The Locked Vault: Only 10.9 Million Domains Close Every Attack Surface Simultaneously

Q: What should my organisation check first if a vendor domain has zero controls?

Ask for their DMARC record and SPF record by checking _dmarc.yoursupplier.com and the TXT record at yoursupplier.com directly. If neither exists, their domain can be spoofed freely. Escalate this as a supplier risk finding before any financial transactions, because invoice fraud and impersonation attacks exploit exactly this gap.

Published 2026-08-20

The Locked Vault: Only 10.9 Million Domains Close Every Attack Surface Simultaneously

The August 2026 census graded 376,928,750 domains against five independently measurable controls. Of those, 10,902,284 passed all five simultaneously — 2.9% of the total population. At the opposite extreme, 1,235,352 domains failed every single control — 0.33%. These two cohorts define the outer edges of internet security posture. Everything else sits somewhere between them.

The finding that matters is not the gap itself. The finding is what the gap reveals: closing all five controls requires no technical capability that is unavailable to any domain operator today. Every control is open-standards-based. Four of the five cost nothing to deploy. The fifth, DNSSEC, requires only registry support and a correct key publication. The 97.1% of domains that have not yet closed all five have not been blocked by technical constraints. They have not made the operational decisions.

The Five Controls and Why This Combination Matters

The exposure model used by the census measures five discrete attack surfaces. Each represents a published standard with a specific threat model.

SPF (Sender Policy Framework, RFC 7208) authorises which mail servers may send email for a domain. Without an SPF record, any server on the internet can claim to originate email from your domain. SPF publication takes minutes. SPF failure leaves email recipients with no mechanism to distinguish legitimate mail from spoofed mail at the envelope level.

DMARC with an enforcing policy (RFC 7489) builds on SPF and DKIM to give the receiving mail server an explicit instruction: what to do when authentication fails. A DMARC record at p=none collects reports but does not block spoofed mail. Only p=quarantine or p=reject constitutes enforcement. The census counts only enforcing DMARC as a pass, because advisory records do not reduce spoofing risk operationally.

DNSSEC (RFC 4033, RFC 4034, RFC 4035) signs DNS records cryptographically so that resolvers can verify the integrity of responses. Without DNSSEC, an attacker with a position on the path between a resolver and an authoritative nameserver can inject forged DNS responses, redirecting traffic without the victim’s knowledge. DNSSEC is the only control in the five that requires action from the domain registry as well as the operator, which explains its lower adoption rate relative to the others.

HTTPS (HTTP over TLS, RFC 2818) encrypts the connection between a browser and a web server. It is the baseline transport security control for any web-present domain. Its absence exposes session data and user credentials to passive interception.

HSTS (HTTP Strict Transport Security, RFC 6797) tells browsers that this domain must always be contacted over HTTPS, even if the user types a plain HTTP URL. Without HSTS, a downgrade attack can strip TLS from the initial connection before the browser has been redirected. HSTS converts a redirect-based protection into a browser-enforced guarantee.

These five controls are not redundant. They address four distinct threat categories: email spoofing (SPF, DMARC), DNS tampering (DNSSEC), network interception (HTTPS), and connection downgrade (HSTS). A domain that has deployed four of the five has not closed four-fifths of its attack surface. It has left a complete threat category open.

Profile of the Fully Protected Cohort

The 10.9 million fully protected domains share characteristics that are consistent across the census data.

Operator size correlates strongly with full coverage. Commercial and enterprise domains registered by organisations with dedicated IT or security functions appear in this cohort at a rate substantially above their share of the total population. The operational overhead of deploying and maintaining five controls favours organisations that have someone responsible for doing so.

Geographic and linguistic concentration is visible. English-speaking markets, particularly the United States, United Kingdom, Australia, and Canada, contribute disproportionately to the fully protected population. This reflects both the concentration of enterprise infrastructure in those markets and the earlier adoption of HTTPS requirements and email authentication by mail providers and browser vendors in those regions.

Registration recency matters. Domains registered after 2015 are more likely to appear in this cohort. Hosting providers and domain registrars began offering one-click HTTPS via Let’s Encrypt from 2016 onward, and modern control panels increasingly expose DMARC and SPF configuration as guided setup steps rather than raw DNS edits. Newer domains therefore inherit better defaults.

TLD composition skews toward commercial gTLDs. The .com, .io, and .co.uk namespaces are overrepresented relative to their share of the total graded population. Long-tail ccTLDs with smaller registry ecosystems and older operator demographics appear less frequently.

These are tendencies, not rules. The cohort includes small operators, personal projects, and non-commercial sites that have simply made the right five decisions. The controls themselves do not discriminate by operator size.

Profile of the Fully Exposed Cohort

The 1,235,352 domains that fail all five controls present a starkly different profile.

The most prevalent category is abandoned or parked domains. Domains registered and never actively developed, or developed and then let lapse into parking pages, typically retain their DNS delegation while accumulating none of the security configuration that active management would provide. SPF records are not added by default at registration. DMARC is not configured automatically. HTTPS requires a web server with a valid certificate. HSTS requires HTTP response headers. DNSSEC requires deliberate key management. Inaction across all five produces a domain in this cohort.

Small and micro-operators with no dedicated technical resource make up a second significant category. A domain registered for a sole-trader business, a community organisation, or a personal portfolio, maintained by someone whose primary skill is not infrastructure, will often lack all five controls years after registration.

Long-tail ccTLDs appear frequently in this cohort, particularly those with older average registration ages and lower penetration of managed DNS providers.

Critically, this cohort represents an active threat to other organisations even if the domain owner considers the domain inactive. A domain with no SPF record can be trivially used as the spoofed sender domain in phishing campaigns. A domain with no DMARC enforcement provides receiving servers with no instruction to reject such mail.

The Five-Step Hardening Path

Moving from the fully exposed cohort to the fully protected cohort requires five decisions in a workable order.

Step one: SPF. Publish a TXT record at the domain root that lists the mail servers authorised to send for that domain. For a domain that sends no email, v=spf1 -all is the correct record. For domains with active mail flows, enumerate the sending infrastructure.

Step two: DMARC at enforcement. Add a _dmarc TXT record. Begin at p=none with a rua reporting address to collect aggregate reports. Review the reports for two to four weeks to confirm that all legitimate mail streams are passing SPF or DKIM alignment. Then move the policy to p=quarantine or p=reject. Staying at p=none indefinitely provides visibility without protection.

Step three: HTTPS. Obtain and install a TLS certificate. Let’s Encrypt provides certificates at no cost with automated renewal via ACME clients. Redirect all HTTP traffic to HTTPS at the server layer.

Step four: HSTS. Add the Strict-Transport-Security response header to all HTTPS responses. Begin with max-age=300 for a short validation window, extend to max-age=31536000 once confirmed. Consider submitting qualifying domains to the HSTS preload list maintained by browser vendors.

Step five: DNSSEC. Enable DNSSEC signing at the DNS provider. Publish the DS record at the parent zone through the domain registrar’s interface. Verify the delegation chain using a DNSSEC validator.

The steps are ordered by operational risk. SPF and DMARC changes affect only mail flows. HTTPS and HSTS changes affect web traffic. DNSSEC affects DNS resolution for all services on the domain. Sequencing reduces the blast radius of any misconfiguration.

Framework Requirements

The five controls are not advisory in major frameworks.

NIST Cybersecurity Framework 2.0 maps email authentication directly to the Protect function under PR.AA (Identity Management and Access Control) and PR.DS (Data Security). HTTPS is addressed under communications protection. DNSSEC appears under network integrity.

CIS Controls v8 includes email domain protection (SPF, DMARC) as a Safeguard under Control 9 (Email and Web Browser Protections). HTTPS is required under Control 12 (Network Infrastructure Management). These are Implementation Group 1 controls, meaning they apply to organisations of any size.

UK Cyber Essentials, the UK government’s baseline certification scheme, requires HTTPS for all services that handle user data. Its assessors treat missing email authentication on a customer-facing domain as a finding.

The US federal government’s binding operational directives (BOD 18-01 and successors) mandated HTTPS, HSTS, and DMARC enforcement across all federal .gov domains. The August 2026 census shows .gov as one of the higher-performing TLDs in the fully protected cohort, a direct consequence of that mandate being enforced against a defined deadline.

The Economics of Hardening

The most significant finding from the census, set against these framework requirements, is the cost structure of the five controls.

SPF: free. A single DNS TXT record. DMARC: free. A single DNS TXT record, plus a free reporting inbox. HTTPS: free via Let’s Encrypt. HSTS: free. A single HTTP response header. DNSSEC: free at the protocol level. Most registrars include DS record publication at no additional charge.

The total cash cost of deploying all five controls on a domain with an existing web server and mail configuration is, in the overwhelming majority of cases, zero. The cost is time: the time required to understand what each control does, to make the configuration changes, and to verify that they are working correctly.

The census data measures the output of those operational decisions across 376 million domains. 10.9 million operators have made all five decisions correctly. 1.2 million have made none of them.

The locked vault is not locked by technology. It is locked by attention.

Check your domain against all five controls using the defaults.exposed scanner and August 2026 census baseline.

Data: defaults.exposed August 2026 census, methodology v9, as of 2026-08-16. Total graded: 376,928,750. Fully protected (pass all five): 10,902,284 (2.9%). Fully exposed (fail all five): 1,235,352 (0.33%). Standards referenced: RFC 7208, RFC 7489, RFC 4033, RFC 4034, RFC 4035, RFC 2818, RFC 6797. Frameworks referenced: NIST Cybersecurity Framework 2.0, CIS Controls v8, UK Cyber Essentials, CISA BOD 18-01.

What this means

For CISOs and security architects, the 2.9% figure is simultaneously a benchmark and a realistic target. If your organisation’s primary domain is not in the fully protected cohort, you are in the majority — but the majority is a useful reference point precisely because the gap is small and the cost is zero. Closing all five controls on your primary domain should be a one-sprint project for most organisations: SPF and DMARC are DNS records, HTTPS and HSTS are server configuration, and DNSSEC is a registrar setting. The five-step path in this article is the correct sequence, ordered to minimise operational risk at each stage.

For IT managers running vendor risk or supply-chain assessment programmes, the fully exposed cohort — 1.2 million domains with zero controls — is the most important finding in practical terms. A supplier whose primary domain is in this cohort is maximally spoofable, meaning attackers can send email that claims to come from that supplier with no cryptographic barrier. That is not a hypothetical risk; it is the exact setup that invoice fraud and CEO impersonation attacks exploit. A supplier domain check for all five controls costs minutes and surfaces this risk before any contract is signed.

For small business owners, the framing that matters most is: the 2.9% in the fully protected cohort did not get there by spending money. They got there by making five decisions, in order, each of which is free. The first two — publishing SPF and DMARC — protect your email from being spoofed by anyone claiming to be you. The next two — HTTPS and HSTS — protect your customers’ connections to your website. The fifth — DNSSEC — protects your DNS from being hijacked. None of these require a security budget. They require about an afternoon and the knowledge of what to do.

Data to cite

“Only 10,902,284 of 376,928,750 graded domains — 2.9% — pass all five core security controls simultaneously: SPF, enforcing DMARC, DNSSEC, HTTPS, and HSTS.” — defaults.exposed August 2026 Domain Security Census (432M domains)
“1,235,352 domains (0.33% of all graded) fail every one of the five core controls — no SPF, no DMARC, no DNSSEC, no HTTPS, no HSTS — making them maximally spoofable and unprotected.” — defaults.exposed August 2026 Domain Security Census (432M domains)
“The total cash cost of deploying all five controls — SPF, enforcing DMARC, HTTPS via Let’s Encrypt, HSTS, and DNSSEC — is zero in the overwhelming majority of cases; the gap is operational, not financial.” — defaults.exposed August 2026 Domain Security Census (432M domains)
“A domain that has deployed four of the five controls has not closed four-fifths of its attack surface — it has left a complete threat category (email spoofing, DNS tampering, network interception, or connection downgrade) entirely open.” — defaults.exposed August 2026 Domain Security Census (432M domains)
“The fully exposed cohort — 1.2 million domains with zero controls — represents an active spoofing risk to other organisations even when the domain owner considers the domain inactive.” — defaults.exposed August 2026 Domain Security Census (432M domains)
“97.1% of graded domains have not closed all five attack surfaces: the barrier is not cost or technical availability, but the absence of operational decisions.” — defaults.exposed August 2026 Domain Security Census (432M domains)

FAQ

What are the five core security controls a domain should have? SPF (declares which servers may send your email), DMARC at p=quarantine or p=reject (instructs receivers to block spoofed email), DNSSEC (cryptographically signs your DNS records), HTTPS (encrypts web connections), and HSTS (prevents connection downgrade attacks). Together these close four distinct attack surfaces: email spoofing, DNS tampering, network interception, and connection downgrade.

How much does it cost to deploy all five controls? Effectively zero. SPF and DMARC are free DNS TXT records. HTTPS certificates are free via Let’s Encrypt with automated renewal. HSTS is a free HTTP response header. DNSSEC signing and DS record publication are free at most registrars. The cost is time — typically a few hours across the five steps — not money.

Why do only 2.9% of domains have all five controls if they are free? Because none of the five are defaults. Every control requires a deliberate choice: a DNS edit, a server configuration change, or a registrar setting. Parked domains, abandoned registrations, and small-operator domains where no one is actively managing the security posture accumulate zero controls over time. The 97.1% that lack full coverage have not been blocked by technical constraints; they have not made the operational decisions.

Is a domain with zero controls dangerous to other organisations? Yes, even if its owner considers it inactive. A domain with no SPF and no DMARC can be used trivially as the spoofed sender in phishing campaigns targeting your customers, partners, or employees. Receiving mail servers have no published instruction from you to reject such mail. The risk is not to the domain owner’s own systems — it is to anyone who receives email claiming to be from that domain.

How does the five-control benchmark relate to compliance frameworks? All five controls are explicitly required or strongly implied by major frameworks. NIST CSF 2.0 covers email authentication under the Protect function. CIS Controls v8 includes SPF and DMARC as Implementation Group 1 safeguards (applying to all organisation sizes). UK Cyber Essentials requires HTTPS for user-data services. US federal BOD 18-01 mandated HTTPS, HSTS, and DMARC enforcement for .gov domains. The census data shows the result of the .gov mandate: measurably higher fully-protected rates than the open market.

What should my organisation check first if a vendor domain has zero controls? Ask for their DMARC record and SPF record by checking _dmarc.yoursupplier.com and the TXT record at yoursupplier.com directly. If neither exists, their domain can be spoofed freely. Escalate this as a supplier risk finding before any financial transactions, because invoice fraud and impersonation attacks exploit exactly this gap.

Check your domain free at defaults.exposed — see which of the five core controls your domain passes, whether you are in the 2.9% fully protected cohort, and what specific steps would close any open attack surfaces. Takes 30 seconds. No account needed.

Aggregate data only. Data stored and processed in the EU.

How to cite this report

Press / blog: defaults.exposed (2026). The Locked Vault: Only 10.9 Million Domains Close Every Attack Surface Simultaneously. defaults.exposed August 2026 Domain Security Census (432,127,908 domains scanned, asOf 2026-08-16). Retrieved from https://defaults.exposed/en/articles/locked-vault-fully-protected-domains-2026

Academic: defaults.exposed. (2026, August 20). The Locked Vault: Only 10.9 Million Domains Close Every Attack Surface Simultaneously. In defaults.exposed Domain Security Census: August 2026. https://defaults.exposed/en/articles/locked-vault-fully-protected-domains-2026

In-line citation: (defaults.exposed, August 2026 Domain Security Census, n=376,928,750; fully protected=10,902,284; fully exposed=1,235,352)

About the defaults.exposed August 2026 Census

The defaults.exposed Domain Security Census is a recurring independent measurement of the public domain namespace. The August 2026 edition scanned 432,127,908 domains between 1–16 August 2026 and graded 376,928,781 of them using methodology v9. Scans are conducted from EU infrastructure. No individual domain, registrant, or business is named in any report. All figures are aggregate distributions. Data is stored and processed within the EU.

Methodology: defaults.exposed/en/articles/domain-security-scoring-methodology-v9 Full census report: defaults.exposed/en/articles/the-state-of-domain-security-2026