Most domains fail basic security checks in new census

Defaults Exposed says 74.2% of 316.6 million graded domains failed its September 2026 security census. The findings point to widespread gaps in email authentication, encryption, DNS and web hardening that leave domains exposed to impersonation and other attacks.

Why it matters: - The census suggests basic domain security is still far from the default, even for infrastructure that underpins email, websites and certificate trust. - The biggest exposure is not a single flaw. Most failing domains miss multiple controls at once, which makes them easier to impersonate, spoof or redirect. - Email gaps have the clearest real-world cost because business email compromise often depends on a sender domain that does not enforce anti-spoofing rules.

What happened: - Defaults Exposed published its September 2026 domain security census on 8 September 2026. - The census scanned 347,691,016 domains and graded 316,600,902 of them. - 234,955,475 domains, or 74.2% of graded domains, received an F as of 5 September 2026. - The grade combines 34 checks across email authentication, TLS and certificates, web security, DNS and infrastructure. - Twenty-five of the 34 checks count toward the final score. - A domain below 60% receives an F, and a domain at 95% or above receives an A+. - The methodology is available here.

The details: - 67.0% of graded domains serve content over HTTPS. - Among domains that use HTTPS, 89.1% present a valid, trusted certificate. - Roughly 40% of all graded domains still lack a valid, trusted certificate, which means a browser cannot confirm it reached the real site. - 75.2% of domains publish no DMARC record. - Only 11.6% publish an enforcing DMARC policy of p=quarantine or p=reject. - 46.4% publish a syntactically valid SPF record. - 6.86% have a valid, fully validating DNSSEC chain. - 1.4% publish a CAA record that limits which certificate authorities may issue certificates in their name. - Of the 125.8 million domains whose page answered a request directly, fewer than one in five send common browser-hardening headers. - 17.8% send X-Content-Type-Options. - 15.3% send clickjacking protection. - 10.1% send a Content-Security-Policy header. - 7.91% send a Referrer-Policy header. - Across the full census, 94.3% of the 233,574,031 domains that scored F fail the DMARC policy check. - 53% of domains with a DMARC record still use p=none, the monitoring-only setting. - The FBI Internet Crime Complaint Center logged 21,489 business email compromise complaints in 2023, with $2,946,830,270 in adjusted losses. - The average loss was about $137,000 per complaint. - The aggregate dataset is at defaults.exposed/v10/data.

Between the lines: - The results show that many domain owners handle one security layer, such as HTTPS, while leaving email, DNS and browser defenses weak. - That pattern matters because attackers usually need only one weak point to make a fake domain or forged message look legitimate. - The low rate of enforcing DMARC stands out because it is one of the clearest steps for reducing exact-domain email impersonation. - The small share of DNSSEC and CAA adoption suggests certificate and DNS trust protections are still niche rather than routine.

What's next: - Defaults Exposed says the census updates monthly. - Anyone can run a free scan at defaults.exposed, with results returned in about a second and no account or email required. - The scan uses the same 34-check engine as the census and provides plain-English fix guidance for each failed check at defaults.exposed/fix. - The service says most fixes require only a DNS record or a single line of web-server configuration. - The current census data and full methodology remain available on the site.

The bottom line: - Three out of four graded domains still miss basic security controls, and the weakest links are spread across email, DNS and web hardening rather than concentrated in one area.