkLogic (976.7K), directional for ParkingCrew (9.1K), and anecdotal for Above and Bodis. Nameserver matching may capture some non-parking use of a provider’s infrastructure, which matters most in the smallest cohorts.
• Attacker-preference framing: the claim that unprotected parked domains are attractive for spoofing is industry knowledge; the census measures configuration, not abuse events.
• Vantage: all measurements from our EU scanning infrastructure at capture time, one census round.
• Aggregate only. We name parking providers as infrastructure operators. We never name, grade or publish data about an individual registrant’s domain.
• Data is stored and processed within the EU.

FAQ

Are parked domains a security risk? The parked domain itself usually hosts nothing sensitive, but its configuration is a standing invitation: in the August 2026 census, 91.3% of 2,147,113 identifiable parked domains graded F, which typically means no email authentication and no meaningful web hardening. A parked name with no SPF or DMARC can be used in email spoofing while its owner assumes “parked” means “inert.” It doesn’t.

Why do parked domains score so badly on security checks? Because the parking provider’s nameservers answer for everything, and the provider’s default configuration serves only what parking needs — a resolving name and an ad page. Email authentication, DNSSEC, HTTPS hardening and security headers cost the provider effort and earn no ad revenue, so the defaults omit them and every parked domain inherits the omission. The result in our data: 99.91% of parked domains at D or worse.

Does the choice of parking provider affect security? Measurably. In our five-provider cohort the F rate ranges from 86.0% (Sedo, 1.16M domains) to 99.0% (ParkingCrew, 9.1K domains), and the differences come from provider defaults rather than owner action. But no provider in the data offers a good baseline — the best large-cohort outcome still leaves the overwhelming majority of its domains at F.

How many parked domains are there on the internet? More than we can count. Our census identifies 2,147,113 graded domains parked with five specific providers via their nameservers — a deliberate floor. Domains parked at their registrar’s default page or on generic infrastructure are undetectable by this method, so the true parked universe is substantially larger.

I’m parking a domain I plan to use later. What should I do? Two cheap moves. First, publish restrictive email records even while parked — an SPF record of v=spf1 -all and a DMARC policy of p=reject tell the world your parked domain sends no mail, closing the spoofing gap for free. Second, when you activate the domain, treat its posture as starting from zero, because it is: the parked baseline is the bottom of the F band, and everything above it has to be configured deliberately.

What This Means

For business owners and IT managers with a domain portfolio, the most immediate takeaway is that parking is not neutral storage. Every domain you park inherits the provider’s security defaults — and those defaults, across every provider in this census, range from poor to nearly non-existent. A parked domain with no SPF or DMARC is an open invitation for email spoofing: someone can send fraudulent emails appearing to come from your domain while you assume it is safely sitting idle. That exposure exists whether the domain is idle for a week or for years.

The provider-gap finding matters for anyone who manages domain portfolios for a business or brand-protection programme. Sedo’s 86.0% F rate versus ParkLogic’s 97.8% is a difference in the provider’s default nameserver configuration, not in what owners do. If you use multiple parking providers and assume the security outcome is uniform, this data says it is not. But it is also worth being clear about the ceiling: even the “best” large provider in this dataset leaves the vast majority of its domains at F. Switching providers is not a security strategy; it is a marginal difference within a uniformly poor range.

For security teams conducting third-party risk assessments or monitoring brand impersonation, the parked domain population is a meaningful threat surface. A brand with dozens of defensively registered parked domains, none of them publishing DMARC, is exposing each of those names to spoofing. The fix — v=spf1 -all and p=reject DMARC — takes minutes per domain and can be applied without changing the parking arrangement itself. The cost of not doing it is accepting that your brand names are spoofable indefinitely.

Data to Cite

• “91.3% of 2,147,113 identifiable parked domains graded F in the August 2026 census — compared to 78.3% across the general web.” — defaults.exposed August 2026 Domain Security Census (432M domains)
• “99.91% of parked domains graded D or worse — only 1,675 of 2,147,113 parked domains reached a C grade or better.” — defaults.exposed August 2026 Domain Security Census (432M domains)
• “Exactly one parked domain out of 2.1 million measured earned an A grade in the August 2026 census.” — defaults.exposed August 2026 Domain Security Census (432M domains)
• “A randomly chosen graded domain is about 37 times more likely to score C or better than a parked one, and roughly 1,900 times more likely to reach B or better.” — defaults.exposed August 2026 Domain Security Census (432M domains)
• “F rates among parking providers range from 86.0% (Sedo, 1.16M domains) to 99.0% (ParkingCrew, 9,109 domains) — the difference is in the provider’s defaults, not the owners’ choices.” — defaults.exposed August 2026 Domain Security Census (432M domains)
• “The 2,147,113 identified parked domains is a floor — domains parked at registrar defaults or on generic infrastructure are undetectable by nameserver matching.” — defaults.exposed August 2026 Domain Security Census (432M domains)

See where your own domain stands

A parked domain inherits its provider’s defaults; an active domain deserves better than defaults at all. Our census grades real, live domains across 34 externally observable security checks, and most of what a failing domain is missing is free and quick to fix — the barrier is almost never cost, it’s that nobody told the owner it mattered. You can check your domain privately and free, and see exactly which checks you pass.

Check your domain →

Read the flagship census report: The State of Domain Security 2026 →

Related reading: The Internet’s Dead Domains · The Internet Security Grade Curve · The Fully Protected Few

Aggregate data only. Data stored and processed in the EU.

Check your domain free at defaults.exposed — see whether your active domain is starting from the same near-zero baseline that parked domains inherit, and find out exactly which of the 34 security checks you pass or fail. Takes 30 seconds. No account needed.

How to cite this report

Press / blog: defaults.exposed (2026). Parked Domains: 91% Grade F Across 2.1 Million Measured. defaults.exposed August 2026 Domain Security Census (432,127,908 domains scanned, asOf 2026-08-16). Retrieved from https://defaults.exposed/en/articles/parked-and-exposed

Academic: defaults.exposed. (2026, August 18). Parked Domains: 91% Grade F Across 2.1 Million Measured. In defaults.exposed Domain Security Census: August 2026. https://defaults.exposed/en/articles/parked-and-exposed

In-line citation: (defaults.exposed, August 2026 Domain Security Census, n=2,147,113)

About the defaults.exposed August 2026 Census

The defaults.exposed Domain Security Census is a recurring independent measurement of the public domain namespace. The August 2026 edition scanned 432,127,908 domains between 1–16 August 2026 and graded 376,928,781 of them using methodology v9. Scans are conducted from EU infrastructure. No individual domain, registrant, or business is named in any report. All figures are aggregate distributions. Data is stored and processed within the EU.

Methodology: defaults.exposed/en/articles/domain-security-scoring-methodology-v9 Full census report: defaults.exposed/en/articles/the-state-of-domain-security-2026