Defaults.Exposed › Reports

The B Ceiling: Where the Climb to an A Grade Stalls

Published 2026-08-18

Figures as of 2026-08-16 · methodology v9. This is a recurring report; each edition re-measures the same population so the numbers can be tracked over time. All figures are aggregate — we never publish an individual business’s grade.

The ceiling: eleven Bs for every A

5,821,014 domains score between 80 and 89 on our 100-point security assessment — one band below an A — while only 549,635 score 90 or above. For every domain that clears the A bar, roughly eleven are stuck at a B. So we pulled the failure records for both cohorts, check by check, to find out what the wall is actually made of.

The answer surprised us. The checks that B-band domains fail most often — CAA, CSP, the TLS extras — turn out to be the wrong suspects, because A-band domains fail them at nearly the same rate. The check that genuinely separates a B from an A is quieter than any of those. It is a single line of DNS text that costs nothing and takes five minutes: a DMARC reporting address.

Key numbers

• 5,821,014 domains (1.54% of the 376.9 million we graded) score in the B band, 80–89. Only 549,635 (0.15%) score 90 or above.
• For every A-grade domain on the measured internet, roughly eleven domains sit in the B band.
• The widest B-to-A gap is DMARC reporting: 34.4% of B-band domains fail it, against roughly 7% of A-band domains — the largest differential of any of the 29 checks we compared.
• 86.0% of B-band domains have no CAA record. So do 66.7% of A-band domains. High B-band failure alone doesn’t make a check the gate.
• Three in four B-band domains (72.1%) fail DNSSEC, versus 56.4% of A-band domains — the second-biggest genuine differentiator after email policy and reporting.
• 90.0% of B-band domains fail the TLS-extras block (OCSP stapling and its siblings). 83.1% of A-band domains fail it too. Almost nobody passes, at any grade.

What does a B-grade domain actually fail?

A B is a good score. Under methodology v9’s bands (A+ ≥95, A ≥90, B ≥80), a B-band domain has working HTTPS, a valid certificate, sane TLS, SPF, and usually an enforced DMARC policy. It sits in roughly the top 2% of everything we measured; the top 1% of the entire internet starts at a score of 82, inside this band. These are the domains that did nearly everything right and stopped one flight of stairs from the top.

Here is the full comparison: the share of each cohort failing each check, sorted by B-band failure rate. B-band denominator 5,821,014; A-band denominator 549,635.

* These four checks record identical fail counts within each band (5,240,709 in B; 456,854 in A), which tells you they succeed or fail together as one deep-TLS probe block. We treat them as a single line.

Read the table top-down and you get one story: B-band domains fail CAA, CSP and the TLS extras in overwhelming numbers. Read the right-hand column and you get a different one.

Which checks actually separate a B from an A?

A check can only be the ceiling if A-grade domains pass it and B-grade domains don’t. By that standard, most of the loud failures are acquitted. The four checks with the biggest cohort gaps:

1. DMARC reporting — a ~27-point gap. 34.4% of B-band domains publish DMARC without a reporting (rua) address, or with reporting the check scores as failing. Among A-band domains that figure collapses to roughly 7%. No other check moves anywhere near this much between the two bands.
2. CAA — a 19.3-point gap. Still failed by most of both cohorts, but it is one of the few checks where the A band has clearly pulled away: 66.7% failing versus 86.0%.
3. DMARC policy — a ~14-point gap. Roughly 15% of B-band domains fail the policy check; in the A band it is roughly 1%. Essentially every A-grade domain has DMARC enforcement squared away.
4. The DNSSEC pair — ~15.7 points each. DS and DNSKEY move in lockstep (you need both, correctly chained, to pass): roughly 72% of the B band fails, against roughly 56% of the A band.

We went in expecting DNSSEC, CAA and CSP to be the wall, and two of the three show up. But the biggest single differentiator is neither cryptography nor headers. It is the feedback loop. Domains that reach an A have overwhelmingly done the DMARC job completely: policy enforced and reports collected. Domains parked at a B have often done the visible half — a policy line that satisfies a compliance checklist — and skipped the part that tells them whether it works.

There is a practical corollary hiding in that. A rua= tag is a free addition to a DNS record you already have. Of the four gap checks, it is the only one with no operational risk: DNSSEC can break resolution if botched, CAA can block a renewal if misconfigured, but a reporting address just receives XML. The cheapest, safest fix on the list is also the statistically strongest marker of the A band.

Why doesn’t fixing CSP get you over the line?

CSP is the instructive counter-example. 83.8% of B-band domains fail the CSP check. Surely that’s the ceiling?

It can’t be, because 77.2% of A-band domains fail it too. A 6.6-point gap means CSP does relatively little work in separating the two cohorts; the grade math evidently reaches 90+ without it in the great majority of cases. The same pattern holds for HSTS (49.2% vs 46.2% — a narrow gap), X-Frame-Options, and the TLS-extras block, which 83.1% of A-grade domains fail.

These are the checks nobody passes. They tell you about the state of the internet, not about the boundary between B and A. If your domain scores 84 and you want 90, the table says your effort is better spent on the gap checks than on chasing a Content-Security-Policy that most of the elite doesn’t have either.

One oddity is worth naming rather than hiding: A-band domains fail the HTTP→HTTPS redirect check more often than B-band domains (34.2% vs 32.3%). The fail counts are what methodology v9 recorded; we don’t smooth them. A plausible reading is compositional — the A band skews toward configurations (apex domains without a conventional port-80 web presence, for instance) where this check bites differently — but we have not decomposed it this round, so treat the inversion as an observation, not an explanation.

Is DNSSEC the hard part?

It is the hard part that behaves like a hard part. The DS and DNSKEY checks show the same ~15.7-point gap, both cohorts fail them at high rates, and unlike CAA or a rua tag, DNSSEC failure has a structural excuse: signing requires support from your DNS operator and a DS record placed at the registry through your registrar, and not every registrar/registry/host combination makes that possible, let alone easy. (That dependency chain is industry knowledge, not census data.)

The numbers still carry a clear message. Even among the ~549,000 best-scoring domains on the internet, 56.4% have no valid DNSSEC chain. In the B band it is 72.1%. Passing DNSSEC is one of the stronger statistical markers of the A band, and it remains a minority behaviour inside the A band itself. The elite of the measured internet mostly runs unsigned DNS.

What this means if your domain scores in the 80s

The B ceiling, in order of measured leverage and ascending effort:

1. Add a rua address to your DMARC record. Five minutes, zero risk, and it closes the single widest gap between the B and A cohorts.
2. Finish DMARC enforcement. The A band is at roughly 99% pass on the policy check. If you are at p=none, you are carrying a B-band signature.
3. Publish a CAA record. One DNS record naming your certificate authority. Most of the A band still hasn’t; the third that has is part of what makes it the A band.
4. Sign your zone. DNSSEC is the heaviest lift on the list and the one that most depends on your providers, but the ~15.7-point gap is real.

None of the first three costs money. That is the recurring finding of this census, and it holds at the top of the distribution just as it does at the bottom: the barrier is awareness, not cost.

How we measured this

• Population and basis: 376,928,781 graded domains from the August 2026 census round (methodology v9, figures as of 2026-08-16). Our live-site headline figures use a broader basis that also grades dead domains as F; this article uses the graded basis throughout, and all percentages state their denominator.
• Cohorts: B band = score 80–89 (n = 5,821,014); A band = score ≥90 (n = 549,635), both taken from the score histogram of the same round. Grade bands under v8: A+ ≥95, A ≥90, B ≥80.
• Fail counts are per-check failure records for each cohort from the August 2026 band-failure extract (b47). A recorded “pass” is not the same as presence: several checks pass legitimately when a feature is absent, which is why, for example, the mx-record check shows near-zero failures in both bands. We compare fail rates between cohorts measured identically, so the semantics cancel. Values marked ”~” are estimates from the available b47 data; exact figures for checks not in the top-10 b47 list are approximate.
• The TLS-extras block (OCSP stapling, cipher strength, secure renegotiation, TLS compression) records identical fail counts within each band (5,240,709 in B; 456,854 in A), indicating the four outcomes are produced by one probe path. We present them as one line and draw no per-check conclusions inside the block.
• A-band denominator note: the b47 extract uses the grade-column A count (477,419) as denominator; this article uses the score-histogram A-band (549,635, score ≥90) as stated above. Percentages derived from b47 fail counts are recalculated to the histogram denominator for consistency.
• Vantage and limits: externally observable checks only, scanned from our EU infrastructure. This is a cross-sectional comparison of two score cohorts from one round; it identifies which checks statistically separate the bands, not the causal path any individual domain took.
• Aggregate only. We never publish an individual business’s grade. Data is stored and processed within the EU.

What this means

For IT managers and security leads whose domains score in the B band, the data provides a specific, prioritised action list that is more useful than a general security checklist. The finding that DMARC reporting is the single biggest statistical separator between B and A means the correct first move is not to tackle DNSSEC or CSP — it is to add a rua= tag to a DMARC record you almost certainly already have. That tag causes your mail receivers to send aggregate reports about what is claiming to be your domain. It costs nothing, takes five minutes, and closes the widest gap in the data.

For security teams building compliance dashboards or vendor scorecards, the distinction between checks that separate the two bands and checks that every domain fails is operationally important. If your scoring system flags CSP as a critical gap for a B-grade domain, it is flagging something 77% of A-grade domains also fail. That is noise. The real gaps that distinguish good from excellent, as of August 2026, are DMARC reporting completeness, DMARC enforcement, CAA publication, and DNSSEC signing — in that order by measured leverage.

For organisations using domain security grades as a proxy for vendor security posture, a B-grade supplier is not one step from excellent. It is two to four specific DNS configurations from the A band, and those configurations are directly observable. Asking a supplier for their DMARC reporting address and their CAA record is a faster, more targeted assessment than asking for a security questionnaire.

Data to cite

• “5,821,014 domains — 1.54% of the 376.9M graded — score in the B band (80–89), but only 549,635 (0.15%) score 90 or above: roughly eleven B-band domains for every A-grade one.” — defaults.exposed August 2026 Domain Security Census (432M domains)
• “The widest B-to-A gap in the census is DMARC reporting: 34.4% of B-band domains fail it versus roughly 7% of A-band domains — a ~27 percentage-point differential, the largest of any check compared.” — defaults.exposed August 2026 Domain Security Census (432M domains)
• “86.0% of B-band domains have no CAA record — but so do 66.7% of A-band domains, showing high failure alone does not make a check the B-to-A ceiling.” — defaults.exposed August 2026 Domain Security Census (432M domains)
• “72.1% of B-band domains fail DNSSEC versus 56.4% of A-band domains — the second-biggest genuine differentiator, but also the one that depends on registrar and registry support.” — defaults.exposed August 2026 Domain Security Census (432M domains)
• “90.0% of B-band domains fail the TLS-extras block — and 83.1% of A-band domains fail it too, meaning it is a check almost nobody passes at any grade level.” — defaults.exposed August 2026 Domain Security Census (432M domains)
• “A score of 82 is already enough to be in the top 1% of the entire measured internet — the B band is the internet’s security near-elite, one deliberate afternoon of DNS work from the A threshold.” — defaults.exposed August 2026 Domain Security Census (432M domains)

FAQ

What score is a B grade in domain security? Under our methodology v9 bands, a B is a score of 80–89 out of 100, with an A starting at 90 and A+ at 95. As of August 2026, 5,821,014 domains — 1.54% of the 376.9 million we graded — sat in the B band, and a score of 82 was already enough to be in the top 1% of the entire measured internet.

Is a B grade good enough for a business domain? It puts you ahead of roughly 98% of measured domains, with HTTPS, certificates and core email authentication typically in place. What the B band characteristically lacks, relative to the A band, is the finishing layer: DMARC reporting (34.4% of Bs fail it), full DMARC enforcement (~15%), CAA (86.0%) and DNSSEC (72.1%). Whether that layer matters depends on how much your business runs on its domain’s mail and name integrity.

What should I fix first to get from a B to an A? The data says: your DMARC record. Adding a reporting (rua) address closes the widest measured gap between the two cohorts (34.4% vs ~7% failing), and completing enforcement closes the third-widest (~15% vs ~1%). Then CAA, then DNSSEC. Chasing CSP or HSTS first is statistically inefficient — most A-grade domains fail those too.

Why do A-grade domains still fail so many checks? Because a 90+ score doesn’t require passing everything, and some checks are failed by nearly the whole internet. 83.1% of A-band domains fail the TLS-extras block, 77.2% fail CSP, and 56.4% have no valid DNSSEC chain. An A means a domain passed far more than almost everyone else, not that it passed it all.

How many domains actually have an A grade? 549,635 out of 376,928,781 graded — 0.15% — scored 90 or above as of August 2026, of which 72,216 reached A+ (95+). For each of those A-band domains, roughly eleven more sit in the B band, one deliberate afternoon of DNS work from the boundary.

Is the B-to-A gap consistent with July 2026? This report uses the August 2026 round (asOf 2026-08-16). The structural pattern — DMARC reporting as the dominant B-to-A differentiator, DNSSEC as the second — is consistent with prior rounds. Absolute counts for B-band and A-band domains may shift as domains are configured and lapse between rounds.

Can I move from a B to an A without a security budget? Yes. The top three gap checks — adding a DMARC reporting address, completing DMARC enforcement, and publishing a CAA record — cost nothing. Only DNSSEC may involve effort coordinating with your DNS provider and registrar. The census consistently shows that the B-to-A boundary is a configuration gap, not a spending gap.

See where your own domain stands

If you are anywhere near the ceiling, the census can tell you exactly which side of these gaps you are on. The check is private, free, and shows every one of the checks discussed above with a pass or fail for your domain — and most of the B-to-A fixes cost nothing but attention.

Check your domain free at defaults.exposed — find out whether you are in the B band, what your exact score is, and which of the four gap checks (DMARC reporting, DMARC enforcement, CAA, DNSSEC) you are currently missing. Takes 30 seconds. No account needed.

The Top 1% of the Internet Starts at a B →

Related in this series: The Internet Security Grade Curve · The Fully Protected Few

Aggregate data only. Data stored and processed in the EU.

How to cite this report

Press / blog: defaults.exposed (2026). The B Ceiling: Where the Climb to an A Grade Stalls. defaults.exposed August 2026 Domain Security Census (432,127,908 domains scanned, asOf 2026-08-16). Retrieved from https://defaults.exposed/en/articles/the-b-ceiling

Academic: defaults.exposed. (2026, August 18). The B Ceiling: Where the Climb to an A Grade Stalls. In defaults.exposed Domain Security Census: August 2026. https://defaults.exposed/en/articles/the-b-ceiling

In-line citation: (defaults.exposed, August 2026 Domain Security Census, B-band n=5,821,014; A-band n=549,635)

About the defaults.exposed August 2026 Census

The defaults.exposed Domain Security Census is a recurring independent measurement of the public domain namespace. The August 2026 edition scanned 432,127,908 domains between 1–16 August 2026 and graded 376,928,781 of them using methodology v9. Scans are conducted from EU infrastructure. No individual domain, registrant, or business is named in any report. All figures are aggregate distributions. Data is stored and processed within the EU.

Methodology: defaults.exposed/en/articles/domain-security-scoring-methodology-v9 Full census report: defaults.exposed/en/articles/the-state-of-domain-security-2026