Defaults.Exposed › August 2026 Research › Data
Domain security statistics — August 2026 (v9)
As of August 2026, 78.3% of 377M graded domains score an F, and fewer than 0.15% score an A — Defaults.Exposed August 2026 census of 432,115,044 domains across 890 TLDs.
This is a permanently pinned snapshot of the August 2026 (v9) census. Every figure below is dated and individually linkable. Download the underlying aggregates as /v9/data/census.json or /v9/data/tld-grades.csv, or explore interactively at Census Explorer.
Grade distribution
As of August 2026 · August 2026 (v9)
¶ The census reached 1,471 top-level domains. 890 of them have at least 100 graded domains and are reported here; the remaining 581 are too small for a percentage to be stable, so they are counted in the totals but not broken out.
¶ As of August 2026, the August 2026 (v9) census has graded 376,928,750 domains (377M) drawn from 432,115,044 registered domains (432M) across 890 TLDs.
¶ 78.3% of graded domains score an F — 295,157,813 domains.
¶ Fewer than 0.15% score an A or A+ (549,635 domains); an A+ is rarer still at 0.02%.
¶ 24.5% of registered domains no longer resolve (92,327,088 dead domains).
Email authentication
As of August 2026 · August 2026 (v9)
¶ Only 9.3% of domains publish an enforcing DMARC policy (quarantine or reject).
¶ 80.0% have no DMARC record at all, leaving them open to email spoofing.
¶ 38.8% publish an SPF record; 61.2% publish none.
¶ 49.8% have a discoverable DKIM selector.
DNS & infrastructure
As of August 2026 · August 2026 (v9)
¶ Only 5.0% of domains have a valid DNSSEC chain; a further 0.0% are signed but broken.
¶ 1.5% publish a CAA record restricting which CAs may issue their certificates.
¶ 23.8% publish an AAAA record (IPv6-reachable).
TLS & web security
As of August 2026 · August 2026 (v9)
¶ 61.4% of domains serve over HTTPS.
¶ Of domains serving HTTPS, 90.5% present a valid, trusted certificate (55.5% of all graded domains).
¶ 94.9% of HTTPS-serving domains negotiate TLS 1.3; 5.1% top out at TLS 1.2.
¶ Only 18.8% of HTTPS-serving domains send an HSTS header (11.5% of all graded domains).
Cite this
Statistics from the August 2026 (v9) census. This URL is permanently pinned — figures will never change.
Defaults.Exposed, "Domain Security Census — August 2026 (v9)" (as of August 2026). https://defaults.exposed/v9/data
Permalink: https://defaults.exposed/v9/data · Machine-readable: /v9/data/census.json, /v9/data/tld-grades.csv · Licence: open data
Explorer: /v9/explore — filter by TLD + security check, shareable permalinks · Methodology: /v9/methodology · All articles: /v9/articles
Current live census data (updated monthly): /data.